CVE-2022-29581

Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions.

The Linux Kernel, the operating system core itself.

Security Fix(es):

Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.(CVE-2022-0002)

In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.(CVE-2022-29582)

A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device is detached and reclaim resources early.(CVE-2022-1195)

In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel(CVE-2022-20008)

Due to the small table perturb size, a memory leak flaw was found in the Linux kernel’s TCP source port generation algorithm in the net/ipv4/tcp.c function. This flaw allows an attacker to leak information and may cause a denial of service.(CVE-2022-1012)

A flaw was found in the Linux kernel’s nfcmrvl_nci_unregister_dev() function. A race condition leads to a use-after-free issue when simulating the NFC device from the user space.(CVE-2022-1734)

Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions.(CVE-2022-29581)

A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user terminates their session using a simulated Ethernet card and continued usage of this connection. This flaw allows a local user to crash the system.(CVE-2022-1516)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

• Race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)

• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

• Memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)

• smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)

• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

• Uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

• Race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

• use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)

• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)

• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

• buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

• use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)

• net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

• Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

• Memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)

• Double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

• Use after free in SUNRPC subsystem (CVE-2022-28893)

• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

• race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)

• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

• memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)

• smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)

• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

• uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

• race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

• use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)

• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)

• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

• buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

• use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)

• net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

• Spectre-BHB (CVE-2022-23960)

• Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

• memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)

• double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

• use after free in SUNRPC subsystem (CVE-2022-28893)

• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
• Race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)
• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
• Memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)
• smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)
• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
• Uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
• Race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
• use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)
• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
• buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)
• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
• use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)
• net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
• Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
• Memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)
• Double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
• Use after free in SUNRPC subsystem (CVE-2022-28893)
• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
• race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)
• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
• memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)
• smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)
• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
• uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
• race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
• use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)
• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
• buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)
• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
• use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)
• net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
• Spectre-BHB (CVE-2022-23960)
• Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
• memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)
• double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
• use after free in SUNRPC subsystem (CVE-2022-28893)
• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
• smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)
• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
• uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
• race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
• concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)
• kernel info leak issue in pfkey_register (CVE-2022-1353)
• use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)
• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
• fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998)
• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
• slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
• incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123)
• incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)
• incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166)
• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
• AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)
• AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)
• Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
• double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
• use after free in SUNRPC subsystem (CVE-2022-28893)
• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
• Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)
• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
• nf_tables disallow binding to already bound chain (CVE-2022-39190)
• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
• smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)
• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
• uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
• race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
• concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)
• kernel info leak issue in pfkey_register (CVE-2022-1353)
• use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)
• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
• fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998)
• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
• integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
• slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
• incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123)
• incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)
• incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166)
• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
• AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)
• AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)
• Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
• double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
• use after free in SUNRPC subsystem (CVE-2022-28893)
• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
• Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)
• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
• nf_tables disallow binding to already bound chain (CVE-2022-39190)
• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• cgroup: Use open-time cgroup namespace for process migration perm checks {CVE-2021-4197}
• cgroup: Use open-time credentials for process migraton perm checks {CVE-2021-4197}
• cgroup: cgroup.{procs,threads} factor out common parts
• cgroup: unify attach permission checking
• vt: drop old FONT ioctls {CVE-2021-33656}
• fbmem: Check virtual screen sizes in fb_set_var() {CVE-2021-33655}
• fbcon: Prevent that screen size is smaller than font size {CVE-2021-33655}
• fbcon: Disallow setting font bigger than screen size {CVE-2021-33655}
• KVM: nVMX: add missing consistency checks for CR0 and CR4 {CVE-2023-30456}
• net: usb: ax88179_178a: Fix packet receiving {CVE-2022-2964}
• net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup {CVE-2022-2964}
• net: usb: ax88179_178a: fix packet alignment padding {CVE-2022-2964}
• ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32
• KVM: x86/mmu: do compare-and-exchange of gPTE via the user address {CVE-2022-1158}
• RDMA/cma: Do not change route.addr.src_addr.ss_family {CVE-2021-4028}
• RDMA/cma: Make the locking for automatic state transition more clear
• ath10k: Validate first subframe of A-MSDU before processing the list {CVE-2020-24588}
• ath10k: drop MPDU which has discard flag set by firmware for SDIO {CVE-2020-24588}
• mac80211: drop A-MSDUs on old ciphers {CVE-2020-24588}
• cfg80211: mitigate A-MSDU aggregation attacks {CVE-2020-24588}
• ipv4: make exception cache less predictible {CVE-2021-20322}
• ipv4: use siphash instead of Jenkins in fnhe_hashfun() {CVE-2021-20322}
• ipv6: make exception cache less predictible {CVE-2021-20322}
• ipv6: use siphash in rt6_exception_hash() {CVE-2021-20322}
• ipv6: use jhash2() in rt6_exception_hash()
• psi: Fix uaf issue when psi trigger is destroyed while being polled {CVE-2022-2938}
• psi: fix possible trigger missing in the window
• cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
• cgroup: make per-cgroup pressure stall tracking configurable
• netfilter: nf_tables_offload: incorrect flow offload action array size {CVE-2022-25636}
• netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create
• cgroup: fix psi monitor for root cgroup
• cgroup/cgroup.c: replace 'of->kn->priv' with of_cft()
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• devlink: Fix use-after-free after a failed reload {CVE-2022-3625}
• KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS {CVE-2022-2196}
• net/sched: tcindex: update imperfect hash filters respecting rcu {CVE-2023-1281}
• seq_buf: Fix overflow in seq_buf_putmem_hex() {CVE-2023-28772}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg {CVE-2023-31436}
• cgroup-v1: Require capabilities to set release_agent {CVE-2022-0492}
• net: sched: fix use-after-free in tc_new_tfilter() {CVE-2022-1055}
• SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() {CVE-2022-28893}
• net/sched: cls_u32: fix netns refcount changes in u32_change() {CVE-2022-29581}
• i2c: ismt: Fix an out-of-bounds bug in ismt_access() {CVE-2022-2873}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}

