SUSE-SU-2026:24067-1 Security update for the Linux Kernel RT (Live Patch 19 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-41.1 fixes various security issues: The following security issues were fixed: - CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267370. - CVE-2026-63802: blk-cgroup: fix UAF in blkcgrstatflush bsc1272283. -...

CVE-2026-98372

The Linux kernel contains a stack out-of-bounds (OOB) read vulnerability in the xfrm: iptfs component. The issue stems from the iptfs_skb_reset_frag_walk() function, which uses an unbounded loop to advance fragments without checking if the index exceeds the nr_frags limit. While one caller is pro...

CVE-2026-98372 xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfsskbresetfragwalk iptfsskbresetfragwalk advances to the fragment containing @offset with an unbounded loop: while offset = walk-past + walk-fragswalk-fragi.len walk-past +=...

EUVD-2026-93357

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfsskbresetfragwalk iptfsskbresetfragwalk advances to the fragment containing @offset with an unbounded loop: while offset = walk-past + walk-fragswalk-fragi.len walk-past +=...

CVE-2026-98372 xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfsskbresetfragwalk iptfsskbresetfragwalk advances to the fragment containing @offset with an unbounded loop: while offset = walk-past + walk-fragswalk-fragi.len walk-past +=...

CVE-2026-98371 xfrm: iptfs: fix runt reassembly panic from short inner tot_len

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix runt reassembly panic from short inner totlen When the start of an inner packet is split across two outer packets such that fewer than 4 bytes land at the end of the first one, inputprocesspayload saves those byt...

CVE-2026-98371 xfrm: iptfs: fix runt reassembly panic from short inner tot_len

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix runt reassembly panic from short inner totlen When the start of an inner packet is split across two outer packets such that fewer than 4 bytes land at the end of the first one, inputprocesspayload saves those byt...

CVE-2026-98371

The Linux kernel contains a vulnerability in the xfrm: iptfs component where an attacker can trigger an unprivileged kernel panic (DoS) . The issue occurs during runt reassembly when an inner packet is split across outer packets; if the first fragment contains fewer than 4 bytes, __input_process_...

EUVD-2026-93356

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix runt reassembly panic from short inner totlen When the start of an inner packet is split across two outer packets such that fewer than 4 bytes land at the end of the first one, inputprocesspayload saves those byt...

CVE-2026-98370

The Linux kernel contains a use-after-free vulnerability in the xfrm component during ALLOCSPI requests. The issue arises because xfrm_state_netlink() and xfrm_alloc_userspi() perform redundant alloc_compat() calls. For compatibility requests, this causes the translator to misinterpret the 228-by...

CVE-2026-98369 xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()

In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcureadlock, skbdstforce and devhold for xfrmtransreinject syzbot reported a suspicious RCU usage warning in ip6pktdrop: WARNING: suspicious RCU usage in ip6pktdrop include/net/addrconf.h:389 suspicious...

CVE-2026-98370 xfrm: fix compat ALLOCSPI request use-after-free

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrmstatenetlink builds the ALLOCSPI response with dumponestate, which already calls alloccompat with the response skb and header. xfrmallocuserspi then calls alloccompat again, bu...

CVE-2026-98369

The Linux kernel is affected by a vulnerability in the xfrm subsystem where xfrm_trans_reinject was converted from a tasklet to a workqueue. Because workqueue workers run in process context, they fail to enter an RCU read-side critical section, causing RCU lockdep warnings when invoking finish ca...

CVE-2026-98369 xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()

In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcureadlock, skbdstforce and devhold for xfrmtransreinject syzbot reported a suspicious RCU usage warning in ip6pktdrop: WARNING: suspicious RCU usage in ip6pktdrop include/net/addrconf.h:389 suspicious...

CVE-2026-98370 xfrm: fix compat ALLOCSPI request use-after-free

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrmstatenetlink builds the ALLOCSPI response with dumponestate, which already calls alloccompat with the response skb and header. xfrmallocuserspi then calls alloccompat again, bu...

EUVD-2026-93354

In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcureadlock, skbdstforce and devhold for xfrmtransreinject syzbot reported a suspicious RCU usage warning in ip6pktdrop: WARNING: suspicious RCU usage in ip6pktdrop include/net/addrconf.h:389 suspicious...

EUVD-2026-93355

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrmstatenetlink builds the ALLOCSPI response with dumponestate, which already calls alloccompat with the response skb and header. xfrmallocuserspi then calls alloccompat again, bu...

CVE-2026-98368

The Linux kernel contains a vulnerability in the ESP (Encapsulating Security Payload) implementation where it fails to downgrade zerocopy managed frags before mutating the skb frag array on the out-of-place output path. Specifically, when SKBFL_MANAGED_FRAG_REFS is set, the ESP component mutates ...

EUVD-2026-93353

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path esp-inplace == false ESP rewrites the skb frag array: espoutputhead appends a trailer frag and espoutputtail replaces the frags with ...

CVE-2026-98368 esp: downgrade zerocopy managed frags before mutating skb frags

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path esp-inplace == false ESP rewrites the skb frag array: espoutputhead appends a trailer frag and espoutputtail replaces the frags with ...