openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:22167-1)

high Nessus Plugin ID 372022

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22167-1 advisory.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

- CVE-2026-31731: thermal: core: Address thermal zone removal races with resume (bsc#1264042).
- CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
- CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
- CVE-2026-63830: net: skmsg: preserve sg.copy across SG transforms (bsc#1272178).
- CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
- CVE-2026-64058: netfs: Fix netfs_read_folio() to wait on writeback (bsc#1272898).
- CVE-2026-64060: netfs: Fix leak of request in netfs_write_begin() error handling (bsc#1272901).
- CVE-2026-64062: netfs: Fix potential deadlock in write-through mode (bsc#1272952).
- CVE-2026-64063: netfs: Fix streaming write being overwritten (bsc#1272955).
- CVE-2026-64064: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone (bsc#1272956).
- CVE-2026-64068: netfs: Fix missing locking around retry adding new subreqs (bsc#1272509).
- CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
- CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
- CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
- CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path (bsc#1274039).
- CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
- CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
- CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
- CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
- CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
- CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
- CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
- CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
- CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
- CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
- CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
- CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
- CVE-2026-72174: fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (bsc#1277695).
- CVE-2026-72212: mm/memory_hotplug: fix incorrect altmap passing in error path (bsc#1277602).
- CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
- CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
- CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
- CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
- CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
- CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
- CVE-2026-72355: netfs: Fix barriering when walking subrequest list (bsc#1276330).
- CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
- CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
- CVE-2026-74306: vfio/qat: fix f_pos race in qat_vf_resume_write() (bsc#1276907).
- CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
- CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
- CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal (bsc#1278232).
- CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
- CVE-2026-74578: crypto: algif_skcipher - force synchronous processing (bsc#1275564).
- CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889).
- CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
- CVE-2026-74611: tls: rx: restore msg_iter before TLS 1.3 optimistic retry (bsc#1277804).
- CVE-2026-74614: vsock/virtio: read virtqueues under worker locks (bsc#1277931).
- CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock (bsc#1277599).
- CVE-2026-74715: bpf: Fix netns reference imbalance in conntrack kfuncs (bsc#1277890).
- CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338).
- CVE-2026-80579: fbdev: clear fb_info->mode before deleting a videomode (bsc#1277260).
- CVE-2026-80893: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() (bsc#1279706).
- CVE-2026-80977: net: skbuff: don't touch shared zerocopy state in skb_tx_error() (bsc#1280259).
- CVE-2026-89528: svcrdma: Reject Read lists that exceed the page budget (bsc#1280743).
- CVE-2026-89558: md/raid10: fix still_degraded being inverted in raid10_sync_request() (bsc#1280552).
- CVE-2026-89593: hugetlb: only adjust reservation during unmapping if mapcount is 0 (bsc#1280229).
- CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).
- CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042).
- CVE-2026-89640: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (bsc#1280950).
- CVE-2026-89754: mm/pagewalk: fix stale walk->action escaping walk_pmd_range() (bsc#1280769).
- CVE-2026-89755: mm/migrate_device: clear stale mapping after freeing swapcache (bsc#1280770).
- CVE-2026-89778: isofs: fix out-of-bounds page array access on empty zisofs block (bsc#1280966).
- CVE-2026-89811: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (bsc#1281144).
- CVE-2026-89987: mm/huge_memory: transfer the pmd dirty bit to the folio on zap (bsc#1281819).
- CVE-2026-90011: scsi: target: iscsi: Reserve a terminator byte for the login payload (bsc#1281280).
- CVE-2026-90283: hugetlbfs: release subpool on fill_super failure (bsc#1281771).
- CVE-2026-90289: drm/amd/display: Resize MST HDCP per-connector arrays to 32 (bsc#1281726).
- CVE-2026-93066: x86/mm/pat: Take cpa_lock around large-page collapse (bsc#1282274).
- CVE-2026-93134: printk: Fix possible console use-after-free (bsc#1281162).
