SUSE-SU-2026:0019-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2025-55753: Fixed modmd ACME unintended retry intervals bsc1254511 - CVE-2025-65082: Fixed CGI environment variable override bsc1254514 - CVE-2025-58098: Fixed Server Side Includes adding query string to exec cmd=... bsc1254512 -...

mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals

An integer overflow flaw has been discovered in the Apache HTTP server. The integer overflow in the case of failed ACME certificate renewal leads, after a number of failures 30 days in default configurations, to the backoff timer becoming 0. Attempts to renew the certificate then are repeated...

Unity Linux 20.1060a Security Update: kernel (UTSA-2025-993174)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993174 advisory. In the Linux kernel, the following vulnerability has been resolved: drivers/md/md-bitmap: check the return value of mdbitmapgetcounter Check the return value of...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992895)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992895 advisory. In the Linux kernel, the following vulnerability has been resolved: md: call mdstopwrites in mdstop From the link 1, we can see raid1d was running even after the pat...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-992827)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992827 advisory. In the Linux kernel, the following vulnerability has been resolved: md/raid10: check slab-out-of-bounds in mdbitmapgetcounter If we write a large number to...

CVE-2023-54294

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix memleak of md thread In raid10run, if setupconf succeed and raid10run failed before setting 'mddev-thread', then in the error path 'conf-thread' is not freed. Fix the problem by setting 'mddev-thread' right after...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992464)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992464 advisory. In the Linux kernel, the following vulnerability has been resolved: md-raid10: fix KASAN warning There's a KASAN warning in raid10removedisk when running the lvm tes...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992473)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992473 advisory. In the Linux kernel, the following vulnerability has been resolved: md: call mdstopwrites in mdstop From the link 1, we can see raid1d was running even after the pat...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992376)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992376 advisory. In the Linux kernel, the following vulnerability has been resolved: drivers/md/md-bitmap: check the return value of mdbitmapgetcounter Check the return value of...

SUSE CVE-2025-68368

In the Linux kernel, the following vulnerability has been resolved: md: init bioset in mddevinit IO operations may be needed before mdrun, such as updating metadata after writing sysfs. Without bioset, this triggers a NULL pointer dereference as below: BUG: kernel NULL pointer dereference, addres...

SUSE CVE-2025-68373

In the Linux kernel, the following vulnerability has been resolved: md: avoid repeated calls to delgendisk There is a uaf problem which is found by case 23rdev-lifetime: Oops: general protection fault, probably for non-canonical address 0xdead000000000122 RIP: 0010:bdiunregister+0x4b/0x170 Call...

SUSE CVE-2025-68374

In the Linux kernel, the following vulnerability has been resolved: md: fix rcu protection in mdwakeupthread We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling mdwakeupthread. This means that the RCU pointer has been acquired before rcureadlock,...

UBUNTU-CVE-2022-50715

In the Linux kernel, the following vulnerability has been resolved: md/raid1: stop mdxraid1 thread when raid1 array run failed fail run raid1 array when we assemble array with the inactive disk only, but the mdxraid1 thread were not stop, Even if the associated resources have been released. it wi...

CVE-2022-50752 md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk()

In the Linux kernel, the following vulnerability has been resolved: md/raid5: Remove unnecessary bioput in raid5readonechunk When running chunk-sized reads on disks with badblocks duplicate bio free/puts are observed: ============================================================================= B...

EUVD-2025-205081

In the Linux kernel, the following vulnerability has been resolved: md: avoid repeated calls to delgendisk There is a uaf problem which is found by case 23rdev-lifetime: Oops: general protection fault, probably for non-canonical address 0xdead000000000122 RIP: 0010:bdiunregister+0x4b/0x170 Call...

EUVD-2025-205086

In the Linux kernel, the following vulnerability has been resolved: md: init bioset in mddevinit IO operations may be needed before mdrun, such as updating metadata after writing sysfs. Without bioset, this triggers a NULL pointer dereference as below: BUG: kernel NULL pointer dereference, addres...

CVE-2025-68374

In the Linux kernel, the following vulnerability has been resolved: md: fix rcu protection in mdwakeupthread We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling mdwakeupthread. This means that the RCU pointer has been acquired before rcureadlock,...

CVE-2025-68373

In the Linux kernel, the following vulnerability has been resolved: md: avoid repeated calls to delgendisk There is a uaf problem which is found by case 23rdev-lifetime: Oops: general protection fault, probably for non-canonical address 0xdead000000000122 RIP: 0010:bdiunregister+0x4b/0x170 Call...

CVE-2025-68374

In the Linux kernel, the following vulnerability has been resolved: md: fix rcu protection in mdwakeupthread We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling mdwakeupthread. This means that the RCU pointer has been acquired before rcureadlock,...

CVE-2025-68373

In the Linux kernel, the following vulnerability has been resolved: md: avoid repeated calls to delgendisk There is a uaf problem which is found by case 23rdev-lifetime: Oops: general protection fault, probably for non-canonical address 0xdead000000000122 RIP: 0010:bdiunregister+0x4b/0x170 Call...