File _patchinfo of Package patchinfo.43074

<patchinfo incident="43074">
  <issue id="1226591" tracker="bnc">VUL-0: CVE-2024-38542: kernel: RDMA/mana_ib: boundary check before installing cq callbacks</issue>
  <issue id="1241345" tracker="bnc">tsc: Marking TSC unstable due to clocksource watchdog, again — ref:_00D1igLOd._500TrXoUjB:ref</issue>
  <issue id="1243055" tracker="bnc">VUL-0: CVE-2025-37861: kernel: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue</issue>
  <issue id="1245728" tracker="bnc">[SUSE][MANA][Backport] net: mana: Handle Reset Request from MANA NIC</issue>
  <issue id="1249998" tracker="bnc">VUL-0: CVE-2025-39817: kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare</issue>
  <issue id="1251135" tracker="bnc">[suse][Backport] Manaib\RDMA Core - Bulk Patches Request</issue>
  <issue id="1251186" tracker="bnc">Backport six scsi mpi3mr commits</issue>
  <issue id="1251966" tracker="bnc">VUL-0: CVE-2025-39964: kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg</issue>
  <issue id="1251971" tracker="bnc">net: mana: Add support for auxiliary device servicing events</issue>
  <issue id="1252266" tracker="bnc">[SUSE][MANA][Backport] net: mana: Reduce waiting time if HWC not responding</issue>
  <issue id="1252911" tracker="bnc">VUL-0: CVE-2025-40099: kernel: cifs: parse_dfs_referrals: prevent oob on malformed input</issue>
  <issue id="1252924" tracker="bnc">VUL-0: CVE-2025-40103: kernel: smb: client: Fix refcount leak for cifs_sb_tlink</issue>
  <issue id="1253049" tracker="bnc">[SUSE][Mana Direct][Backport] Patch: net: mana: Support HW link state events</issue>
  <issue id="1254306" tracker="bnc">SLES 15 SP7 - s390/mm: Disable HugeTLB Vmemmap Optimization (HVO)</issue>
  <issue id="1254992" tracker="bnc">VUL-0: CVE-2023-53817: kernel: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()</issue>
  <issue id="1255084" tracker="bnc">VUL-0: CVE-2025-40253: s390/ctcm: Fix double-kfree</issue>
  <issue id="1256564" tracker="bnc">80 % write performance drop in 6.4.0-150600.23.73 kernel on ceph rbd devices [thread::xiTaeF0TJ1Ok_0FDjE-ifCs::]</issue>
  <issue id="1256645" tracker="bnc">VUL-0: CVE-2025-71066: kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change</issue>
  <issue id="1256690" tracker="bnc">[SUSE][hv_netvsc][Distros][Backport][GB200] hv_netvsc module reload fails for ARM64 SKUs</issue>
  <issue id="1256716" tracker="bnc">VUL-0: CVE-2025-71113: kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc</issue>
  <issue id="1257231" tracker="bnc">VUL-0: CVE-2026-23004: kernel: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()</issue>
  <issue id="1257466" tracker="bnc">[Suse][MANA][Backport] [GB200] Backport patch for handling device slow probe on GB200</issue>
  <issue id="1257472" tracker="bnc">[SUSE][Mana][Backport] net: mana: Implement ndo_tx_timeout and serialize queue resets per port.</issue>
  <issue id="1257473" tracker="bnc">[SUSE]{hv_netvsc][Backport] net: hv_netvsc: reject RSS hash key programming without RX indirection table</issue>
  <issue id="1257732" tracker="bnc">VUL-0: CVE-2026-23054: kernel: net: hv_netvsc: reject RSS hash key programming without RX indirection table</issue>
  <issue id="1257735" tracker="bnc">VUL-0: CVE-2026-23060: kernel: crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec</issue>
  <issue id="1257749" tracker="bnc">VUL-0: CVE-2026-23074: kernel: net/sched: Enforce that teql can only be used as root qdisc</issue>
  <issue id="1257790" tracker="bnc">VUL-0: CVE-2026-23089: kernel: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()</issue>
