🛡️ SUSE-SU-2026:2310-1 — kernel-64kb (CVE-2026-31405 +21 more)

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-31405: media: dvb-net: fix OOB access in ULE extension header tables (bsc#1261700).
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb in ip4ip6_err() (bsc#1263995).
• CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).
• CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).
• CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).
• CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
• CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
• CVE-2026-46004: ALSA: caiaq: Handle probe errors properly (bsc#1267222).
• CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
• CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
• CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (bsc#1266969).
• CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).

The following non security issues were fixed:

• arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
• arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).
• drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).
• drm/hyperv: validate VMBus packet size in receive callback (git-fixes).
• net: gro: don't merge zcopy skbs (git-fixes).
• net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).
• net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).
• net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).
• net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).
• net: mana: Skip redundant detach on already-detached port (git-fixes).
• net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).
• net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).
• net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).
• RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).
• s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068).
• s390/entry: Scrub r12 register on kernel entry (bsc#1263068).
• s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068).
• smb: client: correctly handle ErrorContextData as a flexible array (git-fixes).