suse/kernel-livepatch-SLE15-SP6_Update_20&distro=SUSE Linux Enterprise Live Patching 15 SP6

Vulnerabilities (42)

• CVE-2026-23268HigMar 18, 2026
  affected < 3-150600.2.1fixed 3-150600.2.1

  In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confused deputy attack, by

• CVE-2026-23209HigFeb 14, 2026
  affected < 2-150600.2.1fixed 2-150600.2.1

  In the Linux kernel, the following vulnerability has been resolved: macvlan: fix error recovery in macvlan_common_newlink() valis provided a nice repro to crash the kernel: ip link add p1 type veth peer p2 ip link set address 00:00:00:00:00:20 dev p1 ip link set up dev p1 ip l

• CVE-2026-23111HigFeb 13, 2026
  affected < 2-150600.2.1fixed 2-150600.2.1

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft_mapelem_activate()

• CVE-2026-23074HigFeb 4, 2026
  affected < 2-150600.2.1fixed 2-150600.2.1

  In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not important, I will desc

• CVE-2026-23010HigJan 25, 2026
  affected < 1-150600.13.3.1fixed 1-150600.13.3.1

  In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del(). syzbot reported use-after-free of inet6_ifaddr in inet6_addr_del(). [0] The cited commit accidentally moved ipv6_del_addr() for mngtmpaddr before reading its ifp->

• CVE-2026-23001HigJan 25, 2026
  affected < 1-150600.13.3.1fixed 1-150600.13.3.1

  In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace

• CVE-2026-22999HigJan 25, 2026
  affected < 1-150600.13.3.1fixed 1-150600.13.3.1

  In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: do not free existing class in qfq_change_class() Fixes qfq_change_class() error case. cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we risk various UAF.

• CVE-2025-71147Jan 23, 2026
  affected < 1-150600.13.3.1fixed 1-150600.13.3.1

  In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix a memory leak in tpm2_load_cmd 'tpm2_load_cmd' allocates a tempoary blob indirectly via 'tpm2_key_decode' but it is not freed in the failure paths. Address this by wrapping the blob into with

• CVE-2025-71136Jan 14, 2026
  affected < 1-150600.13.3.1fixed 1-150600.13.3.1

  In the Linux kernel, the following vulnerability has been resolved: media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() It's possible for cp_read() and hdmi_read() to return -EIO. Those values are further used as indexes for accessing arrays.

• CVE-2025-71120Jan 14, 2026
  affected < 1-150600.13.3.1fixed 1-150600.13.3.1

  In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf A zero length gss_token results in pages == 0 and in_token->pages[0] is NULL. The code unconditionally evaluates page_addres

• CVE-2025-71112Jan 14, 2026
  affected < 1-150600.13.3.1fixed 1-150600.13.3.1

  In the Linux kernel, the following vulnerability has been resolved: net: hns3: add VLAN id validation before using Currently, the VLAN id may be used without validation when receive a VLAN configuration mailbox from VF. The length of vlan_del_fail_bmap is BITS_TO_LONGS(VLAN_N_V

• CVE-2025-71111Jan 14, 2026
  affected < 1-150600.13.3.1fixed 1-150600.13.3.1

  In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83791d) Convert macros to functions to avoid TOCTOU The macro FAN_FROM_REG evaluates its arguments multiple times. When used in lockless contexts involving shared driver data, this leads to Time-of-Che

• CVE-2025-71089HigJan 13, 2026
  affected < 1-150600.13.3.1fixed 1-150600.13.3.1

  In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is set Patch series "Fix stale IOTLB entries for kernel address space", v7. This proposes a fix for a security vulnerability related to IOMMU Shared Virtual Addressing (SVA).

• CVE-2025-68819Jan 13, 2026
  affected < 1-150600.13.3.1fixed 1-150600.13.3.1

  In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() rlen value is a user-controlled value, but dtv5100_i2c_msg() does not check the size of the rlen value. Therefore, if it is set to a value larger

• CVE-2025-68813Jan 13, 2026
  affected < 1-150600.13.3.1fixed 1-150600.13.3.1

  In the Linux kernel, the following vulnerability has been resolved: ipvs: fix ipv4 null-ptr-deref in route error path The IPv4 code path in __ip_vs_get_out_rt() calls dst_link_failure() without ensuring skb->dev is set, leading to a NULL pointer dereference in fib_compute_spec_

• CVE-2025-68808Jan 13, 2026
  affected < 1-150600.13.3.1fixed 1-150600.13.3.1

  In the Linux kernel, the following vulnerability has been resolved: media: vidtv: initialize local pointers upon transfer of memory ownership vidtv_channel_si_init() creates a temporary list (program, service, event) and ownership of the memory itself is transferred to the PAT/

• CVE-2025-68804Jan 13, 2026
  affected < 1-150600.13.3.1fixed 1-150600.13.3.1

  In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver After unbinding the driver, another kthread `cros_ec_console_log_work` is still accessing the device, resulting an UAF and crash. The driver doesn

• CVE-2025-68775Jan 13, 2026
  affected < 1-150600.13.3.1fixed 1-150600.13.3.1

  In the Linux kernel, the following vulnerability has been resolved: net/handshake: duplicate handshake cancellations leak socket When a handshake request is cancelled it is removed from the handshake_net->hn_requests list, but it is still present in the handshake_rhashtbl until

• CVE-2025-71085Jan 13, 2026
  affected < 1-150600.13.3.1fixed 1-150600.13.3.1

  In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is triggered as part of t

• CVE-2025-71083Jan 13, 2026
  affected < 1-150600.13.3.1fixed 1-150600.13.3.1

  In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Avoid NULL pointer deref for evicted BOs It is possible for a BO to exist that is not currently associated with a resource, e.g. because it has been evicted. When devcoredump tries to read the content