suse/kgraft-patch-SLE12-SP5_Update_72&distro=SUSE Linux Enterprise Live Patching 12 SP5

Vulnerabilities (90)

• CVE-2026-23268HigMar 18, 2026
  affected < 9-2.1fixed 9-2.1

  In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confused deputy attack, by

• CVE-2026-23209HigFeb 14, 2026
  affected < 8-2.1fixed 8-2.1

  In the Linux kernel, the following vulnerability has been resolved: macvlan: fix error recovery in macvlan_common_newlink() valis provided a nice repro to crash the kernel: ip link add p1 type veth peer p2 ip link set address 00:00:00:00:00:20 dev p1 ip link set up dev p1 ip l

• CVE-2026-23191HigFeb 14, 2026
  affected < 9-2.1fixed 9-2.1

  In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop

• CVE-2026-23074HigFeb 4, 2026
  affected < 8-2.1fixed 8-2.1

  In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not important, I will desc

• CVE-2026-22999HigJan 25, 2026
  affected < 8-2.1fixed 8-2.1

  In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: do not free existing class in qfq_change_class() Fixes qfq_change_class() error case. cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we risk various UAF.

• CVE-2025-71120Jan 14, 2026
  affected < 8-2.1fixed 8-2.1

  In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf A zero length gss_token results in pages == 0 and in_token->pages[0] is NULL. The code unconditionally evaluates page_addres

• CVE-2025-68813Jan 13, 2026
  affected < 7-2.1fixed 7-2.1

  In the Linux kernel, the following vulnerability has been resolved: ipvs: fix ipv4 null-ptr-deref in route error path The IPv4 code path in __ip_vs_get_out_rt() calls dst_link_failure() without ensuring skb->dev is set, leading to a NULL pointer dereference in fib_compute_spec_

• CVE-2025-71085Jan 13, 2026
  affected < 7-2.1fixed 7-2.1

  In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is triggered as part of t

• CVE-2022-50756Dec 24, 2025
  affected < 7-2.1fixed 7-2.1

  In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix mempool alloc size Convert the max size to bytes to match the units of the divisor that calculates the worst-case number of PRP entries. The result is used to determine how many PRP Lists are req

• CVE-2022-50697Dec 24, 2025
  affected < 7-2.1fixed 7-2.1

  In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent UAF when applicant uninit The caller of del_timer_sync must prevent restarting of the timer, If we have no this synchronization, there is a small probability that the canc

• CVE-2025-68285Dec 16, 2025
  affected < 7-2.1fixed 7-2.1

  In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both

• CVE-2023-53794Dec 9, 2025
  affected < 8-2.1fixed 8-2.1

  In the Linux kernel, the following vulnerability has been resolved: cifs: fix session state check in reconnect to avoid use-after-free issue Don't collect exiting session in smb2_reconnect_server(), because it will be released soon. Note that the exiting session will stay in s

• CVE-2023-53781Dec 9, 2025
  affected < 7-2.1fixed 7-2.1

  In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in tcp_write_timer_handler(). With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcp_write_timer_handler() by kernel TCP sockets. [0] If SMC creates a kernel so

• CVE-2025-40204Nov 12, 2025
  affected < 4-2.1fixed 4-2.1

  In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

• CVE-2025-40186Nov 12, 2025
  affected < 5-2.1fixed 5-2.1

  In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(),

• CVE-2025-40018Oct 24, 2025
  affected < 8-2.1fixed 8-2.1

  In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-fr

• CVE-2023-53717Oct 22, 2025
  affected < 4-2.1fixed 4-2.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() Fix a stack-out-of-bounds write that occurs in a WMI response callback function that is called after a timeout occurs in ath9k_wm

• CVE-2025-39973Oct 15, 2025
  affected < 8-2.1fixed 8-2.1

  In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ring_len param The `ring_len` parameter provided by the virtual function (VF) is assigned directly to the hardware memory context (HMC) without any validation. To address this, introdu

• CVE-2023-53676Oct 7, 2025
  affected < 4-2.1fixed 4-2.1

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() The function lio_target_nacl_info_show() uses sprintf() in a loop to print details for every iSCSI connection in a session without checkin

• CVE-2022-50423Oct 1, 2025
  affected < 7-2.1fixed 7-2.1

  In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() There is an use-after-free reported by KASAN: BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82 Read of size 1 at addr ffff8