{"schema_version":"1.7.5","id":"SUSE-SU-2026:22436-1","published":"2026-06-30T23:09:03Z","modified":"2026-07-03T18:24:21.038473869Z","related":["CVE-2025-10263","CVE-2025-68822","CVE-2026-31414","CVE-2026-31429","CVE-2026-31452","CVE-2026-31453","CVE-2026-31469","CVE-2026-31492","CVE-2026-31495","CVE-2026-31499","CVE-2026-31500","CVE-2026-31555","CVE-2026-31592","CVE-2026-31664","CVE-2026-31665","CVE-2026-31674","CVE-2026-31680","CVE-2026-31693","CVE-2026-31697","CVE-2026-31698","CVE-2026-31699","CVE-2026-31752","CVE-2026-31759","CVE-2026-31771","CVE-2026-43023","CVE-2026-43024","CVE-2026-43028","CVE-2026-43035","CVE-2026-43036","CVE-2026-43049","CVE-2026-43053","CVE-2026-43074","CVE-2026-43077","CVE-2026-43083","CVE-2026-43101","CVE-2026-43112","CVE-2026-43119","CVE-2026-43158","CVE-2026-43171","CVE-2026-43187","CVE-2026-43198","CVE-2026-43239","CVE-2026-43339","CVE-2026-43345","CVE-2026-43405","CVE-2026-43469","CVE-2026-43491","CVE-2026-45840","CVE-2026-45841","CVE-2026-45862","CVE-2026-45870","CVE-2026-45894","CVE-2026-45940","CVE-2026-45961","CVE-2026-45964","CVE-2026-45965","CVE-2026-45974","CVE-2026-46005","CVE-2026-46037","CVE-2026-46101","CVE-2026-46119","CVE-2026-46120","CVE-2026-46123","CVE-2026-46150","CVE-2026-46160","CVE-2026-46172","CVE-2026-46197","CVE-2026-46227","CVE-2026-46244","CVE-2026-46259","CVE-2026-46273"],"upstream":["CVE-2025-10263","CVE-2025-68822","CVE-2026-31414","CVE-2026-31429","CVE-2026-31452","CVE-2026-31453","CVE-2026-31469","CVE-2026-31492","CVE-2026-31495","CVE-2026-31499","CVE-2026-31500","CVE-2026-31555","CVE-2026-31592","CVE-2026-31664","CVE-2026-31665","CVE-2026-31674","CVE-2026-31680","CVE-2026-31693","CVE-2026-31697","CVE-2026-31698","CVE-2026-31699","CVE-2026-31752","CVE-2026-31759","CVE-2026-31771","CVE-2026-43023","CVE-2026-43024","CVE-2026-43028","CVE-2026-43035","CVE-2026-43036","CVE-2026-43049","CVE-2026-43053","CVE-2026-43074","CVE-2026-43077","CVE-2026-43083","CVE-2026-43101","CVE-2026-43112","CVE-2026-43119","CVE-2026-43158","CVE-2026-43171","CVE-2026-43187","CVE-2026-43198","CVE-2026-43239","CVE-2026-43339","CVE-2026-43345","CVE-2026-43405","CVE-2026-43469","CVE-2026-43491","CVE-2026-45840","CVE-2026-45841","CVE-2026-45862","CVE-2026-45870","CVE-2026-45894","CVE-2026-45940","CVE-2026-45961","CVE-2026-45964","CVE-2026-45965","CVE-2026-45974","CVE-2026-46005","CVE-2026-46037","CVE-2026-46101","CVE-2026-46119","CVE-2026-46120","CVE-2026-46123","CVE-2026-46150","CVE-2026-46160","CVE-2026-46172","CVE-2026-46197","CVE-2026-46227","CVE-2026-46244","CVE-2026-46259","CVE-2026-46273"],"summary":"Security update for the Linux Kernel","details":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).\n- CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31592: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).\n- CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).\n- CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).\n- CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880).\n- CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43049: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (bsc#1264080).\n- CVE-2026-43053: xfs: close crash window in attr dabtree inactivation (bsc#1264084).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev->req_status (bsc#1264561).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43171: EFI/CPER: do not dump the entire memory region (bsc#1264549).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).\n- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1267651).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Do not leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).\n- KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: Do not set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Guard against NULL vcpu on VHE hyp panic path (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: Treat vCPU with pending SError as runnable (git-fixes).\n- KVM: arm64: Wake-up from WFI when iqrchip is in userspace (git-fixes).\n- KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n- add bugnumber to existing mana_ib change (bsc#1267682)\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE (git-fixes).\n- batman-adv: tp_meter: add only finished tp_vars to lists (git-fixes).\n- batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (git-fixes).\n- batman-adv: tp_meter: avoid window underflow (git-fixes).\n- batman-adv: tp_meter: fix fast recovery precondition (git-fixes).\n- batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection (git-fixes).\n- batman-adv: tp_meter: initialize dec_cwnd explicitly (git-fixes).\n- batman-adv: tp_meter: initialize dup_acks explicitly (git-fixes).\n- batman-adv: tp_meter: keep unacked list in ascending ordered (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() (git-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- ethtool: provide customized dim profile management (bsc#1261256).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- linux/dim: move useful macros to .h file (bsc#1261256).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- watchdog: apple: Add \"apple,t8103-wdt\" compatible (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n","affected":[{"package":{"name":"kernel-default","ecosystem":"SUSE:Linux Micro 6.0","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Micro%206.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"ecosystem_specific":{"binaries":[{"kernel-default":"6.4.0-48.1","kernel-default-base":"6.4.0-48.1.21.25","kernel-default-livepatch":"6.4.0-48.1","kernel-devel":"6.4.0-48.1","kernel-kvmsmall":"6.4.0-48.1","kernel-macros":"6.4.0-48.1","kernel-source":"6.4.0-48.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:22436-1.json"}},{"package":{"name":"kernel-default-base","ecosystem":"SUSE:Linux Micro 6.0","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Micro%206.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1.21.25"}]}],"ecosystem_specific":{"binaries":[{"kernel-default":"6.4.0-48.1","kernel-default-base":"6.4.0-48.1.21.25","kernel-default-livepatch":"6.4.0-48.1","kernel-devel":"6.4.0-48.1","kernel-kvmsmall":"6.4.0-48.1","kernel-macros":"6.4.0-48.1","kernel-source":"6.4.0-48.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:22436-1.json"}},{"package":{"name":"kernel-kvmsmall","ecosystem":"SUSE:Linux Micro 6.0","purl":"pkg:rpm/suse/kernel-kvmsmall&distro=SUSE%20Linux%20Micro%206.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"ecosystem_specific":{"binaries":[{"kernel-default":"6.4.0-48.1","kernel-default-base":"6.4.0-48.1.21.25","kernel-default-livepatch":"6.4.0-48.1","kernel-devel":"6.4.0-48.1","kernel-kvmsmall":"6.4.0-48.1","kernel-macros":"6.4.0-48.1","kernel-source":"6.4.0-48.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:22436-1.json"}},{"package":{"name":"kernel-source","ecosystem":"SUSE:Linux Micro 6.0","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Micro%206.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-48.1"}]}],"ecosystem_specific":{"binaries":[{"kernel-default":"6.4.0-48.1","kernel-default-base":"6.4.0-48.1.21.25","kernel-default-livepatch":"6.4.0-48.1","kernel-devel":"6.4.0-48.1","kernel-kvmsmall":"6.4.0-48.1","kernel-macros":"6.4.0-48.1","kernel-source":"6.4.0-48.