- CVE-2026-93222: signal: avoid shared siginfo namespace rewrites (bsc#1282742).
- CVE-2026-93252: ocfs2: fix circular locking dependency in ocfs2_init_acl() (bsc#1282784).
- CVE-2026-93785: cifs: validate idmap key payload length (bsc#1282869).
- CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir (bsc#1282932).
- CVE-2026-93798: btrfs: fix reloc root cleanup in merge_reloc_roots() (bsc#1282769).
- CVE-2026-93806: wifi: cfg80211: validate assoc response length before status and IE access (bsc#1283037).
- CVE-2026-97415: btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF (bsc#1282768).
- CVE-2026-97416: btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() (bsc#1282770).
- CVE-2026-97491: net/rds: Don't sleep inside rds_ib_conn_path_shutdown (bsc#1283142).
- CVE-2026-97533: x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF (bsc#1283454).
- CVE-2026-97554: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() (bsc#1283850).
- CVE-2026-97555: smb: client: fix heap overflow in DACL owner/group rewrite (bsc#1283851).
- CVE-2026-97556: smb: client: avoid leaking refcount when cifs_sb_tlink() fails (bsc#1283853).
- CVE-2026-97558: smb: client: fix cifsFileInfo reference leak in deferred close (bsc#1283855).
- CVE-2026-97559: smb: client: fail DACL rewrite when the new DACL exceeds 64K (bsc#1283856).
- CVE-2026-97561: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid (bsc#1283858).
- CVE-2026-97562: smb: client: pin DFS superblock in iterator callback (bsc#1283862).
- CVE-2026-97563: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() (bsc#1283877).
- CVE-2026-97564: smb: client: reject userspace cifs.idmap descriptions (bsc#1283946).
- CVE-2026-97942: x86/alternatives: Exclude text poking against change_page_attr() (bsc#1283153).
- CVE-2026-97943: x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF (bsc#1283158).
- CVE-2026-97945: x86/mm: Fix user-space data loss with MADV_FREE and THP (bsc#1283144).
- CVE-2026-98010: net/sched: drr: clamp quantum in change class (bsc#1283823).
- CVE-2026-98015: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (bsc#1283963).
- CVE-2026-98016: net/mlx5e: Fix use-after-free race in sample_restore_put() (bsc#1283894).
- CVE-2026-98041: bpf: Don't predict JMP32 pointer vs zero comparisons (bsc#1284064).
- CVE-2026-98077: netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() (bsc#1283979).
- CVE-2026-98089: bonding: alb: fix uninitialized transport header access in alb_determine_nd() (bsc#1283936).
- CVE-2026-98125: smb/client: fix stale page cache in insert/collapse range (bsc#1283812).
- CVE-2026-98126: smb/client: validate new EOF for zero range (bsc#1283859).
- CVE-2026-98127: smb/client: validate new EOF for insert range (bsc#1283873).
- CVE-2026-98130: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (bsc#1283835).
- CVE-2026-98167: smb: client: fix server->total_read for compound encrypted PDUs (bsc#1284422).
- CVE-2026-98169: smb: client: fix potential OOB read in smb3_enum_snapshots() (bsc#1284298).
- CVE-2026-98170: smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() (bsc#1284310).
- CVE-2026-98171: smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs (bsc#1284419).
- CVE-2026-98173: smb: client: fix use-after-free of iface in cifs_try_adding_channels() (bsc#1284415).
- CVE-2026-98174: smb: client: fix rlist race and missing initialization (bsc#1284412).
- CVE-2026-98175: smb: client: cancel reconnect work in clean_demultiplex_info() (bsc#1284312).
- CVE-2026-98216: IB/hfi1: Fix the PIO_CRED credit-return mmap (bsc#1284559).
- CVE-2026-98252: RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() (bsc#1284581).
- CVE-2026-98253: RDMA/ucma: Serialize join and leave on copy_to_user failure (bsc#1284790).
- CVE-2026-98260: exec: Cleanup POSIX timers right after de_thread() (bsc#1284408).
- CVE-2026-98261: cifs: Fix server use-after-free in cifs_chan_skip_or_disable() (bsc#1284605).
- CVE-2026-98269: btrfs: abort transaction on failure to update inode for hole punching and reflinking (bsc#1284606).
- CVE-2026-98273: x86/kprobes: Fix crash when probing CS CALL instructions (bsc#1284462).
- CVE-2026-98323: RDMA/siw: Bound fragmented header copies by the remaining length (bsc#1284713).
- CVE-2026-98347: IB/IPoIB: Avoid restoring OPER_UP after multicast flush (bsc#1284295).
- CVE-2026-98352: kABI fix for RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted (bsc#1284647).
- CVE-2026-98354: RDMA/mad: Fix receive buffer leak when PKey enforcement fails (bsc#1284291).
- CVE-2026-98357: IB/isert: wait for deferred control PDU completions before releasing the connection (bsc#1284791).
- CVE-2026-98358: IB/iser: reject a remote invalidation of an unregistered direction (bsc#1284289).
- CVE-2026-98359: RDMA/core: Reject unregistering netdevs in ib_get_eth_speed (bsc#1284746).
- CVE-2026-98360: RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds (bsc#1284649).
- CVE-2026-98365: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access (bsc#1284288).
- CVE-2026-98366: RDMA/rxe: validate access flags before swapping the MR's PD (bsc#1284655).
- CVE-2026-98367: RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept (bsc#1284424).
- CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285685).
- CVE-2026-99999: ipv4: validate checksum_start before completing checksum (bsc#1285684).

