SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4687-1)

high Nessus Plugin ID 366749

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4687-1 advisory.

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

- CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
- CVE-2026-43428: USB: core: Limit the length of unkillable synchronous timeouts (bsc#1265138).
- CVE-2026-45834: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (bsc#1266412).
- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
- CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
- CVE-2026-46312: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (bsc#1267990).
- CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
- CVE-2026-53037: HID: usbhid: fix deadlock in hid_post_reset() (bsc#1269081).
- CVE-2026-53237: gpio: mvebu: fix NULL pointer dereference in suspend/resume (bsc#1269131).
- CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
- CVE-2026-53385: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (bsc#1271834).
- CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1273953).
- CVE-2026-63897: USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (bsc#1272642).
- CVE-2026-63900: USB: serial: keyspan: fix missing indat transfer sanity check (bsc#1272499).
- CVE-2026-63902: USB: serial: cypress_m8: validate interrupt packet headers (bsc#1272517).
- CVE-2026-63903: USB: serial: belkin_sa: validate interrupt status length (bsc#1272522).
- CVE-2026-63904: usb: usbtmc: check URB actual_length for interrupt-IN notifications (bsc#1272523).
- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
- CVE-2026-63942: parport: Fix race between port and client registration (bsc#1273023).
- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
- CVE-2026-63957: USB: serial: safe_serial: fix memory corruption with small endpoint (bsc#1272472).
- CVE-2026-63961: usb: typec: altmodes/displayport: validate count before reading Status Update VDO (bsc#1272480).
- CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
- CVE-2026-64014: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (bsc#1273769).
- CVE-2026-64097: drm/amd/display: Validate GPIO pin LUT table size before iterating (bsc#1273480).
- CVE-2026-64191: i2c: stub: Reject I2C block transfers with invalid length (bsc#1272211).
- CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
- CVE-2026-64320: nvmet: fix discover log page when offsets are used (bsc#1273420).
- CVE-2026-64342: USB: iowarrior: fix use-after-free on disconnect (bsc#1274011).
- CVE-2026-64348: usb: free iso schedules on failed submit (bsc#1274026).
- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
- CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).
- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).
- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).
- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
- CVE-2026-64496: iio: event: Fix event FIFO reset race (bsc#1273600).
- CVE-2026-64540: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (bsc#1273302).
- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
- CVE-2026-68108: drm/amdgpu/vce: fix integer overflow in image size (bsc#1274869).
- CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
- CVE-2026-68184: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (bsc#1274981).
- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).
- CVE-2026-68350: wifi: carl9170: fix OOB read from off-by-two in TX status handler (bsc#1274682).
- CVE-2026-68365: USB: serial: io_edgeport: cap received transmit credits (bsc#1276257).
- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).
- CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).
- CVE-2026-68479: Bluetooth: btrtl: validate firmware patch bounds (bsc#1276585).
- CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).
- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).
- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
- CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).
- CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).
- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
- CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
- CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).
- CVE-2026-72166: net/9p: avoid -ERESTARTSYS leak to userspace (bsc#1277556).
- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).
- CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).
- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).
- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).
- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).
- CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).
- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).
- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).
- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).
- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).
- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).
- CVE-2026-72436: netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types (bsc#1277245).
- CVE-2026-72444: flow_dissector: fix false-positive __read_overflow2_field() warning (bsc#1278100).
- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).
- CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).
- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen (bsc#1276519).
- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).
- CVE-2026-74276: spi: xilinx: use FIFO occupancy register to determine buffer size (bsc#1276495).
- CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).
- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
- CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).
- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).
- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).
- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).
- CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).
- CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).
- CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
- CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).
- CVE-2026-74359: configfs_lookup(): don't leave ->s_dentry dangling on failure (bsc#1278067).
- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).
- CVE-2026-74386: nvmet-tcp: fix a memory leak when releasing a queue (bsc#1277098).
- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
- CVE-2026-74424: fbcon: fix NULL pointer dereference for a console without vc_data (bsc#1276321).
- CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).
- CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).
- CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).
- CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).
- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).
- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).
- CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).
- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).
- CVE-2026-74497: ALSA: usb-audio: Clamp frame size in implicit-feedback mode (bsc#1275957).
- CVE-2026-74498: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (bsc#1275958).
- CVE-2026-74499: ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (bsc#1275959).
- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).
- CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).
- CVE-2026-74585: thunderbolt: Bound the DROM dual link port number before indexing sw->ports (bsc#1277881).
- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
- CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).
- CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
- CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).
- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).
- CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
- CVE-2026-74641: ALSA: usx2y: bound the hwdep mmap fault offset (bsc#1278310).
- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).
- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).
- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).
- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).
- CVE-2026-74682: ALSA: usb-audio: fix OOB write on Type II inbound URBs (bsc#1276934).
- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).
- CVE-2026-74691: net: thunderbolt: Tear down DMA paths before stopping the rings (bsc#1276925).
- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).
- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).
- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).
- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).
- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).
- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
- CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).
- CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).
- CVE-2026-80558: libceph: Avoid using invalid osd indices from primary_temp (bsc#1277485).
- CVE-2026-80561: libceph: fix multiple unsafe decodes in decode_locker() (bsc#1277265).
- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).
- CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).
- CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).
- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).
- CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).
- CVE-2026-80798: nfc: llcp: reject PDUs shorter than the LLCP header (bsc#1279809).
- CVE-2026-80800: nfc: llcp: bound the connect_sn TLV walk to the skb (bsc#1279812).
- CVE-2026-80829: ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (bsc#1279485).
- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).
- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).
- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).
- CVE-2026-80908: drm/amdgpu: Reject UVD message with dimensions above 4096 (bsc#1279627).
- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).
- CVE-2026-81005: ipmi: si: Fix NULL pointer dereference after failed registration (bsc#1280230).
- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).
- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).
- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
- CVE-2026-89480: nvme-tcp: Do not reset transport on data digest errors (bsc#1280449).
- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).
- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).
- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).
- CVE-2026-89524: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (bsc#1280581).
- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).
- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).
- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).
- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).
- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).
- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).
- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
- CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).
- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).
- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).
- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).
- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).
- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).
- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).
- CVE-2026-89752: mm: memcg: stop reclaim when a limit update is superseded (bsc#1281176).
- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).
- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).
- CVE-2026-89870: media: zoran: Avoid freeing a registered video_device twice (bsc#1281352).
- CVE-2026-89927: KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (bsc#1281429).
- CVE-2026-89929: KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (bsc#1281358).
- CVE-2026-89930: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (bsc#1281359).
- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
- CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).
- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).
- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).
- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).
- CVE-2026-90223: nfc: llcp: bound SNL TLV parsing to the skb and add length checks (bsc#1281708).
- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).
- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).
- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).
- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).
- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).
- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).
- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] (bsc#1282270).
- CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).
- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).
- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).
- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).
- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).
- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).
- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).
- CVE-2026-98080: btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1283973).
- CVE-2026-98164: KVM: x86/mmu: Check write tracking in all address spaces (bsc#1283935).
- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).

