File _patchinfo of Package patchinfo.43196

<patchinfo incident="43196">
  <!--generated with prepare-kernel from request 403652-->
  <issue tracker="bnc" id="1238917">VUL-0: CVE-2025-21738: kernel: ata: libata-sff: ensure that we cannot write outside the allocated buffer</issue>
  <issue tracker="bnc" id="1246166">VUL-0: CVE-2025-38224: kernel: can: kvaser_pciefd: refine error prone echo_skb_max handling logic</issue>
  <issue tracker="bnc" id="1247177">VUL-0: CVE-2025-38375: kernel: virtio-net: ensure the received length does not exceed allocated size</issue>
  <issue tracker="bnc" id="1255049">VUL-0: CVE-2023-53827: kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}</issue>
  <issue tracker="bnc" id="1255163">VUL-0: CVE-2023-53794: kernel: cifs: fix session state check in reconnect to avoid use-after-free issue</issue>
  <issue tracker="bnc" id="1255401">VUL-0: CVE-2025-68285: kernel: libceph: fix potential use-after-free in have_mon_and_osd_map()</issue>
  <issue tracker="bnc" id="1256645">VUL-0: CVE-2025-71066: kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change</issue>
  <issue tracker="bnc" id="1257231">VUL-0: CVE-2026-23004: kernel: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()</issue>
  <issue tracker="bnc" id="1257735">VUL-0: CVE-2026-23060: kernel: crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec</issue>
  <issue tracker="bnc" id="1257749">VUL-0: CVE-2026-23074: kernel: net/sched: Enforce that teql can only be used as root qdisc</issue>
  <issue tracker="bnc" id="1257790">VUL-0: CVE-2026-23089: kernel: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()</issue>
  <issue tracker="bnc" id="1258340">VUL-0: CVE-2026-23204: kernel: net/sched: cls_u32: use skb_header_pointer_careful()</issue>
  <issue tracker="bnc" id="1258395">VUL-0: CVE-2026-23191: kernel: ALSA: aloop: Fix racy access at PCM trigger</issue>
  <issue tracker="bnc" id="1258849">VUL-0: apparmor: "CrackArmor": multi issues found by Qualys</issue>
  <issue tracker="cve" id="2023-53794"/>
  <issue tracker="cve" id="2023-53827"/>
  <issue tracker="cve" id="2025-21738"/>
  <issue tracker="cve" id="2025-38224"/>
  <issue tracker="cve" id="2025-38375"/>
  <issue tracker="cve" id="2025-68285"/>
  <issue tracker="cve" id="2025-71066"/>
  <issue tracker="cve" id="2026-23004"/>
  <issue tracker="cve" id="2026-23060"/>
  <issue tracker="cve" id="2026-23074"/>
  <issue tracker="cve" id="2026-23089"/>
  <issue tracker="cve" id="2026-23191"/>
  <issue tracker="cve" id="2026-23204"/>
  <issue tracker="jsc" id="PED-12836"/>
  <category>security</category>
  <rating>important</rating>
  <packager>alix82</packager>
  <summary>Security update for the Linux Kernel</summary>
  <description>
The SUSE Linux Enterprise 15 SP3 kernel was updated to fix various security issues

The following security issues were fixed:

- CVE-2023-53794: cifs: fix session state check in reconnect to avoid use-after-free issue (bsc#1255163).
- CVE-2023-53827: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} (bsc#1255049).
- CVE-2025-21738: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (bsc#1238917).
- CVE-2025-38375: virtio-net: ensure the received length does not exceed allocated size (bsc#1247177).
- CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
- CVE-2025-71066: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change
  (bsc#1256645).
- CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
- CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (bsc#1257735).
- CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
- CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).
- CVE-2026-23191: ALSA: aloop: Fix racy access at PCM trigger (bsc#1258395).
- CVE-2026-23204: net: add skb_header_pointer_careful() helper (bsc#1258340).

The following non security issues were fixed:

- apparmor: fix differential encoding verification (bsc#1258849).
- apparmor: Fix double free of ns_name in aa_replace_profiles() (bsc#1258849).
- apparmor: fix memory leak in verify_header (bsc#1258849).
- apparmor: fix missing bounds check on DEFAULT table in verify_dfa() (bsc#1258849).
- apparmor: fix side-effect bug in match_char() macro usage (bsc#1258849).
- apparmor: fix unprivileged local user can do privileged policy management (bsc#1258849).
- apparmor: fix: limit the number of levels of policy namespaces (bsc#1258849).
- apparmor: replace recursive profile removal with iterative approach (bsc#1258849).
- apparmor: validate DFA start states are in bounds in unpack_pdb (bsc#1258849).
</description>
  <reboot_needed/>
</patchinfo>