The following non security issues were fixed:

- ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices (git-fixes).
- arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems (git-fixes).
- arm64: cpufeature: Make PMUVer and PerfMon unsigned (git-fixes).
- arm64: errata: Add Cortex-A725 erratum 3821522 workaround (git-fixes) Enable workaround by default for aarch64.
- arm64: errata: Factor out broken AMU const counter cap (git-fixes) Enable this workaround by default for aarch64.
- arm64: errata: Workaround for SI L1 downstream coherency issue (git-fixes) Enable workaround by default for aarch64.
- arm64: irq: exclude the softirq stack switch from KCOV (git-fixes).
- ASoC: adau1372: allow sleepy powerdown GPIOs (git-fixes).
- ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes (git-fixes).
- ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) (stable-fixes).
- ASoC: cs42l52: Fix the NG Type Switch bit (git-fixes).
- ASoC: cs42l56: Put the Limiter Cushion control on the limiter register (git-fixes).
- ASoC: Intel: avs: Reset the stream unless it is already prepared (git-fixes).
- ASoC: max98371: Fix the Speaker DHT Min Volume bits (git-fixes).
- ASoC: nau8822: Fix the 128x oversampling switch bits (git-fixes).
- ASoC: pcm3168a: Fix the DAC zero flag polarity bit (git-fixes).
- ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM (git-fixes).
- ASoC: SOF: ipc4-priv: Add kernel doc for fw_context_save of sof_ipc4_fw_data (stable-fixes).
- ASoC: SOF: ipc4/Intel: Add support for library restore firmware functionality (stable-fixes).
- ASoC: stm32: spdifrx: fix synchronization state check (git-fixes).
- ASoC: wm8978: Fix the 128x oversampling switch bits (git-fixes).
- Bluetooth: btintel: fix buffer over-read in btintel_hw_error() (git-fixes).
- Bluetooth: btintel: validate DDC record lengths (git-fixes).
- Bluetooth: btintel_pcie: Add shared HW reset for clean start (git-fixes).
- Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() (git-fixes).
- Bluetooth: btintel_pcie: fix TX descriptor bounds check (git-fixes).
- Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() (git-fixes).
- Bluetooth: btintel_pcie: use managed IRQ teardown (git-fixes).
- Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table (stable-fixes).
- Bluetooth: hci_conn: Lock parent access during enhanced SCO setup (git-fixes).
- Bluetooth: hci_core: free the HCI ID if naming fails (git-fixes).
- Bluetooth: hci_core: Serialize ACL scheduling with channel deletion (git-fixes).
- Bluetooth: hci_core: Serialize fragmented ISO packet queueing (git-fixes).
- Bluetooth: hci_sock: Serialize dead-device detachment (git-fixes).
- Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister (git-fixes).
- Bluetooth: hci_sync: Fix inquiry cache use-after-free (git-fixes).
- Bluetooth: ISO: Reject concurrent BIS listener setup (git-fixes).
- Bluetooth: ISO: Serialize concurrent connect calls (git-fixes).
- Bluetooth: MGMT: Fix status of pending commands flushed on power off (git-fixes).
- Bluetooth: RFCOMM: Fix initial port reference race (git-fixes).
- Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown (git-fixes).
- Bluetooth: RFCOMM: free the skb when the DLC has no owner (git-fixes).
- Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata() (git-fixes).
- crypto: ccp - Add support for PCI device 0x17D8 (jsc#PED-13872).
- Drivers: hv: Avoid infinite retry loop in init_vp_index() (git-fixes).
- Drivers: hv: Don't reset VMBus connection state on error/exit paths (git-fixes).