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:22436-1.json"}}],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622436-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1256668"},{"type":"REPORT","url":"https://bugzilla.suse.com/1261256"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262085"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262392"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262617"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262620"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262674"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262748"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262798"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262993"},{"type":"REPORT","url":"https://bugzilla.suse.com/1263123"},{"type":"REPORT","url":"https://bugzilla.suse.com/1263137"},{"type":"REPORT","url":"https://bugzilla.suse.com/1263178"},{"type":"REPORT","url":"https://bugzilla.suse.com/1263563"},{"type":"REPORT","url":"https://bugzilla.suse.com/1263568"},{"type":"REPORT","url":"https://bugzilla.suse.com/1263578"},{"type":"REPORT","url":"https://bugzilla.suse.com/1263879"},{"type":"REPORT","url":"https://bugzilla.suse.com/1263880"},{"type":"REPORT","url":"https://bugzilla.suse.com/1263930"},{"type":"REPORT","url":"https://bugzilla.suse.com/1263934"},{"type":"REPORT","url":"https://bugzilla.suse.com/1263993"},{"type":"REPORT","url":"https://bugzilla.suse.com/1263996"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264045"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264076"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264080"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264084"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264116"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264137"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264145"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264239"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264263"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264266"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264437"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264444"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264470"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264549"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264561"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264595"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264603"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264610"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264741"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264763"},{"type":"REPORT","url":"https://bugzilla.suse.com/1265103"},{"type":"REPORT","url":"https://bugzilla.suse.com/1265143"},{"type":"REPORT","url":"https://bugzilla.suse.com/1265628"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266290"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266390"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266397"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266698"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266704"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266705"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266878"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266895"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266903"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266916"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266922"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266933"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267208"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267361"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267381"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267387"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267431"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267621"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267624"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267628"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267640"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267651"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267654"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267682"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267685"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267697"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267744"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268307"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-10263"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-68822"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31414"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31429"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31452"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31453"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31469"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31492"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31495"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31499"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31500"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31555"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31592"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31664"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31665"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31674"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31680"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31693"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31697"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31698"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31699"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31752"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31759"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-31771"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43023"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43024"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43028"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43035"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43036"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43049"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43053"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43074"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43077"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43083"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43101"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43112"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43119"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43158"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43171"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43187"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43198"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43239"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43339"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43345"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43405"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43469"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43491"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-45840"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-45841"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-45862"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-45870"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-45894"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-45940"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-45961"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-45964"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-45965"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-45974"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46005"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46037"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46101"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46119"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46120"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46123"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46150"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46160"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46172"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46197"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46227"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46244"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46259"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46273"}]}