Security update for the Linux Kernel
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290). - CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430). - CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029). - CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800). - CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565). - CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604). - CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085). - CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392). - CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824). - CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618). - CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620). - CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825). - CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816). - CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765). - CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748). - CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798). - CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674). - CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072). - CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178). - CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057). - CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319). - CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796). - CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581). - CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133). - CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578). - CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137). - CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573). - CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143). - CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568). - CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563). - CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744). - CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067). - CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045). - CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145). - CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015). - CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012). - CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007). - CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001). - CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930). - CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934). - CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998). - CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (bsc#1263996). - CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993). - CVE-2026-43053: xfs: factor out xfs_attr3_node_entry_remove (bsc#1264084). - CVE-2026-43057: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (bsc#1264056). - CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263). - CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236). - CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241). - CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266). - CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230). - CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286). - CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261). - CVE-2026-43090: xfrm: fix refc
AI Analysis
Technical Summary
This advisory covers several security fixes in the Linux kernel packages distributed by Red Hat, including a critical privilege escalation and information disclosure vulnerability on Arm processors (CVE-2025-10263). Other fixed issues include out-of-bounds reads in SMB client code (CVE-2026-43112), use-after-free in network code (CVE-2026-46323), and multiple other memory safety and logic errors across kernel subsystems. The vulnerabilities have been assigned CVEs and have CVSS scores up to 9.1, indicating critical impact. Red Hat has released updated kernel packages for multiple architectures and product variants, including Red Hat Enterprise Linux versions 8.4, 8.6, 9, and 10, along with their Extended Update Support and Long Life Cycle variants. The vendor advisory confirms that these updates must be applied and systems rebooted to mitigate the issues.
Potential Impact
Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges or disclose sensitive information on affected systems. The CVSS 3.1 base score of 9.1 for CVE-2025-10263 indicates critical impact with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Other vulnerabilities fixed include memory corruption and out-of-bounds read/write issues that could lead to system instability or further exploitation. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released official kernel updates addressing these vulnerabilities. Users should apply the relevant security updates for their Red Hat Enterprise Linux versions as detailed in the vendor advisories (e.g., RHSA-2026:47248 and RHSA-2026:34911) and reboot the systems to activate the fixes. Delaying updates may leave systems exposed. No alternative mitigations are specified by the vendor; patching is the recommended and effective remediation.
Security update for the Linux Kernel
Description
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290). - CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430). - CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029). - CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800). - CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565). - CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604). - CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085). - CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392). - CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824). - CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618). - CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620). - CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825). - CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816). - CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765). - CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748). - CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798). - CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674). - CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072). - CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178). - CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057). - CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319). - CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796). - CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581). - CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133). - CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578). - CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137). - CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573). - CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143). - CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568). - CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563). - CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744). - CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067). - CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045). - CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145). - CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015). - CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012). - CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007). - CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001). - CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930). - CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934). - CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998). - CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (bsc#1263996). - CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993). - CVE-2026-43053: xfs: factor out xfs_attr3_node_entry_remove (bsc#1264084). - CVE-2026-43057: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (bsc#1264056). - CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263). - CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236). - CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241). - CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266). - CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230). - CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286). - CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261). - CVE-2026-43090: xfrm: fix refc
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers several security fixes in the Linux kernel packages distributed by Red Hat, including a critical privilege escalation and information disclosure vulnerability on Arm processors (CVE-2025-10263). Other fixed issues include out-of-bounds reads in SMB client code (CVE-2026-43112), use-after-free in network code (CVE-2026-46323), and multiple other memory safety and logic errors across kernel subsystems. The vulnerabilities have been assigned CVEs and have CVSS scores up to 9.1, indicating critical impact. Red Hat has released updated kernel packages for multiple architectures and product variants, including Red Hat Enterprise Linux versions 8.4, 8.6, 9, and 10, along with their Extended Update Support and Long Life Cycle variants. The vendor advisory confirms that these updates must be applied and systems rebooted to mitigate the issues.
Potential Impact
Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges or disclose sensitive information on affected systems. The CVSS 3.1 base score of 9.1 for CVE-2025-10263 indicates critical impact with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Other vulnerabilities fixed include memory corruption and out-of-bounds read/write issues that could lead to system instability or further exploitation. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released official kernel updates addressing these vulnerabilities. Users should apply the relevant security updates for their Red Hat Enterprise Linux versions as detailed in the vendor advisories (e.g., RHSA-2026:47248 and RHSA-2026:34911) and reboot the systems to activate the fixes. Delaying updates may leave systems exposed. No alternative mitigations are specified by the vendor; patching is the recommended and effective remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- SUSE Product Security Team
- Advisory Id
- SUSE-SU-2026:2450-1
- Cve Count
- 84
- Additional Cves
- ["CVE-2025-40253","CVE-2025-68324","CVE-2025-68822","CVE-2026-23271","CVE-2026-23279","CVE-2026-23303","CVE-2026-23367","CVE-2026-23396","CVE-2026-23444","CVE-2026-23448","CVE-2026-31405","CVE-2026-31415","CVE-2026-31421","CVE-2026-31447","CVE-2026-31452","CVE-2026-31464","CVE-2026-31469","CVE-2026-31498","CVE-2026-3150","CVE-2026-31500","CVE-2026-31515","CVE-2026-31516","CVE-2026-31532","CVE-2026-31540","CVE-2026-31546","CVE-2026-31588","CVE-2026-31590","CVE-2026-31596","CVE-2026-31629","CVE-2026-31664","CVE-2026-31668","CVE-2026-31671","CVE-2026-31673","CVE-2026-31674","CVE-2026-31678","CVE-2026-31759","CVE-2026-31778","CVE-2026-43020","CVE-2026-43024","CVE-2026-43026","CVE-2026-43028","CVE-2026-43037","CVE-2026-43038","CVE-2026-43040","CVE-2026-43052","CVE-2026-43077","CVE-2026-43140","CVE-2026-43158","CVE-2026-43187","CVE-2026-43198","CVE-2026-43206","CVE-2026-43234","CVE-2026-43338","CVE-2026-43339","CVE-2026-43359","CVE-2026-43361","CVE-2026-43407","CVE-2026-43413","CVE-2026-43414","CVE-2026-43499","CVE-2026-43503","CVE-2026-45835","CVE-2026-45841","CVE-2026-45842","CVE-2026-45843","CVE-2026-45852","CVE-2026-45870","CVE-2026-45970","CVE-2026-45983","CVE-2026-46021","CVE-2026-46024","CVE-2026-46043","CVE-2026-46090","CVE-2026-46113","CVE-2026-46116","CVE-2026-46150","CVE-2026-46157","CVE-2026-46159","CVE-2026-46160","CVE-2026-46169","CVE-2026-46181","CVE-2026-46259","CVE-2026-46273"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a35935af198dc38c1067823
Added to database: 06/19/2026, 19:07:06 UTC
Last enriched: 08/17/2026, 21:46:00 UTC
Last updated: 09/17/2026, 22:01:28 UTC
Views: 177
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.