Security update for the Linux Kernel (Live Patch 39 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.163 fixes various security issues: The following security issues were fixed: CVE-2026-46150: fanotify: fix false positive on permission events bsc1267388. CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on devic...

CVE-2026-93181: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix uncorebox ref/unref ordering In uncoreeventcpuonline, uncoreboxref was called before uncorechangecontext. uncoreboxref gates on box-cpu = 0, but box-cpu is still -1 at that point because...

CVE-2026-93164: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Move optimized uprobe from nop5 to nop10 Andrii reported an issue with optimized uprobes 1 that can clobber redzone area with call instruction storing return address on stack where user code may keep temporary data...

CVE-2026-90136: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/hsmp: Reject negative power cap writes in hwmon hsmphwmonwrite takes the user-supplied hwmon value as a signed long and assigns "val / MICROWATTPERMILLIWATT" to msg.args0, which is a u32. MICROWATTPERMILLIWATT is...

CVE-2026-90358: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btfdistillfuncproto accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128 reaches the x86 trampoline with argsize == 16. But the current...

CVE-2026-90383: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: misc: sgi-gru: remove interrupt-context page-table walks The GRU TLB miss handler walks a process's page tables without holding page-table locks or a reference to the mapped page. It also uses a kernel page-table accessor on user...

CVE-2026-90137: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...

CVE-2026-93128: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: lg-laptop: Fix LED resource handling The event notification callback might access kbdbacklight even when it was not successfully registered with the LED subsystem. The same happens inside acpiremove, where the LED...

CVE-2026-93131: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-privacy: Fix race condition Accessing priv-featurespresent needs to happen with the list mutex being held, otherwise priv can be freed at any moment...

CVE-2026-93066: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Take cpalock around large-page collapse Loading and unloading modules concurrently on several CPUs on a KASAN build, with a short delay injected at the CPA page-table lookup to widen the window, faults within minutes:...

CVE-2026-93116: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wmi: fix resource leaks on probe failure During driver initialization in asuswmiadd, various subsystems are registered sequentially. However, the error path labels are out of order relative to the registration...

CVE-2026-90042

In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc buffers The fscrypt subsystem uses the scatterlist crypto API, inheriting its requirement that any buffers are in the linear mapping region. However, the messenger client uses kvmalloc ...

CVE-2026-89928

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk kvmrmaplock deliberately elides the rmap lock when it observes an empty rmap. In that case kvmrmaplockreadonly also re-enables preemption and returns zero, so...

CVE-2026-89984

This vulnerability affects the Linux kernel 's perf/x86/intel subsystem. Before Arch LBR gained CPL filtering support, intel_pmu_lbr_filter() did not fully validate the privilege level of sampled entries. While it filtered some mismatches based on branch type and the destination address, it faile...

EUVD-2026-80584

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix kernel address leakages in LBR stack Before Arch LBR gained CPL filtering support, a user-only branch stack could still contain kernel addresses. As a result, kernel branch records may be exposed to user space...

CVE-2026-89928 KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk kvmrmaplock deliberately elides the rmap lock when it observes an empty rmap. In that case kvmrmaplockreadonly also re-enables preemption and returns zero, so...

CVE-2026-89928 KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk kvmrmaplock deliberately elides the rmap lock when it observes an empty rmap. In that case kvmrmaplockreadonly also re-enables preemption and returns zero, so...

CVE-2026-89928

CVE-2026-89928 is a slab use-after-free in the Linux kernel's KVM x86/mmu subsystem. The root cause is a race condition in the lockless reverse-mapping (rmap) walk: kvm_rmap_age_gfn_range() ignores the value returned by kvm_rmap_lock_readonly() and instead re-reads the rmap head via rmap_get_firs...

SUSE CVE-2026-89581

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

CVE-2026-89928: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk kvmrmaplock deliberately elides the rmap lock when it observes an empty rmap. In that case kvmrmaplockreadonly also re-enables preemption and returns zero, so...