- Drivers: hv: vmbus: add VTL2 redirect connection ID (git-fixes).
- Drivers: hv: vmbus: fix typo substract in comment (git-fixes).
- drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs (stable-fixes).
- drm/amdgpu/gfx6: fix firmware leak on teardown (stable-fixes).
- drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set (git-fixes).
- drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks (git-fixes).
- drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr (git-fixes).
- drm/amdgpu: make Mac FB workaround generic (stable-fixes).
- drm/amdgpu: reset VI ASIC on MacBookPro14,3 (stable-fixes).
- drm/amdgpu: reset VI ASIC on MacBookPro15,1 (stable-fixes).
- drm/amdgpu: serialize vblank counter reads against GPU reset (stable-fixes).
- drm/amdkfd: align SDMA doorbell base for shader doorbell writes (git-fixes).
- drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info (git-fixes).
- drm/aspeed: Balance the display clock enable on teardown (git-fixes).
- drm/dp: don't mark the AUX backlight enabled when enabling failed (git-fixes).
- drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN (git-fixes).
- drm/gud: don't keep a connector without a CRTC as connector_state (git-fixes).
- drm/i915/gem: Prevent overstepping exec array boundary (git-fixes).
- drm/i915/gt: Unmask interrupts only when ACTIVE is true (git-fixes).
- drm/imagination: Fix reference and vm_bo handling in remap() (git-fixes).
- drm/imagination: Size page table preallocation by device address (git-fixes).
- drm/vc4: drain the hangcheck timer and works on V3D unbind (git-fixes).
- drm/vc4: Fix binner slot allocation failing on an idle GPU (git-fixes).
- drm/vc4: Free the BO cache size list on teardown (git-fixes).
- drm/vc4: hdmi: Move packet RAM enable to PM runtime (git-fixes).
- drm/vc4: Make v3d paths unavailable on any generation newer than vc4 (stable-fixes).
- gpio: exar: initialize the ID before registering its cleanup (git-fixes).
- gpio: xilinx: fix runtime PM leak on request error path (git-fixes).
- i2c: at91: release DMA channels when probe defers (git-fixes).
- i2c: xiic: don't clobber msg->len to signal block-read completion (git-fixes).
- i2c: xiic: Relocate xiic_i2c_runtime_suspend and xiic_i2c_runtime_resume to facilitate atomic mode (stable-fixes).
- IB/hfi1: Resolve the credit-return buffer through the send context's node (git-fixes).
- iio: accel: kionix-kx022a: Prevent memory leak and fix state (git-fixes).
- iio: accel: kx022a: Use cleanup.h helpers (stable-fixes).
- iio: adc: aspeed: propagate reset deassert errors (git-fixes).
- iio: adc: aspeed: Simplify with dev_err_probe (stable-fixes).
- iio: bu27034: simplify using guard(mutex) (stable-fixes).
- iio: imu: adis16480: fix unprotected debugfs reads (git-fixes).
- iio: light: rohm-bu27034: Fix error return (git-fixes).
- iio: light: rohm-bu27034: Fix infinite delay on error (git-fixes).
- Input: ati_remote2 - fix type confusion in device attribute handlers (git-fixes).
- Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 (stable-fixes).
- Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 (stable-fixes).
- Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 (stable-fixes).
- Input: xpad - add support for Corsair Novablade Pro (stable-fixes).
- iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init() (git-fixes).
- KVM: PPC: Book3S HV: Add H_VIRT mapping for tracing exits (bsc#1215199).
- KVM: PPC: Book3S HV: Add missing mappings for tracing exits (bsc#1215199).
- KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users (bsc#1215199).
- KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls (bsc#1215199).
- KVM: PPC: Book3S HV: Free the queue pages in error path (bsc#1215199).
- KVM: PPC: Fix callback check in kvmppc_gsm_refresh_info (jsc#PED-11016 git-fixes).
- KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form (bsc#1215199).
- memstick: core: wait for request completion before freeing card (git-fixes).
- memstick: rtsx_usb_ms: complete requests after eject instead of dropping them (git-fixes).
- mmc: cavium-octeon: destroy slot platform devices on remove (git-fixes).
- mmc: cavium-thunderx: destroy slot platform devices on remove (git-fixes).
- mmc: mtk-sd: Cancel request timeout work on remove (git-fixes).
- mmc: sdhci-sprd: disable runtime PM on remove (git-fixes).
- net: mana: reserve RX buffer headroom to fix forwarding performance (git-fixes).
- net: usb: ax88179_178a: fix rx frame length for non-last packets (git-fixes).
- net: usb: qmi_wwan: add Quectel EG120K-EA (stable-fixes).
- PCI: hv: Probe vPCI buses asynchronously (git-fixes).
- PCI: hv: Warn when wait_for_response() waits indefinitely (git-fixes).
- pinctrl: amd: Clear S4 wake bits when firmware has _AEI (git-fixes).
- pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13 (git-fixes).
- pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12 (git-fixes).
- power: supply: ds2780: Fix ds2780_get_capacity() returning raw value (git-fixes).
- power: supply: Fix maintenance charge table kernel-doc (git-fixes).
- power: supply: generic-adc-battery: Fix temperature IIO channel conversion (git-fixes).
- powerpc/fadump: collect dump when CPU_STATE_DATA is less than reserved (bsc#1268315 ltc#217645).
- powerpc/interrupt: Use early_radix_enabled() in NMI real-mode guard (bsc#1215199).
- printk: Handle pre-enabled consoles in the top-level register_console() (bsc#1285989).
- pseries/plpks: clear SED key data after use (bsc#1215199).
- pseries/plpks: clear sensitive PLPKS buffers (bsc#1215199).
- pseries/plpks: clear signed update authentication buffer (bsc#1215199).
- pseries/plpks: fix error handling in plpks_read_var() (bsc#1215199).
- pseries/plpks: make narrowing conversions explicit (bsc#1215199).
- pseries/plpks: validate input to plpks_signed_update_var() (bsc#1215199).
- regulator: ltc3676: don't read the write-only HRST and CLIRQ registers (git-fixes).
- regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 (git-fixes).
- sched/debug: Change SCHED_WARN_ON() to WARN_ON_ONCE() (jsc#PED-14958 bsc#1234634 (Scheduler functional and performance backports SL-16.1) bsc#1282005).
- sched/eevdf: Update se->vprot in reweight_entity() (bsc#1234634 (Scheduler functional and performance backports SL-16.1) bsc#1282005).
- sched/fair: Revert 6d71a9c61604 (sched/fair: Fix EEVDF entity placement bug causing scheduling lag) (bsc#1234634 (Scheduler functional and performance backports SL-16.1) bsc#1282005).
- smb: client: harden DFS cache against invalid target hints (git-fixes).
- smb: client: use kzalloc to zero-initialize security descriptor buffer (git-fixes).
- smb: common: change the data type of num_aces to le16 (git-fixes).
- thunderbolt: Disable CL states for the Anker Prime TB5 dock (stable-fixes).
- tools/hv: fix typo retrive in comment (git-fixes).
- tools: gpio: fix building from the top level with O= (git-fixes).
- tpm: Initialize name_size_alg for non-NULL name in tpm_buf_append_name() (stable-fixes).