  <issue id="1257891" tracker="bnc">Kernel worker threads running in isolated (nohz) cores causes application performance degradation [ thread::WsmmU463JLaBQ1VrtwLSUSs:: ]</issue>
  <issue id="1257952" tracker="bnc">Nvidia Grace:tegra-qspi: Fix race condition causing NULL pointer dereference and spurious IRQ</issue>
  <issue id="1258181" tracker="bnc">VUL-0: CVE-2026-23111: kernel: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()</issue>
  <issue id="1258338" tracker="bnc">VUL-0: CVE-2026-23202: kernel: spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer</issue>
  <issue id="1258340" tracker="bnc">VUL-0: CVE-2026-23204: kernel: net/sched: cls_u32: use skb_header_pointer_careful()</issue>
  <issue id="1258376" tracker="bnc">VUL-0: CVE-2026-23157: kernel: btrfs: do not strictly require dirty metadata threshold for metadata writepages</issue>
  <issue id="1258377" tracker="bnc">VUL-0: CVE-2026-23141: kernel: btrfs: send: check for inline extents in range_is_hole_in_parent()</issue>
  <issue id="1258395" tracker="bnc">VUL-0: CVE-2026-23191: kernel: ALSA: aloop: Fix racy access at PCM trigger</issue>
  <issue id="1258424" tracker="bnc">VUL-0: CVE-2025-71231: kernel: crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode</issue>
  <issue id="1258464" tracker="bnc">VUL-0: CVE-2026-23214: kernel: btrfs: reject new transactions if the fs is fully read-only</issue>
  <issue id="1258518" tracker="bnc">VUL-0: CVE-2026-23209: kernel: macvlan: fix error recovery in macvlan_common_newlink()</issue>
  <issue id="1258524" tracker="bnc">VUL-0: CVE-2026-23207: kernel: spi: tegra210-quad: Protect curr_xfer check in IRQ handler</issue>
  <issue id="1258832" tracker="bnc">mpi3mr debug messages</issue>
  <issue id="1258849" tracker="bnc">VUL-0: apparmor: "CrackArmor": multi issues found by Qualys</issue>
  <issue id="1258928" tracker="bnc">L3: Azure - RCA "Kernel panic - not syncing: Fatal exception" - SFSC 01653630</issue>
  <issue id="1259070" tracker="bnc">L3: NULL pointer dereference in smb2_query_server_interfaces() — thread::wCK8HTgYJkeoLtvUdsfuxSs::</issue>
  <issue id="2023-53817" tracker="cve" />
  <issue id="2024-38542" tracker="cve" />
  <issue id="2025-37861" tracker="cve" />
  <issue id="2025-39817" tracker="cve" />
  <issue id="2025-39964" tracker="cve" />
  <issue id="2025-40099" tracker="cve" />
  <issue id="2025-40103" tracker="cve" />
  <issue id="2025-40253" tracker="cve" />
  <issue id="2025-71066" tracker="cve" />
  <issue id="2025-71113" tracker="cve" />
  <issue id="2025-71231" tracker="cve" />
  <issue id="2026-23004" tracker="cve" />
  <issue id="2026-23054" tracker="cve" />
  <issue id="2026-23060" tracker="cve" />
  <issue id="2026-23074" tracker="cve" />
  <issue id="2026-23089" tracker="cve" />
  <issue id="2026-23111" tracker="cve" />
  <issue id="2026-23141" tracker="cve" />
  <issue id="2026-23157" tracker="cve" />
  <issue id="2026-23191" tracker="cve" />
  <issue id="2026-23202" tracker="cve" />
  <issue id="2026-23204" tracker="cve" />
  <issue id="2026-23207" tracker="cve" />
  <issue id="2026-23209" tracker="cve" />
  <issue id="2026-23214" tracker="cve" />
  <issue tracker="bnc" id="1258850">VUL-0: CVE-2026-23268: kernel: apparmor: fix unprivileged local user can do privileged policy management</issue>
  <issue tracker="bnc" id="1259857">VUL-0: CVE-2026-23269: kernel: apparmor: validate DFA start states are in bounds in unpack_pdb</issue>
  <issue tracker="cve" id="2026-23268"/>
  <issue tracker="cve" id="2026-23269"/>
  <category>security</category>
  <rating>important</rating>
  <packager>tabraham1</packager>
  <reboot_needed/>
  <description>
The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.


The following security bugs were fixed:

- CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
- CVE-2024-38542: RDMA/mana_ib: boundary check before installing cq callbacks (bsc#1226591).
- CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
- CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
- CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
- CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
- CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
- CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
- CVE-2025-71066: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (bsc#1256645).
- CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
- CVE-2025-71231: crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (bsc#1258424).
- CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
- CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (bsc#1257735).
- CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
- CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).
- CVE-2026-23111: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (bsc#1258181).
- CVE-2026-23141: btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377).
- CVE-2026-23191: ALSA: aloop: Fix racy access at PCM trigger (bsc#1258395).
- CVE-2026-23204: net/sched: cls_u32: use skb_header_pointer_careful() (bsc#1258340).
- CVE-2026-23209: macvlan: fix error recovery in macvlan_common_newlink() (bsc#1258518).
- CVE-2026-23214: btrfs: reject new transactions if the fs is fully read-only (bsc#1258464).
- CVE-2026-23268: apparmor: fix unprivileged local user can do privileged policy management (bsc#1258850).
- CVE-2026-23269: apparmor: validate DFA start states are in bounds in unpack_pdb (bsc#1259857).

The following non-security bugs were fixed:

- Add bugnumber to existing mana change (bsc#1251971).
- Drivers: hv: fix missing kernel-doc description for 'size' in request_arr_init() (git-fixes).
- Drivers: hv: remove stale comment (git-fixes).
- Drivers: hv: vmbus: Clean up sscanf format specifier in target_cpu_store() (git-fixes).
- Drivers: hv: vmbus: Fix sysfs output format for ring buffer index (git-fixes).
- Drivers: hv: vmbus: Fix typos in vmbus_drv.c (git-fixes).
- PCI: hv: Correct a comment (git-fixes).
- PCI: hv: Remove unnecessary flex array in struct pci_packet (git-fixes).
- PCI: hv: Remove unused field pci_bus in struct hv_pcibus_device (git-fixes).
- PCI: hv: remove unnecessary module_init/exit functions (git-fixes).
- RDMA/mana_ib: Access remote atomic for MRs (bsc#1251135).
- RDMA/mana_ib: Add EQ creation for rnic adapter (git-fixes).
- RDMA/mana_ib: Add device statistics support (git-fixes).
- RDMA/mana_ib: Add device-memory support (git-fixes).
- RDMA/mana_ib: Add port statistics support (git-fixes).
- RDMA/mana_ib: Add support of 4M, 1G, and 2G pages (git-fixes).
- RDMA/mana_ib: Add support of mana_ib for RNIC and ETH nic (git-fixes).
- RDMA/mana_ib: Adding and deleting GIDs (git-fixes).
- RDMA/mana_ib: Allow registration of DMA-mapped memory in PDs (git-fixes).
- RDMA/mana_ib: Configure mac address in RNIC (git-fixes).
- RDMA/mana_ib: Create and destroy RC QP (git-fixes).
- RDMA/mana_ib: Create and destroy UD/GSI QP (git-fixes).
- RDMA/mana_ib: Create and destroy rnic adapter (git-fixes).
- RDMA/mana_ib: Drain send wrs of GSI QP (git-fixes).
- RDMA/mana_ib: Enable RoCE on port 1 (git-fixes).
- RDMA/mana_ib: Extend modify QP (git-fixes).
- RDMA/mana_ib: Fix DSCP value in modify QP (git-fixes).
- RDMA/mana_ib: Fix error code in probe() (git-fixes).
- RDMA/mana_ib: Fix integer overflow during queue creation (bsc#1251135).
- RDMA/mana_ib: Fix missing ret value (git-fixes).
- RDMA/mana_ib: Handle net event for pointing to the current netdev (bsc#1256690).
- RDMA/mana_ib: Implement DMABUF MR support (git-fixes).
- RDMA/mana_ib: Implement port parameters (git-fixes).
- RDMA/mana_ib: Implement uapi to create and destroy RC QP (git-fixes).
- RDMA/mana_ib: Introduce helpers to create and destroy mana queues (git-fixes).
- RDMA/mana_ib: Introduce mana_ib_get_netdev helper function (git-fixes).
