SUSE-SU-2026:5121-1: Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918). - CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703 bsc#1275737). - CVE-2026-23059: scsi: qla2xxx: Sanitize payload size to prevent member overflow (bsc#1257737 bsc#1275737). - CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860). - CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in docpunanosleep() error path (bsc#1273805). - CVE-2026-64379: smb: client: mask server-provided mode to 07777 in modefromsid (bsc#1273029). - CVE-2026-64413: netfilter: ebtables: zero chainstack array (bsc#1274082). - CVE-2026-64435: audit: Fix data races of skbqueuelen() readers on auditqueue (bsc#1274080). - CVE-2026-64539: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (bsc#1273338). - CVE-2026-64546: drm/edid: fix OOB read in drmparsetiledblock() (bsc#1273334). - CVE-2026-64549: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10xsetup() (bsc#1273341). - CVE-2026-72250: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag (bsc#1277663). - CVE-2026-72310: smb: client: fix overflow in passthrough ioctl bounds check (bsc#1277750). - CVE-2026-72416: netfilter: nftcompat: ebtables emulation must reject non-bridge targets (bsc#1278041). - CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050). - CVE-2026-74620: net/sched: actgact, actpolice: range check the fallback control action (bsc#1277044). - CVE-2026-74683: Input: evdev - sanitize event type index when fetching event masks (bsc#1277387). - CVE-2026-74720: bpf: Preserve pointer state for commuted arithmetic (bsc#1276574). - CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578). - CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338). - CVE-2026-80579: fbdev: clear fbinfo->mode before deleting a videomode (bsc#1277260). - CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343). - CVE-2026-80704: drm/amd/display: use proper context for logging (bsc#1278431). - CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836). - CVE-2026-80764: Bluetooth: hcievent: fix LE list UAF on reset (bsc#1279493). - CVE-2026-80808: ext4: stop retrying saturated xattr cache entries (bsc#1279795). - CVE-2026-80809: ocfs2: fix missing metadata reservation for large xattrs (bsc#1279606). - CVE-2026-80879: ocfs2: fix circular locking dependency in ocfs2dioendiowrite (bsc#1279494). - CVE-2026-80881: ocfs2: fix buffer head management in ocfs2readblocks() (bsc#1279496). - CVE-2026-80888: drm/vmwgfx: drop dmabuf reference on foreign-fd prime import (bsc#1279455). - CVE-2026-80978: net: cap advertised IP tunnel headroom (bsc#1280253). - CVE-2026-80989: net: thunderbolt: Mark the connection down when bringing it up fails (bsc#1280305). - CVE-2026-89494: ocfs2: validate lengths in dlmmiglockreshandler (bsc#1280520). - CVE-2026-89495: ocfs2: bound namelen in dlmmigraterequesthandler (bsc#1280569). - CVE-2026-89537: SUNRPC: Reject short RFC 4121 MIC tokens in gsskrb5verifymicv2 (bsc#1280713). - CVE-2026-89559: libnvdimm/labels: Prevent integer overflow in ndlabelvalidate() (bsc#1280554). - CVE-2026-89606: ecryptfs: reject too-small tag 70 packets (bsc#1280469). - CVE-2026-89607: ecryptfs: reject oversized encryptedkeysize in parsetag3packet (bsc#1281792). - CVE-2026-89608: ecryptfs: pass packet set buffer size to parser (bsc#1280826). - CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496). - CVE-2026-89636: smb: client: clear ce->tgthint in freetgts() (bsc#1281042). - CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046). - CVE-2026-89640: cifs: fix lofft underflow in cifsremapfilerange() when len == 0 (bsc#1280950). - CVE-2026-89642: cifs: call pagecacheisizeextended() in cifssetsize() when extending (bsc#1280970). - CVE-2026-89656: libceph: reject buckets with mismatched CRUSH ids (bsc#1280563). - CVE-2026-89821: drm/amd/display: avoid divide-by-zero in islutlinear() (bsc#1280996). - CVE-2026-89842: scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started (bsc#1275737 bsc#1281189). - CVE-2026-89843: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak (bsc#1275737 bsc#1280984). - CVE-2026-89844: scsi: qla2xxx: Hold vportslock for host map update in report ID acquisition (bsc#1275737 bsc#1281183). - CVE-2026-89845: scsi: qla2xxx: Avoid reqqmap double-read in qla2x00errorentry() (bsc#1275737 bsc#1281001). - CVE-2026-89846: scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read (bsc#1275737 bsc#1281184). - CVE-2026-89847: scsi: qla2xxx: Avoid double completion in async IOCB timeout (bsc#1275737 bsc#1281185). - CVE-2026-89848: scsi: qla2xxx: Quiesce response IRQ before freeing request queue (bsc#1275737 bsc#1281179). - CVE-2026-89849: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path (bsc#1275737 bsc#1281180). - CVE-2026-89850: scsi: qla2xxx: Don't query firmware state while chip is down (bsc#1275737 bsc#1281181). - CVE-2026-89851: scsi: qla2xxx: Fix FCE trace enable parsing in debugfs (bsc#1275737 bsc#1281175). - CVE-2026-89852: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate() (bsc#1275737 bsc#1281174). - CVE-2026-89853: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump (bsc#1275737 bsc#1281173). - CVE-2026-89854: scsi: qla2xxx: Fix cs84xx use-after-free on host teardown (bsc#1275737 bsc#1281165). - CVE-2026-89855: scsi: qla2xxx: Serialize flash version read in reset handler (bsc#1275737 bsc#1281164). - CVE-2026-89857: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject (bsc#1275737 bsc#1281211). - CVE-2026-89858: scsi: qla2xxx: Bound image count in qla2x00updatefruversions() (bsc#1275737 bsc#1281334). - CVE-2026-89859: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak (bsc#1275737 bsc#1281333). - CVE-2026-89860: scsi: qla2xxx: Initialize NVMe abortwork once at submission (bsc#1275737 bsc#1281357). - CVE-2026-89861: scsi: qla2xxx: Hold vport reference in qla24xxreportidacquisition() (bsc#1275737 bsc#1281353). - CVE-2026-89862: scsi: qla2xxx: Fix BSG job leak on validate flash image error path (bsc#1275737 bsc#1281214). - CVE-2026-89863: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check (bsc#1275737 bsc#1281251). - CVE-2026-89864: scsi: qla2xxx: Bound i2c->length in I2C bsg handlers (bsc#1275737 bsc#1281253). - CVE-2026-89865: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers (bsc#1275737 bsc#1281254). - CVE-2026-90015: xhci: fix lost bounce buffers on TDs spanning several ring segments (bsc#1281080). - CVE-2026-90057: slip: remove sliphangup() to fix use-after-free in slipreceivebuf() (bsc#1281650). - CVE-2026-90081: net/rds: use wqhassleeper() in rdscongmapupdated() (bsc#1281490). - CVE-2026-90103: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion (bsc#1281538). - CVE-2026-90125: smb: client: fix request buffer leak in smb2newreadreq() (bsc#1281580). - CVE-2026-90138: vsock: don't check the listener's skerr in vsockaccept() (bsc#1281535). - CVE-2026-90227: nvme: fine-granular CAPSYSADMIN for nvme io commands (bsc#1281705). - CVE-2026-90434: isofs: release zisofs block pointer buffer head (bsc#1281993). - CVE-2026-93210: smb: client: harden DFS cache against invalid target hints (bsc#1282737). - CVE-2026-93231: lockd: fix swapped arguments in nlmsvcmatchip() (bsc#1282778). - CVE-2026-93242: scsi: qla2xxx: Fix response queue over-consumption in qlaconsumeiocb() (bsc#1275737 bsc#1282684). - CVE-2026-93262: md/raid5-ppl: fix use-after-free in ppldoflush() (bsc#1283004). - CVE-2026-93269: ext4: fix circular lock dependency in ext4extmigrate (bsc#1282810). - CVE-2026-93785: cifs: validate idmap key payload length (bsc#1282869). - CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifsfilldir (bsc#1282932). - CVE-2026-93817: perf: Fix addrfilterranges lifetime (bsc#1283017). - CVE-2026-97527: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock (bsc#1275737 bsc#1283343). - CVE-2026-97528: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error (bsc#1275737 bsc#1283360). - CVE-2026-97530: scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature (bsc#1275737 bsc#1283159). - CVE-2026-97531: scsi: qla2xxx: Skip vport under deletion in report ID acquisition (bsc#1275737 bsc#1283834). - CVE-2026-97535: scsi: qla2xxx: Bound VP index against VPCTRL IOCB bitmap size (bsc#1275737 bsc#1283837). - CVE-2026-97537: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking (bsc#1275737 bsc#1283453). - CVE-2026-97612: net: mpls: clear innerprotocol when the last label is popped (bsc#1283967). - CVE-2026-97926: ufs: validate cylinder group metadata before caching it (bsc#1283887). - CVE-2026-97954: net/rds: fix tcp stream corruption with large pages (bsc#1283113). - CVE-2026-97965: vxlan: initialize md in vxlanxmitone() (bsc#1282963). - CVE-2026-98014: net/mlx5: E-Switch, prevent mclist repopulation during vport disable (bsc#1283668). - CVE-2026-98022: net: cap txqueuelen at S16MAX to prevent oversized ring allocations (bsc#1283810). - CVE-2026-98071: net/rds: clear cpflags bits individually in rdsconnpathreset() (bsc#1283842). - CVE-2026-98072: net/rds: use wqhassleeper() in releaseinxmit() (bsc#1283846). - CVE-2026-98074: bonding: do not clear curractiveslave prematurely when releasing all slaves (bsc#1283871). - CVE-2026-98078: ipvs: fix reversed sequence option serialization (bsc#1284150). - CVE-2026-98095: afpacket: Don't cast tpackethdr.tplen to int in tpacketparseheader() (bsc#1283921). - CVE-2026-98116: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (bsc#1283878). - CVE-2026-98158: pppasync: drop the errored frame instead of resetting its headroom (bsc#1283933). - CVE-2026-98257: rds: ib: use rdsconndrop() on protocol version mismatch (bsc#1284346). - CVE-2026-98282: powerpc/iommu: Fix the overflow validation in iommutcecheckioba (bsc#1284360). - CVE-2026-98386: scsi: qla2xxx: Use memsetio() to clear QLAFX00 request ring slot (bsc#1275737 bsc#1285668). - CVE-2026-98432: ipv4: free inetopt and ireqopt after an RCU grace period (bsc#1285685).

The following non security issues were fixed:

- net/rds: use clearbitunlock() in releaserefill() (git-fixes). - nvmet-tcp: do not continue for invalid icreq (git-fixes). - ocfs2: reserve xattr value tree metadata only once (git-fixes). - rds: add missing barrier to releaserefill (git-fixes). - Revert 'mkspec: Exclude rt flavor from kernel-syms dependencies' (bsc#1244337). - Revert 'rpm/mkspec: Fix missing kernel-syms-rt creation' (bsc#1244337).