- usb: f81604: fix struct f81604_int_data size mismatch (git-fixes).
- usb: ohci-spear: disable controller wakeup on removal (git-fixes).
- usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare() (stable-fixes).
- USB: serial: cp210x: add Corsair AX1500i Power Supply (stable-fixes).
- USB: serial: option: add Compal EXC-T1 support (stable-fixes).
- USB: serial: option: add Compal EXM-G1x support (stable-fixes).
- USB: serial: option: add Quectel EG060W (stable-fixes).
- USB: serial: option: add Quectel RG660QB (stable-fixes).
- USB: serial: option: add support for SIMCom SIM8260C (stable-fixes).
- wifi: ath9k: reject short WMI command responses (git-fixes).
- wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE (git-fixes).
- wifi: ath11k: reset ar->num_stations on hardware start (git-fixes).
- wifi: atk9k: Revert wifi: ath9k: reject short WMI command responses (stable-fixes).
- wifi: brcmfmac: fix P2P device removal race in brcmf_detach() (git-fixes).
- wifi: cfg80211: preserve hidden-group beacon IE ownership (git-fixes).
- wifi: cw1200: fix TX padding OOB read leaking heap data to device (git-fixes).
- wifi: iwlegacy: 3945: free EEPROM data on remove (git-fixes).
- wifi: mac80211: account proxy paths against the mesh path limit (git-fixes).
- wifi: mac80211: Add 802.3 multicast encapsulation offload support (stable-fixes).
- wifi: mac80211: Add multicast to unicast support for 802.3 path (stable-fixes).
- wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit() (stable-fixes).
- wifi: mac80211: drain PS delivery work during station teardown (git-fixes).
- wifi: mac80211: fix mesh fast xmit path deletion UAF (git-fixes).
- wifi: mac80211: handle empty FILS association request payload (git-fixes).
- wifi: mac80211: keep fallback association elements alive (git-fixes).
- wifi: mac80211: keep paired old chanctx alive (git-fixes).
- wifi: mac80211: minstrel_ht: validate fixed rate index (git-fixes).
- wifi: mac80211: prevent AP VLAN tx from other interfaces (git-fixes).
- wifi: mac80211: reject invalid 320 MHz CSA bandwidth (git-fixes).
- wifi: mac80211: release mesh path quota on failed additions (git-fixes).
- wifi: mac80211: set info->band for 802.3 encap offload frames (git-fixes).
- wifi: mt76: mt792x: pick the SAR table layout from the table itself (git-fixes).
- wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit (git-fixes).
- wifi: mt76: mt7915: disable rx napi when removing device (git-fixes).
- wifi: mt76: mt7925: don't put the band auto marker in TGID (git-fixes).
- wifi: mt76: mt7925: restore the legacy BSS after MLO teardown (git-fixes).
- wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout (git-fixes).
- wifi: wfx: validate MIB read length before copying to caller (git-fixes).
- wifi: wlcore: Fix runtime PM leak in wlcore_remove() (git-fixes).
- x86/bugs: Adapt SRSO mitigation to Zen6 (bsc#1282615).
- x86/bugs: Add attack vector controls for VMSCAPE (git-fixes).
- x86/bugs: Remove dead code which might prevent from building (git-fixes).
- x86/bugs: Remove uses of cpu_mitigations_off() (git-fixes).
- x86/bugs: Remove X86_BUG_MMIO_UNKNOWN (git-fixes).
- x86/bugs: Simplify SSB cmdline parsing (git-fixes).
- x86/bugs: Use early_param() for spectre_v2 (git-fixes).
- x86/bugs: Use early_param() for spectre_v2_user (git-fixes).
- x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() (git-fixes).
- x86/mm: Drop unnecessary PMD page copy when freeing (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 372022