- RDMA/mana_ib: Introduce mana_ib_install_cq_cb helper function (git-fixes).
- RDMA/mana_ib: Introduce mdev_to_gc helper function (git-fixes).
- RDMA/mana_ib: Modify QP state (git-fixes).
- RDMA/mana_ib: Process QP error events in mana_ib (git-fixes).
- RDMA/mana_ib: Query feature_flags bitmask from FW (git-fixes).
- RDMA/mana_ib: Set correct device into ib (git-fixes).
- RDMA/mana_ib: Take CQ type from the device type (git-fixes).
- RDMA/mana_ib: UD/GSI QP creation for kernel (git-fixes).
- RDMA/mana_ib: UD/GSI work requests (git-fixes).
- RDMA/mana_ib: Use num_comp_vectors of ib_device (git-fixes).
- RDMA/mana_ib: Use safer allocation function() (bsc#1251135).
- RDMA/mana_ib: Use struct mana_ib_queue for CQs (git-fixes).
- RDMA/mana_ib: Use struct mana_ib_queue for RAW QPs (git-fixes).
- RDMA/mana_ib: Use struct mana_ib_queue for WQs (git-fixes).
- RDMA/mana_ib: add additional port counters (bsc#1251135).
- RDMA/mana_ib: add support of multiple ports (bsc#1251135).
- RDMA/mana_ib: check cqe length for kernel CQs (git-fixes).
- RDMA/mana_ib: create EQs for RNIC CQs (git-fixes).
- RDMA/mana_ib: create and destroy RNIC cqs (git-fixes).
- RDMA/mana_ib: create kernel-level CQs (git-fixes).
- RDMA/mana_ib: create/destroy AH (git-fixes).
- RDMA/mana_ib: extend mana QP table (git-fixes).
- RDMA/mana_ib: extend query device (git-fixes).
- RDMA/mana_ib: helpers to allocate kernel queues (git-fixes).
- RDMA/mana_ib: implement get_dma_mr (git-fixes).
- RDMA/mana_ib: implement req_notify_cq (git-fixes).
- RDMA/mana_ib: implement uapi for creation of rnic cq (git-fixes).
- RDMA/mana_ib: indicate CM support (git-fixes).
- RDMA/mana_ib: introduce a helper to remove cq callbacks (git-fixes).
- RDMA/mana_ib: polling of CQs for GSI/UD (git-fixes).
- RDMA/mana_ib: remove useless return values from dbg prints (git-fixes).
- RDMA/mana_ib: request error CQEs when supported (git-fixes).
- RDMA/mana_ib: set node_guid (git-fixes).
- RDMA/mana_ib: support of the zero based MRs (bsc#1251135).
- RDMA/mana_ib: unify mana_ib functions to support any gdma device (git-fixes).
- apparmor: Fix double free of ns_name in aa_replace_profiles() (bsc#1258849).
- apparmor: fix differential encoding verification (bsc#1258849).
- apparmor: fix memory leak in verify_header (bsc#1258849).
- apparmor: fix missing bounds check on DEFAULT table in verify_dfa() (bsc#1258849).
- apparmor: fix race between freeing data and fs accessing it (bsc#1258849).
- apparmor: fix race on rawdata dereference (bsc#1258849).
- apparmor: fix side-effect bug in match_char() macro usage (bsc#1258849).
- apparmor: fix unprivileged local user can do privileged policy management (bsc#1258849).
- apparmor: fix: limit the number of levels of policy namespaces (bsc#1258849).
- apparmor: replace recursive profile removal with iterative approach (bsc#1258849).
- apparmor: validate DFA start states are in bounds in unpack_pdb (bsc#1258849).
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (git-fixes).
- cifs: add xid to query server interface call (git-fixes).
- clocksource: Print durations for sync check unconditionally (bsc#1241345).
- clocksource: Reduce watchdog readout delay limit to prevent false positives (bsc#1241345).
- hv/hv_kvp_daemon: Handle IPv4 and Ipv6 combination for keyfile format (git-fixes).
- hv/hv_kvp_daemon: Pass NIC name to hv_get_dns_info as well (git-fixes).
- net/mana: Null service_wq on setup error to prevent double destroy (git-fix).
- net: mana: Add metadata support for xdp mode (git-fixes).
