SUSE-SU-2026:0263-1

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlbhandleuserfault (bsc#1254785).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2023-53254: cacheinfo: Fix sharedcpumap to handle shared caches at different levels (bsc#1249871).
• CVE-2023-53781: smc: Fix use-after-free in tcpwritetimer_handler() (bsc#1254751).
• CVE-2024-56590: Bluetooth: hcicore: Fix not checking skb length on hciacldata_packet (bsc#1235038).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
• CVE-2025-40139: net: ipv4: Consolidate ipv4mtu and ipdstmtumaybe_forward (bsc#1253409).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40258: mptcp: fix race condition in mptcpschedulework() (bsc#1254843).
• CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
• CVE-2025-40280: tipc: Fix use-after-free in tipcmonreinit_self() (bsc#1254847).
• CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
• CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).

The following non security issues were fixed:

• ACPI/IORT: Fix memory leak in iortrmralloc_sids() (git-fixes).
• ACPI: PRM: Remove unnecessary strict handler address checks (git-fixes).
• ACPI: property: Do not pass NULL handles to acpiattachdata() (git-fixes).
• ACPI: property: Fix buffer properties extraction for subnodes (git-fixes).
• KVM: SVM: Fix TSC_AUX virtualization setup (git-fixes).
• RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes).
• RDMA/counter: Check CAPNETRAW check in user namespace for RDMA counters (git-fixes).
• RDMA/hns: Fix the modification of maxsendsge (git-fixes).
• RDMA/mlx5: Check CAPNETRAW in user namespace for anchor create (git-fixes).
• RDMA/mlx5: Check CAPNETRAW in user namespace for devx create (git-fixes).
• RDMA/mlx5: Check CAPNETRAW in user namespace for flow create (git-fixes).
• RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes).
• RDMA/nldev: Check CAPNETRAW in user namespace for QP modify (git-fixes).
• RDMA/uverbs: Add empty rdmauattrshasrawcap() declaration (git-fixes).
• RDMA/uverbs: Check CAPNETRAW in user namespace for QP create (git-fixes).
• RDMA/uverbs: Check CAPNETRAW in user namespace for RAW QP create (git-fixes).
• RDMA/uverbs: Check CAPNETRAW in user namespace for flow create (git-fixes).
• arch/idle: Change archcpuidle() behavior: always exit with IRQs disabled (git-fixes).
• cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls (git-fixes).
• cpuidle: Move IRQ state validation (git-fixes).
• cpuidle: haltpoll: Do not enable interrupts when entering idle (git-fixes).
• dm: free table mempools if not used in __bind (git-fixes).
• padata: Honor the caller's alignment in case of chunk_size 0 (bsc#1237563).
• platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (git-fixes).
• x86/bugs: Fix RSB clearing in indirectbranchprediction_barrier() (git-fixes).
• x86/bugs: Use SBPB in write_ibpb() if applicable (git-fixes).
• x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (git-fixes).
• x86/tdx: Drop flags from _tdxhypercall() (git-fixes).
• x86/tdx: Dynamically disable SEPT violations from causing #VEs (git-fixes).
• x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (git-fixes).
• x86/tdx: Extend TDXMODULECALL to support more TDCALL/SEAMCALL leafs (git-fixes).
• x86/tdx: Fix _noreturn build warning around _tdxhypercallfailed() (git-fixes).
• x86/tdx: Fix archsafehalt() execution for TDX VMs (git-fixes).
• x86/tdx: Introduce wrappers to read and write TD metadata (git-fixes).
• x86/tdx: Make TDXHYPERCALL asm similar to TDXMODULE_CALL (git-fixes).
• x86/tdx: Make macros of TDCALLs consistent with the spec (git-fixes).
• x86/tdx: Pass TDCALL/SEAMCALL input/output registers via a structure (git-fixes).
• x86/tdx: Reimplement _tdxhypercall() using TDXMODULECALL asm (git-fixes).
• x86/tdx: Remove 'struct tdxhypercallargs' (git-fixes).
• x86/tdx: Remove TDXHCALLISSUE_STI (git-fixes).
• x86/tdx: Rename _tdxmodulecall() to _tdcall() (git-fixes).
• x86/tdx: Rename tdxparsetdinfo() to tdx_setup() (git-fixes).
• x86/tdx: Retry partially-completed page conversion hypercalls (git-fixes).
• x86/tdx: Skip saving output regs when SEAMCALL fails with VMFailInvalid (git-fixes).
• x86/tdx: Zero out the missing RSI in TDX_HYPERCALL macro (git-fixes).
• x86/virt/tdx: Make TDXMODULECALL handle SEAMCALL #UD and #GP (git-fixes).
• x86/virt/tdx: Wire up basic SEAMCALL functions (git-fixes).
• xfs: fix sparse inode limits on runt AG (bsc#1254392).