File Name: openSUSE-2026-22167-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 10/26/2026

Updated: 10/26/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8

Percentile: 99.69

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-64424

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:cluster-md-kmp-64kb, p-cpe:/a:novell:opensuse:cluster-md-kmp-azure, p-cpe:/a:novell:opensuse:cluster-md-kmp-default, p-cpe:/a:novell:opensuse:cluster-md-kmp-rt, p-cpe:/a:novell:opensuse:dlm-kmp-64kb, p-cpe:/a:novell:opensuse:dlm-kmp-azure, p-cpe:/a:novell:opensuse:dlm-kmp-default, p-cpe:/a:novell:opensuse:dlm-kmp-rt, p-cpe:/a:novell:opensuse:dtb-allwinner, p-cpe:/a:novell:opensuse:dtb-altera, p-cpe:/a:novell:opensuse:dtb-amazon, p-cpe:/a:novell:opensuse:dtb-amd, p-cpe:/a:novell:opensuse:dtb-amlogic, p-cpe:/a:novell:opensuse:dtb-apm, p-cpe:/a:novell:opensuse:dtb-apple, p-cpe:/a:novell:opensuse:dtb-arm, p-cpe:/a:novell:opensuse:dtb-broadcom, p-cpe:/a:novell:opensuse:dtb-cavium, p-cpe:/a:novell:opensuse:dtb-exynos, p-cpe:/a:novell:opensuse:dtb-freescale, p-cpe:/a:novell:opensuse:dtb-hisilicon, p-cpe:/a:novell:opensuse:dtb-lg, p-cpe:/a:novell:opensuse:dtb-marvell, p-cpe:/a:novell:opensuse:dtb-mediatek, p-cpe:/a:novell:opensuse:dtb-nvidia, p-cpe:/a:novell:opensuse:dtb-qcom, p-cpe:/a:novell:opensuse:dtb-renesas, p-cpe:/a:novell:opensuse:dtb-rockchip, p-cpe:/a:novell:opensuse:dtb-socionext, p-cpe:/a:novell:opensuse:dtb-sprd, p-cpe:/a:novell:opensuse:dtb-xilinx, p-cpe:/a:novell:opensuse:gfs2-kmp-64kb, p-cpe:/a:novell:opensuse:gfs2-kmp-azure, p-cpe:/a:novell:opensuse:gfs2-kmp-default, p-cpe:/a:novell:opensuse:gfs2-kmp-rt, p-cpe:/a:novell:opensuse:kernel-64kb-extra, p-cpe:/a:novell:opensuse:kernel-64kb-optional, p-cpe:/a:novell:opensuse:kernel-64kb, p-cpe:/a:novell:opensuse:kernel-azure-extra, p-cpe:/a:novell:opensuse:kernel-azure-optional, p-cpe:/a:novell:opensuse:kernel-azure-vdso, p-cpe:/a:novell:opensuse:kernel-azure, p-cpe:/a:novell:opensuse:kernel-default-base, p-cpe:/a:novell:opensuse:kernel-default-extra, p-cpe:/a:novell:opensuse:kernel-default-optional, p-cpe:/a:novell:opensuse:kernel-default-vdso, p-cpe:/a:novell:opensuse:kernel-default, p-cpe:/a:novell:opensuse:kernel-kvmsmall-vdso, p-cpe:/a:novell:opensuse:kernel-kvmsmall, p-cpe:/a:novell:opensuse:kernel-obs-build, p-cpe:/a:novell:opensuse:kernel-obs-qa, p-cpe:/a:novell:opensuse:kernel-rt-extra, p-cpe:/a:novell:opensuse:kernel-rt-optional, p-cpe:/a:novell:opensuse:kernel-rt-vdso, p-cpe:/a:novell:opensuse:kernel-rt, p-cpe:/a:novell:opensuse:kernel-source-vanilla, p-cpe:/a:novell:opensuse:kernel-source, p-cpe:/a:novell:opensuse:kernel-zfcpdump, p-cpe:/a:novell:opensuse:kselftests-kmp-64kb, p-cpe:/a:novell:opensuse:kselftests-kmp-azure, p-cpe:/a:novell:opensuse:kselftests-kmp-default, p-cpe:/a:novell:opensuse:kselftests-kmp-rt, p-cpe:/a:novell:opensuse:ocfs2-kmp-64kb, p-cpe:/a:novell:opensuse:ocfs2-kmp-azure, p-cpe:/a:novell:opensuse:ocfs2-kmp-default, p-cpe:/a:novell:opensuse:ocfs2-kmp-rt