- net: mana: Add standard counter rx_missed_errors (git-fixes).
- net: mana: Add support for auxiliary device servicing events (bsc#1251971).
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (bsc#1256690).
- net: mana: Drop TX skb on post_work_request failure and unmap resources (git-fixes).
- net: mana: Fix double destroy_workqueue on service rescan PCI path (git-fixes).
- net: mana: Fix use-after-free in reset service rescan path (git-fixes).
- net: mana: Fix warnings for missing export.h header inclusion (git-fixes).
- net: mana: Handle Reset Request from MANA NIC (bsc#1245728 bsc#1251971).
- net: mana: Handle SKB if TX SGEs exceed hardware limit (git-fixes).
- net: mana: Handle hardware recovery events when probing the device (bsc#1257466).
- net: mana: Handle unsupported HWC commands (git-fixes).
- net: mana: Implement ndo_tx_timeout and serialize queue resets per port (bsc#1257472).
- net: mana: Move hardware counter stats from per-port to per-VF context (git-fixes).
- net: mana: Probe rdma device in mana driver (git-fixes).
- net: mana: Reduce waiting time if HWC not responding (bsc#1252266).
- net: mana: Ring doorbell at 4 CQ wraparounds (git-fixes).
- net: mana: Support HW link state events (bsc#1253049).
- net: mana: Use mana_cleanup_port_context() for rxq cleanup (git-fixes).
- net: mana: fix spelling for mana_gd_deregiser_irq() (git-fixes).
- net: mana: use ethtool string helpers (git-fixes).
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (bsc#1254306).
- scsi: mpi3mr: Event processing debug improvement (bsc#1251186, bsc#1258832).
- scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT (git-fixes).
- scsi: storvsc: Remove redundant ternary operators (git-fixes).
- shrink_slab_memcg: clear_bits of skipped shrinkers (bsc#1256564).
- spi: tegra210-quad: Move curr_xfer read inside spinlock (bsc#1257952)
- spi: tegra210-quad: Protect curr_xfer assignment in (bsc#1257952)
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (bsc#1257952)
- spi: tegra210-quad: Protect curr_xfer clearing in (bsc#1257952)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (bsc#1257952)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed (bsc#1257952)
- tools/hv: add a .gitignore file (git-fixes).
- tools/hv: reduce resouce usage in hv_get_dns_info helper (git-fixes).
- tools/hv: reduce resource usage in hv_kvp_daemon (git-fixes).
- tools: hv: Enable debug logs for hv_kvp_daemon (git-fixes).
- tools: hv: lsvmbus: change shebang to use python3 (git-fixes).
- workqueue: mark power efficient workqueue as unbounded if (bsc#1257891)
</description>
<!-- inserted by gitlab@gitlab.suse.de:security/tools.git//home/securitybot/src/sectools/auto_maintenance.pl -->
<releasetarget project="SUSE:Updates:openSUSE-SLE:15.6"/>
<releasetarget project="SUSE:Updates:SLE-Product-SLES_SAP:15-SP6:x86_64"/>
<releasetarget project="SUSE:Updates:SLE-Product-SLES_SAP:15-SP6:ppc64le"/>
<releasetarget project="SUSE:Updates:SLE-Product-SLES:15-SP6-LTSS:x86_64"/>
<releasetarget project="SUSE:Updates:SLE-Product-SLES:15-SP6-LTSS:s390x"/>
<releasetarget project="SUSE:Updates:SLE-Product-SLES:15-SP6-LTSS:ppc64le"/>
<releasetarget project="SUSE:Updates:SLE-Product-SLES:15-SP6-LTSS:aarch64"/>
<releasetarget project="SUSE:Updates:SLE-Product-HA:15-SP6:x86_64"/>
<releasetarget project="SUSE:Updates:SLE-Product-HA:15-SP6:s390x"/>
<releasetarget project="SUSE:Updates:SLE-Product-HA:15-SP6:ppc64le"/>
<releasetarget project="SUSE:Updates:SLE-Product-HA:15-SP6:aarch64"/>
<releasetarget project="SUSE:SLE-15-SP6:Update"/>
	<summary>Security update for the Linux Kernel</summary>
</patchinfo>