opensuse/kernel-azure&distro=openSUSE Leap 16.0

Vulnerabilities (643)

• CVE-2026-23425HigApr 3, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix ID register initialization for non-protected pKVM guests In protected mode, the hypervisor maintains a separate instance of the `kvm` structure for each VM. For non-protected VMs, this structure

• CVE-2026-23419HigApr 3, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: net/rds: Fix circular locking dependency in rds_tcp_tune syzbot reported a circular locking dependency in rds_tcp_tune() where sk_net_refcnt_upgrade() is called while holding the socket lock: =================

• CVE-2026-23414HigApr 2, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: tls: Purge async_hold in tls_decrypt_async_wait() The async_hold queue pins encrypted input skbs while the AEAD engine references their scatterlist data. Once tls_decrypt_async_wait() returns, every AEAD operat

• CVE-2026-23413HigApr 2, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: clsact: Fix use-after-free in init/destroy rollback asymmetry Fix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry. The latter is achieved by first fully initializing a clsact instance,

• CVE-2026-23398MedMar 26, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmp_tag_validation() icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] arra

• CVE-2026-31788HigMar 25, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: restrict usage in unprivileged domU The Xen privcmd driver allows to issue arbitrary hypercalls from user space processes. This is normally no problem, as access is usually limited to root and the

• CVE-2026-23393HigMar 25, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context und

• CVE-2026-23386MedMar 25, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL In DQ-QPL mode, gve_tx_clean_pending_packets() incorrectly uses the RDA buffer cleanup path. It iterates num_bufs times and attempts to

• CVE-2026-23383HigMar 25, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing struct bpf_plt contains a u64 target field. Currently, the BPF JIT allocator requests an alignment of 4 bytes (sizeof(u32)) for the JI

• CVE-2026-23381MedMar 25, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which in

• CVE-2026-23379MedMar 25, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: fix divide by zero in the offload path Offloading ETS requires computing each class' WRR weight: this is done by averaging over the sums of quanta as 'q_sum' and 'q_psum'. Using unsigned int, th

• CVE-2026-23361HigMar 25, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry Endpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X interrupt to the host using a writel(), which generates a PCI posted write trans

• CVE-2026-23343HigMar 25, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: xdp: produce a warning when calculated tailroom is negative Many ethernet drivers report xdp Rx queue frag size as being the same as DMA write size. However, the only user of this field, namely bpf_xdp_frags_in

• CVE-2026-23335MedMar 25, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() struct irdma_create_ah_resp { // 8 bytes, no padding __u32 ah_id; // offset 0 - SET (uresp.ah_id = ah->sc_ah.ah_info.ah_idx) __

• CVE-2026-23326HigMar 25, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: xsk: Fix fragment node deletion to prevent buffer leak After commit b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node"), the list_node field is reused for both the xskb pool list and the buffer free l

• CVE-2026-23319HigMar 25, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim The root cause of this bug is that when 'bpf_link_put' reduces the refcount of 'shim_link->link.link' to zero, the resource is considered released but may

• CVE-2026-23304Mar 25, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() l3mdev_master_dev_rcu() can return NULL when the slave device is being un-slaved from a VRF. All other callers deal with this, but we lost the fallback to lo

• CVE-2026-23293Mar 25, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which ini

• CVE-2026-23281HigMar 25, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix use-after-free in lbs_free_adapter() The lbs_free_adapter() function uses timer_delete() (non-synchronous) for both command_timer and tx_lockup_timer before the structure is freed. This is i

• CVE-2026-23297Mar 25, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit(). syzbot reported memory leak of struct cred. [0] nfsd_nl_threads_set_doit() passes get_current_cred() to nfsd_svc(), but put_cred() is not called after tha