The following non security issues were fixed:

- Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN (git-fixes).
- default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).
- Fix backport of 'RDMA/efa: Fix PBL chunk length computation' Refresh:.
- gpio: mvebu: Use IS_REACHABLE instead of IS_ENABLED for CONFIG_PWM (git-fixes).
- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).
- kernel-binary.spec.in: Fix syntax error.
- KVM: nVMX: Always flush vpid02 on first use (git-fixes).
- RDMA/efa: Fix PBL chunk length computation.
- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).
- scripts/osc_wrapper: Select repository appropriate for architecture.
- scripts: Add kernel_repos.
- scripts: obsapi: Kick get_kernel_projects from uploader
- scripts: obsapi: Kick get_project_repo_archs from uploader
- slab: Introduce kmalloc_obj() and family (bsc#1280139).
- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).
- smb3: missing inode locks in punch hole (git-fixes).
- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).
- xfs: don't drain buffer lru on freeze and read-only remount (bsc#1280223).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 366749

File Name: suse_SU-2026-4687-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 10/17/2026

Updated: 10/17/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.9

Percentile: 99.35

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-64348

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:12, p-cpe:/a:novell:suse_linux:cluster-md-kmp-default, p-cpe:/a:novell:suse_linux:dlm-kmp-default, p-cpe:/a:novell:suse_linux:gfs2-kmp-default, p-cpe:/a:novell:suse_linux:kernel-default-base, p-cpe:/a:novell:suse_linux:kernel-default-man, p-cpe:/a:novell:suse_linux:kernel-default, p-cpe:/a:novell:suse_linux:kernel-source, p-cpe:/a:novell:suse_linux:ocfs2-kmp-default