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/24/2026

Vulnerability Publication Date: 5/1/2026

Reference Information

CVE: CVE-2026-31731, CVE-2026-46028, CVE-2026-53108, CVE-2026-63830, CVE-2026-64012, CVE-2026-64058, CVE-2026-64060, CVE-2026-64062, CVE-2026-64063, CVE-2026-64064, CVE-2026-64068, CVE-2026-64116, CVE-2026-64280, CVE-2026-64424, CVE-2026-64428, CVE-2026-64435, CVE-2026-64461, CVE-2026-68233, CVE-2026-68241, CVE-2026-68242, CVE-2026-68323, CVE-2026-72015, CVE-2026-72040, CVE-2026-72041, CVE-2026-72081, CVE-2026-72110, CVE-2026-72172, CVE-2026-72174, CVE-2026-72212, CVE-2026-72213, CVE-2026-72236, CVE-2026-72250, CVE-2026-72253, CVE-2026-72305, CVE-2026-72319, CVE-2026-72355, CVE-2026-72405, CVE-2026-72493, CVE-2026-74306, CVE-2026-74312, CVE-2026-74368, CVE-2026-74379, CVE-2026-74544, CVE-2026-74578, CVE-2026-74583, CVE-2026-74587, CVE-2026-74611, CVE-2026-74614, CVE-2026-74624, CVE-2026-74715, CVE-2026-80572, CVE-2026-80579, CVE-2026-80893, CVE-2026-80977, CVE-2026-89528, CVE-2026-89558, CVE-2026-89593, CVE-2026-89631, CVE-2026-89636, CVE-2026-89640, CVE-2026-89754, CVE-2026-89755, CVE-2026-89778, CVE-2026-89811, CVE-2026-89987, CVE-2026-90011, CVE-2026-90283, CVE-2026-90289, CVE-2026-93066, CVE-2026-93134, CVE-2026-93222, CVE-2026-93252, CVE-2026-93785, CVE-2026-93787, CVE-2026-93798, CVE-2026-93806, CVE-2026-97415, CVE-2026-97416, CVE-2026-97491, CVE-2026-97533, CVE-2026-97554, CVE-2026-97555, CVE-2026-97556, CVE-2026-97558, CVE-2026-97559, CVE-2026-97561, CVE-2026-97562, CVE-2026-97563, CVE-2026-97564, CVE-2026-97942, CVE-2026-97943, CVE-2026-97945, CVE-2026-98010, CVE-2026-98015, CVE-2026-98016, CVE-2026-98041, CVE-2026-98077, CVE-2026-98089, CVE-2026-98125, CVE-2026-98126, CVE-2026-98127, CVE-2026-98130, CVE-2026-98167, CVE-2026-98169, CVE-2026-98170, CVE-2026-98171, CVE-2026-98173, CVE-2026-98174, CVE-2026-98175, CVE-2026-98216, CVE-2026-98252, CVE-2026-98253, CVE-2026-98260, CVE-2026-98261, CVE-2026-98269, CVE-2026-98273, CVE-2026-98323, CVE-2026-98347, CVE-2026-98352, CVE-2026-98354, CVE-2026-98357, CVE-2026-98358, CVE-2026-98359, CVE-2026-98360, CVE-2026-98365, CVE-2026-98366, CVE-2026-98367, CVE-2026-98432, CVE-2026-99999

Detections

Analytics