Threats Tagged 'cve-2026-53381'

SUSE Linux Enterprise 15 SP5 kernel received a security update addressing multiple vulnerabilities across various kernel components including networking, bonding, team, cpuidle, bpf, netfilter, sctp, futex, dm log, locking, virtiofs, tipc, keys, apparmor, scsi target, ipv6, tunnels, netfilter synproxy, nfc, security keys, net tls, drm, af_unix, vsock, RDMA, crypto, bpf devmap, ipv4 igmp, ALSA, KVM, rhashtable, fib, gtp, xfrm, btrfs, pppoe, ceph, and others. These fixes resolve issues such as memory leaks, infinite loops, type confusion, use-after-free, out-of-bounds reads/writes, race conditions, and other kernel-level bugs. The update is classified as high severity due to the breadth and nature of the vulnerabilities fixed. No CVSS score is provided. No specific affected versions are explicitly stated in the input data.

These are all security issues fixed in the kernel-devel-7.1.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-7.1.4-1.1 package on the GA media of openSUSE Tumbleweed.

In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput() called from fuse_release_end() can Oops if the super block has already been destroyed. Normally this is prevented by waiting for num_waiting to go down to zero before commencing with super block shutdown. This only works, however, for the last submount instance, as the wait counter is per connection, not per superblock. Revert to using synchronous release requests for the auto_submounts case, which is virtiofs only at this time.

In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput() called from fuse_release_end() can Oops if the super block has already been destroyed. Normally this is prevented by waiting for num_waiting to go down to zero before commencing with super block shutdown. This only works, however, for the last submount instance, as the wait counter is per connection, not per superblock. Revert to using synchronous release requests for the auto_submounts case, which is virtiofs only at this time.

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.