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/15/2026

Vulnerability Publication Date: 7/21/2021

Reference Information

CVE: CVE-2022-50645, CVE-2026-100075, CVE-2026-31663, CVE-2026-43428, CVE-2026-45834, CVE-2026-45836, CVE-2026-46044, CVE-2026-46196, CVE-2026-46304, CVE-2026-46312, CVE-2026-52975, CVE-2026-53037, CVE-2026-53237, CVE-2026-53284, CVE-2026-53385, CVE-2026-53400, CVE-2026-63897, CVE-2026-63900, CVE-2026-63902, CVE-2026-63903, CVE-2026-63904, CVE-2026-63913, CVE-2026-63942, CVE-2026-63956, CVE-2026-63957, CVE-2026-63961, CVE-2026-63963, CVE-2026-64009, CVE-2026-64014, CVE-2026-64097, CVE-2026-64191, CVE-2026-64279, CVE-2026-64299, CVE-2026-64320, CVE-2026-64342, CVE-2026-64348, CVE-2026-64372, CVE-2026-64373, CVE-2026-64375, CVE-2026-64378, CVE-2026-64388, CVE-2026-64448, CVE-2026-64496, CVE-2026-64540, CVE-2026-64580, CVE-2026-68108, CVE-2026-68162, CVE-2026-68184, CVE-2026-68343, CVE-2026-68350, CVE-2026-68365, CVE-2026-68376, CVE-2026-68377, CVE-2026-68445, CVE-2026-68477, CVE-2026-68479, CVE-2026-72019, CVE-2026-72025, CVE-2026-72051, CVE-2026-72052, CVE-2026-72053, CVE-2026-72054, CVE-2026-72061, CVE-2026-72066, CVE-2026-72098, CVE-2026-72106, CVE-2026-72107, CVE-2026-72129, CVE-2026-72157, CVE-2026-72163, CVE-2026-72166, CVE-2026-72224, CVE-2026-72243, CVE-2026-72256, CVE-2026-72321, CVE-2026-72322, CVE-2026-72348, CVE-2026-72349, CVE-2026-72350, CVE-2026-72351, CVE-2026-72383, CVE-2026-72392, CVE-2026-72398, CVE-2026-72406, CVE-2026-72413, CVE-2026-72435, CVE-2026-72436, CVE-2026-72444, CVE-2026-72447, CVE-2026-72463, CVE-2026-74267, CVE-2026-74268, CVE-2026-74276, CVE-2026-74282, CVE-2026-74283, CVE-2026-74284, CVE-2026-74288, CVE-2026-74289, CVE-2026-74290, CVE-2026-74307, CVE-2026-74317, CVE-2026-74330, CVE-2026-74349, CVE-2026-74359, CVE-2026-74384, CVE-2026-74386, CVE-2026-74398, CVE-2026-74424, CVE-2026-74443, CVE-2026-74444, CVE-2026-74453, CVE-2026-74464, CVE-2026-74469, CVE-2026-74471, CVE-2026-74473, CVE-2026-74474, CVE-2026-74475, CVE-2026-74480, CVE-2026-74485, CVE-2026-74497, CVE-2026-74498, CVE-2026-74499, CVE-2026-74512, CVE-2026-74540, CVE-2026-74585, CVE-2026-74586, CVE-2026-74588, CVE-2026-74589, CVE-2026-74592, CVE-2026-74597, CVE-2026-74598, CVE-2026-74601, CVE-2026-74609, CVE-2026-74630, CVE-2026-74641, CVE-2026-74660, CVE-2026-74663, CVE-2026-74667, CVE-2026-74671, CVE-2026-74682, CVE-2026-74688, CVE-2026-74689, CVE-2026-74691, CVE-2026-74692, CVE-2026-74701, CVE-2026-74726, CVE-2026-74739, CVE-2026-74744, CVE-2026-74752, CVE-2026-80540, CVE-2026-80557, CVE-2026-80558, CVE-2026-80561, CVE-2026-80664, CVE-2026-80681, CVE-2026-80731, CVE-2026-80747, CVE-2026-80785, CVE-2026-80789, CVE-2026-80793, CVE-2026-80798, CVE-2026-80800, CVE-2026-80829, CVE-2026-80841, CVE-2026-80844, CVE-2026-80847, CVE-2026-80852, CVE-2026-80863, CVE-2026-80864, CVE-2026-80908, CVE-2026-81000, CVE-2026-81001, CVE-2026-81005, CVE-2026-89448, CVE-2026-89477, CVE-2026-89479, CVE-2026-89480, CVE-2026-89481, CVE-2026-89510, CVE-2026-89511, CVE-2026-89524, CVE-2026-89531, CVE-2026-89538, CVE-2026-89539, CVE-2026-89540, CVE-2026-89544, CVE-2026-89548, CVE-2026-89551, CVE-2026-89569, CVE-2026-89580, CVE-2026-89644, CVE-2026-89662, CVE-2026-89673, CVE-2026-89674, CVE-2026-89686, CVE-2026-89707, CVE-2026-89752, CVE-2026-89784, CVE-2026-89789, CVE-2026-89870, CVE-2026-89927, CVE-2026-89929, CVE-2026-89930, CVE-2026-89968, CVE-2026-90088, CVE-2026-90104, CVE-2026-90149, CVE-2026-90151, CVE-2026-90203, CVE-2026-90223, CVE-2026-90259, CVE-2026-90293, CVE-2026-90294, CVE-2026-90307, CVE-2026-90413, CVE-2026-90414, CVE-2026-90415, CVE-2026-90417, CVE-2026-92525, CVE-2026-93104, CVE-2026-93108, CVE-2026-93264, CVE-2026-93782, CVE-2026-93794, CVE-2026-93829, CVE-2026-97557, CVE-2026-97940, CVE-2026-98080, CVE-2026-98164

SuSE: SUSE-SU-2026:4687-1

Detections

Analytics