Security update for the Linux Kernel (Live Patch 16 for SUSE Linux Enterprise 15 SP6)

Security update for the Linux Kernel (Live Patch 5 for SUSE Linux Enterprise 15 SP7)

Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise 15 SP7)

Security update for the Linux Kernel RT (Live Patch 3 for SUSE Linux Enterprise 15 SP7)

Security update for the Linux Kernel (Live Patch 28 for SUSE Linux Enterprise 15 SP5)

Security update for the Linux Kernel (Live Patch 32 for SUSE Linux Enterprise 15 SP5)

Security update for the Linux Kernel (Live Patch 13 for SUSE Linux Enterprise 15 SP6)

Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise 15 SP6)

Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 15 SP6)

Security update for the Linux Kernel (Live Patch 26 for SUSE Linux Enterprise 15 SP5)

Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 15 SP7)

Security update for the Linux Kernel (Live Patch 2 for SUSE Linux Enterprise 15 SP7)

Security update for the Linux Kernel RT (Live Patch 0 for SUSE Linux Enterprise 15 SP7)

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow paging if the guest page tables are modified between VM entries (similar to commit aad885e77496, "KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE", 2026-03-27). The flow is as follows: - a PDE is installed for a 2MB mapping, and a page in that area is accessed. KVM creates a kvm_mmu_page consisting of 512 4KB pages; the kvm_mmu_page is marked by FNAME(fetch) as direct-mapped because the guest's mapping is a huge page (and thus contiguous). - the PDE mapping is changed from outside the guest. - the guest accesses another page in the same 2MB area. KVM installs a new leaf SPTE and rmap entry; the SPTE uses the "correct" GFN (i.e. based on the new mapping, as changed in the previous step) ...

Security update for the Linux Kernel (Live Patch 17 for SUSE Linux Enterprise 15 SP7)

Security update for the Linux Kernel

Security update for the Linux Kernel

Security update for the Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap ...

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap ...