suse/kernel-livepatch-SLE15-SP7-RT_Update_11&distro=SUSE Linux Enterprise Live Patching 15 SP7

Vulnerabilities (45)

• CVE-2026-46323HigJun 9, 2026
  affected < 5-150700.2.1fixed 5-150700.2.1

  In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_

• CVE-2026-43503HigMay 23, 2026
  affected < 5-150700.2.1fixed 5-150700.2.1

  In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when m

• CVE-2026-31694HigMay 1, 2026
  affected < 5-150700.2.1fixed 5-150700.2.1

  In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache() computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existi

• CVE-2026-31504HigApr 22, 2026
  affected < 5-150700.2.1fixed 5-150700.2.1

  In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race window where `NETDEV_UP` can re-register a socket into a fanout group's `arr[]` array. The re-registration is not cleaned

• CVE-2026-31402CriApr 3, 2026
  affected < 5-150700.2.1fixed 5-150700.2.1

  In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size was calculated bas

• CVE-2026-23414HigApr 2, 2026
  affected < 1-150700.1.3.1fixed 1-150700.1.3.1

  In the Linux kernel, the following vulnerability has been resolved: tls: Purge async_hold in tls_decrypt_async_wait() The async_hold queue pins encrypted input skbs while the AEAD engine references their scatterlist data. Once tls_decrypt_async_wait() returns, every AEAD operat

• CVE-2026-23413HigApr 2, 2026
  affected < 1-150700.1.3.1fixed 1-150700.1.3.1

  In the Linux kernel, the following vulnerability has been resolved: clsact: Fix use-after-free in init/destroy rollback asymmetry Fix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry. The latter is achieved by first fully initializing a clsact instance,

• CVE-2026-23398MedMar 26, 2026
  affected < 1-150700.1.3.1fixed 1-150700.1.3.1

  In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmp_tag_validation() icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] arra

• CVE-2026-31788HigMar 25, 2026
  affected < 1-150700.1.3.1fixed 1-150700.1.3.1

  In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: restrict usage in unprivileged domU The Xen privcmd driver allows to issue arbitrary hypercalls from user space processes. This is normally no problem, as access is usually limited to root and the

• CVE-2026-23386MedMar 25, 2026
  affected < 1-150700.1.3.1fixed 1-150700.1.3.1

  In the Linux kernel, the following vulnerability has been resolved: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL In DQ-QPL mode, gve_tx_clean_pending_packets() incorrectly uses the RDA buffer cleanup path. It iterates num_bufs times and attempts to

• CVE-2026-23381MedMar 25, 2026
  affected < 1-150700.1.3.1fixed 1-150700.1.3.1

  In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which in

• CVE-2026-23379MedMar 25, 2026
  affected < 1-150700.1.3.1fixed 1-150700.1.3.1

  In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: fix divide by zero in the offload path Offloading ETS requires computing each class' WRR weight: this is done by averaging over the sums of quanta as 'q_sum' and 'q_psum'. Using unsigned int, th

• CVE-2026-23361HigMar 25, 2026
  affected < 1-150700.1.3.1fixed 1-150700.1.3.1

  In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry Endpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X interrupt to the host using a writel(), which generates a PCI posted write trans

• CVE-2026-23319HigMar 25, 2026
  affected < 1-150700.1.3.1fixed 1-150700.1.3.1

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim The root cause of this bug is that when 'bpf_link_put' reduces the refcount of 'shim_link->link.link' to zero, the resource is considered released but may

• CVE-2026-23317HigMar 25, 2026
  affected < 1-150700.1.3.1fixed 1-150700.1.3.1

  In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions Before the referenced fixes these functions used a lookup function that returned a pointer. This was changed to another lookup function that r

• CVE-2026-23293MedMar 25, 2026
  affected < 1-150700.1.3.1fixed 1-150700.1.3.1

  In the Linux kernel, the following vulnerability has been resolved: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which ini

• CVE-2026-23292MedMar 25, 2026
  affected < 1-150700.1.3.1fixed 1-150700.1.3.1

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix recursive locking in __configfs_open_file() In flush_write_buffer, &p->frag_sem is acquired and then the loaded store function is called, which, here, is target_core_item_dbroot_store(). This

• CVE-2026-23281HigMar 25, 2026
  affected < 1-150700.1.3.1fixed 1-150700.1.3.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix use-after-free in lbs_free_adapter() The lbs_free_adapter() function uses timer_delete() (non-synchronous) for both command_timer and tx_lockup_timer before the structure is freed. This is i

• CVE-2026-23278HigMar 20, 2026
  affected < 1-150700.1.3.1fixed 1-150700.1.3.1

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: always walk all pending catchall elements During transaction processing we might have more than one catchall element: 1 live catchall element and 1 pending element that is coming as part o

• CVE-2026-23277MedMar 20, 2026
  affected < 1-150700.1.3.1fixed 1-150700.1.3.1

  In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit teql_master_xmit() calls netdev_start_xmit(skb, slave) to transmit through slave devices, but does not update skb->dev to the sl