The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security
issues

The following security issues were fixed:

• CVE-2025-40216: io_uring/rsrc: don't rely on user vaddr alignment
  (bsc#1259764).
• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race
  (bsc#1255029).
• CVE-2025-71294: drm/amdgpu: fix NULL pointer issue buffer funcs
  (bsc#1264562).
• CVE-2026-23451: bonding: prevent potential infinite loop in
  bond_header_parse() (bsc#1261604).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31462: drm/amdgpu: prevent immediate PASID reuse case
  (bsc#1262655).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in
  softleaf_to_folio() (bsc#1267825).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports
  (bsc#1263072).
• CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC
  handling (bsc#1263581).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from
  being created (bsc#1263573).
• CVE-2026-31677: crypto: af_alg - limit RX SG extraction by receive buffer
  budget (bsc#1263560).
• CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP
  command failed (bsc#1264116).
• CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if
  PSP command failed (bsc#1263880).
• CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP
  command failed (bsc#1263879).
• CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into
  validated event handlers (bsc#1264145).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time
  (bsc#1264015).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return
  -EEXIST if exists (bsc#1264001).
• CVE-2026-43034: bnxt_en: set backing store type from query type
  (bsc#1263998).
• CVE-2026-43053: xfs: close crash window in attr dabtree inactivation
  (bsc#1264084).
• CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period
  (bsc#1264263).
• CVE-2026-43079: perf/x86/intel/uncore: Skip discovery table for offline dies
  (bsc#1264228).
• CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).
• CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
  (bsc#1264241).
• CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE
  terminator (bsc#1264230).
• CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path
  (bsc#1264286).
• CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).
• CVE-2026-43093: xsk: tighten UMEM headroom validation to account for
  tailroom and min frame (bsc#1264254).
• CVE-2026-43094: ixgbevf: add missing negotiate_features op to Hyper-V ops
  table (bsc#1264231).
• CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation
  (bsc#1264258).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock
  (bsc#1264484).
• CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path
  (bsc#1264612).
• CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
  (bsc#1264294).
• CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in
  decode_choice() (bsc#1264337).
• CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in
  tcf_skbedit_hash() (bsc#1264320).
• CVE-2026-43303: mm/page_alloc: clear page->private in free_pages_prepare()
  (bsc#1264974).
• CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves
  scope (bsc#1265113).
• CVE-2026-43420: ceph: fix i_nlink underrun during async unlink
  (bsc#1264814).
• CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave()
  (bsc#1264734).
• CVE-2026-43472: unshare: fix unshare_fs() handling (bsc#1264748).
• CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in
  mpi_read_raw_from_sgl() (bsc#1265629).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is
  queued (bsc#1266008).
• CVE-2026-45838: bpf: fix end-of-list detection in
  cgroup_storage_get_next_key() (bsc#1266396).
• CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).
• CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer
  (bsc#1266717).
• CVE-2026-45912: ext4: don't cache extent during splitting extent
  (bsc#1266899).
• CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents()
  (bsc#1266929).
• CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting
  before submitting I/O (bsc#1266700).
• CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests
  (bsc#1267430).
• CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).
• CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn
  (bsc#1267228).
• CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of
  struct (bsc#1267458).
• CVE-2026-46069: wifi: mwifiex: fix use-after-free in
  mwifiex_adapter_cleanup() (bsc#1267437).
• CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).
• CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted
  by L1 (bsc#1267365).
• CVE-2026-46112: RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
  (bsc#1267582).
• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in
  __xfrm_state_delete (bsc#1267369).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink()
  (bsc#1267640).
• CVE-2026-46124: isofs: validate block number from NFS file handle in
  isofs_export_iget (bsc#1266847).
• CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing
  (bsc#1266928).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task
  (bsc#1267722).
• CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data()
  (bsc#1266830).
• CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size
  (bsc#1267381).
• CVE-2026-46214: vsock/virtio: fix accept queue count leak on transport
  mismatch (bsc#1267717).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in
  SCTP_SENDALL (bsc#1267697).
• CVE-2026-46229: drm/amdkfd: Clear VRAM on allocation to prevent stale data
  exposure (bsc#1267567).
• CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old()
  (bsc#1267635).
• CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables
  (bsc#1267637).
• CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
  (bsc#1267684).
• CVE-2026-46289: lib/scatterlist: fix length calculations in
  extract_kvec_to_sg (bsc#1267966).
• CVE-2026-46291: crypto: caam - guard HMAC key hex dumps in hash_digest_key
  (bsc#1267937).
• CVE-2026-46315: io_uring/waitid: clear waitid info before copying it to
  userspace (bsc#1267953).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft
  (bsc#1268022).
• CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp()
  (bsc#1267993).
• CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).
• CVE-2026-46330: Revert "net/smc: Introduce TCP ULP support" (bsc#1268049).
• CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache
  (bsc#1265421).
• CVE-2026-52908: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
  (bsc#1268661).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device
  (bsc#1268660).
• CVE-2026-52918: Bluetooth: serialize accept_q access (bsc#1269100).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range
  (bsc#1269033).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve
  helpers (bsc#1269022).
• CVE-2026-52954: libceph: handle rbtree insertion error in
  decode_choose_args() (bsc#1269137).
• CVE-2026-52957: libceph: Fix potential null-ptr-deref in
  decode_choose_args() (bsc#1269103).
• CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).
• CVE-2026-52969: KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
  (bsc#1269184).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000
  (bsc#1269195).
• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269090).
• CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).
• CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full
  (bsc#1269398).
• CVE-2026-53052: ASoC: qcom: qdsp6: topology: check widget type before
  accessing data (bsc#1269314).
• CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's
  devid (bsc#1269310).
• CVE-2026-53071: Bluetooth: l2cap: Add missing chan lock in
  l2cap_ecred_reconf_rsp (bsc#1269678).
• CVE-2026-53072: Bluetooth: fix locking in hci_conn_request_evt() with
  HCI_PROTO_DEFER (bsc#1269681).
• CVE-2026-53122: btrfs: fix deadlock between reflink and transaction commit
  when using flushoncommit (bsc#1269418).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G
  (bsc#1269821).
• CVE-2026-53138: drm/amd/display: Bound VBIOS record-chain walk loops
  (bsc#1269281).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269884).
• CVE-2026-53253: Bluetooth: bnep: fix incorrect length parsing in
  bnep_rx_frame() extension handling (bsc#1269574).
• CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable
  (bsc#1269136).
• CVE-2026-53281: iommu/vt-d: Avoid NULL pointer dereference or refcount
  corruption (bsc#1269519).
• CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET
  records (bsc#1269506).
• CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected
  role (bsc#1270059).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path
  (bsc#1269493).

The following non security issues were fixed:
https://lists.suse.com/pipermail/sle-security-updates/2026-July/027327.html