SUSE-SU-2026:0961-1

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53794: cifs: fix session state check in reconnect to avoid use-after-free issue (bsc#1255163).
• CVE-2023-53827: Bluetooth: L2CAP: Fix use-after-free in l2capdisconnect{req,rsp} (bsc#1255049).
• CVE-2025-21738: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (bsc#1238917).
• CVE-2025-38224: can: kvaserpciefd: refine error prone echoskb_max handling logic (bsc#1246166).
• CVE-2025-38375: virtio-net: ensure the received length does not exceed allocated size (bsc#1247177).
• CVE-2025-68285: libceph: fix potential use-after-free in havemonandosdmap() (bsc#1255401).
• CVE-2025-71066: net/sched: ets: Always remove class from active list before deleting in etsqdiscchange (bsc#1256645).
• CVE-2026-23004: dst: fix races in rt6uncachedlistdel() and rtdeluncachedlist() (bsc#1257231).
• CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in sndusbmixer_free() (bsc#1257790).
• CVE-2026-23191: ALSA: aloop: Fix racy access at PCM trigger (bsc#1258395).
• CVE-2026-23204: net/sched: clsu32: use skbheaderpointercareful() (bsc#1258340).
• CVE-2026-23268: apparmor: fix unprivileged local user can do privileged policy management
• CVE-2026-23269: apparmor: validate DFA start states are in bounds in unpack_pdb

The following non-security bugs were fixed:

• Disable CONFIGNETSCH_ATM (jsc#PED-12836).
• apparmor: Fix double free of nsname in aareplace_profiles() (bsc#1258849).
• apparmor: fix differential encoding verification (bsc#1258849).
• apparmor: fix memory leak in verify_header (bsc#1258849).
• apparmor: fix missing bounds check on DEFAULT table in verify_dfa() (bsc#1258849).
• apparmor: fix side-effect bug in match_char() macro usage (bsc#1258849).
• apparmor: fix unprivileged local user can do privileged policy management (bsc#1258849).
• apparmor: fix: limit the number of levels of policy namespaces (bsc#1258849).
• apparmor: replace recursive profile removal with iterative approach (bsc#1258849).
• apparmor: validate DFA start states are in bounds in unpack_pdb (bsc#1258849).