• cgroup: Use open-time cgroup namespace for process migration perm checks {CVE-2021-4197}
• cgroup: Use open-time credentials for process migraton perm checks {CVE-2021-4197}
• vt: drop old FONT ioctls {CVE-2021-33656}
• fbmem: Check virtual screen sizes in fb_set_var() {CVE-2021-33655}
• fbcon: Prevent that screen size is smaller than font size {CVE-2021-33655}
• fbcon: Disallow setting font bigger than screen size {CVE-2021-33655}
• KVM: nVMX: add missing consistency checks for CR0 and CR4 {CVE-2023-30456}
• net: usb: ax88179_178a: Fix packet receiving
• ipv4: make exception cache less predictible {CVE-2021-20322}
• ipv4: use siphash instead of Jenkins in fnhe_hashfun() {CVE-2021-20322}
• ipv6: make exception cache less predictible {CVE-2021-20322}
• ipv6: use siphash in rt6_exception_hash() {CVE-2021-20322}
• ipv6: use jhash2() in rt6_exception_hash()
• psi: Fix uaf issue when psi trigger is destroyed while being polled {CVE-2022-2938}
• psi: fix possible trigger missing in the window
• cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
• cgroup: make per-cgroup pressure stall tracking configurable
• netfilter: nf_tables_offload: incorrect flow offload action array size {CVE-2022-25636}
• netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• devlink: Fix use-after-free after a failed reload {CVE-2022-3625}
• KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS {CVE-2022-2196}
• net/sched: tcindex: update imperfect hash filters respecting rcu {CVE-2023-1281}
• seq_buf: Fix overflow in seq_buf_putmem_hex() {CVE-2023-28772}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg {CVE-2023-31436}
• cgroup-v1: Require capabilities to set release_agent {CVE-2022-0492}
• net: sched: fix use-after-free in tc_new_tfilter() {CVE-2022-1055}
• SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() {CVE-2022-28893}
• net/sched: cls_u32: fix netns refcount changes in u32_change() {CVE-2022-29581}
• i2c: ismt: Fix an out-of-bounds bug in ismt_access() {CVE-2022-2873}
• RDMA/cma: Do not change route.addr.src_addr.ss_family {CVE-2021-4028}
• net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup {CVE-2022-2964}
• KVM: x86/mmu: do compare-and-exchange of gPTE via the user address {CVE-2022-1158}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}

• xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• net/sched: cls_u32: fix netns refcount changes in u32_change() {CVE-2022-29581}
• net/packet: fix slab-out-of-bounds access in packet_recvmsg() {CVE-2022-20368}
• openvswitch: fix OOB access in reserve_sfa_size() {CVE-2022-2639}
• net: sched: fix use-after-free in tc_new_tfilter() {CVE-2022-1055}
• wifi: cfg80211: fix BSS refcounting bugs {CVE-2022-42720}
• wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() {CVE-2022-41674}
• igmp: Add ip_mc_list lock in ip_check_mc_rcu {CVE-2022-20141}
• af_key: Do not call xfrm_probe_algs in parallel {CVE-2022-3028}
• drm/amd/display: Check gpio_id before used as array index {CVE-2024-46818}
• drm/amd/display: Check link_index before accessing dc->links[] {CVE-2024-46813}
• Squashfs: sanity check symbolic link size {CVE-2024-46744}

It was discovered that a race condition existed in the network scheduling subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2021-39713)

Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges.(CVE-2022-0492)

It was discovered that the network traffic control implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2022-1055)

Bing-Jhong Billy Jheng discovered that the io_uring subsystem in the Linux kernel contained in integer overflow. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-1116)

It was discovered that the Linux kernel did not properly restrict access to the kernel debugger when booted in secure boot environments. A privileged attacker could use this to bypass UEFI Secure Boot restrictions.(CVE-2022-21499)

Kyle Zeng discovered that the Network Queuing and Scheduling subsystem of the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-29581)

Jann Horn discovered that the Linux kernel did not properly enforce seccomp restrictions in some situations. A local attacker could use this to bypass intended seccomp sandbox restrictions.(CVE-2022-30594)

Aaron Adams discovered that the netfilter subsystem in the Linux kernel did not properly handle the removal of stateful expressions in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-1966)

Ziming Zhang discovered that the netfilter subsystem in the Linux kernel did not properly validate sets with multiple ranged fields. A local attacker could use this to cause a denial of service or execute arbitrary code.(CVE-2022-1972)

It was discovered that the implementation of POSIX timers in the Linux kernel did not properly clean up timers in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-2585)

It was discovered that the netfilter subsystem of the Linux kernel did not prevent one nft object from referencing an nft set in another nft table, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-2586)

Zhenpeng Lin discovered that the network packet scheduler implementation in the Linux kernel did not properly remove all references to a route filter before freeing it in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-2588)

It was discovered that the Linux kernel did not properly restrict access to the kernel debugger when booted in secure boot environments. A privileged attacker could use this to bypass UEFI Secure Boot restrictions.(CVE-2022-21499)

Kyle Zeng discovered that the Network Queuing and Scheduling subsystem of the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-29581)

Arthur Mongodin discovered that the netfilter subsystem in the Linux kernel did not properly perform data validation. A local attacker could use this to escalate privileges in certain situations.(CVE-2022-34918)

This kernel update is based on upstream 5.15.41 and fixes at least the following security issues:

A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system. NOTE: Mageia kernels by default prevents unprivileged users from being able to use eBPF so this would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space (CVE-2022-0500).

Due to the small table perturb size, a memory leak flaw was found in the Linux kernel’s TCP source port generation algorithm in the net/ipv4/tcp.c function. This flaw allows an attacker to leak information and may cause a denial of service (CVE-2022-1012).

A flaw was found in the Linux kernel’s nfcmrvl_nci_unregister_dev() function. A race condition leads to a use-after-free issue when simulating the NFC device from the user space (CVE-2022-1734).

A flaw was found in the Linux kernel's adjust_ptr_min_max_vals in the kernel/bpf/verifier.c function. In this flaw, a missing sanity check for *_OR_NULL pointer types that perform pointer arithmetic may cause a kernel information leak issue. NOTE: Mageia kernels by default prevents unprivileged users from being able to use eBPF so this would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space (CVE-2022-23222).

The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state (CVE-2022-28893).

Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root (CVE-2022-29581).

Other fixes in this update:

• nfsd: Fix a write performance regression
• x86/mm: Include spinlock_t definition in pgtable.h

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.15.41 and fixes at least the following security issues:

A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system. NOTE: Mageia kernels by default prevents unprivileged users from being able to use eBPF so this would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space (CVE-2022-0500).

Due to the small table perturb size, a memory leak flaw was found in the Linux kernel’s TCP source port generation algorithm in the net/ipv4/tcp.c function. This flaw allows an attacker to leak information and may cause a denial of service (CVE-2022-1012).

A flaw was found in the Linux kernel’s nfcmrvl_nci_unregister_dev() function. A race condition leads to a use-after-free issue when simulating the NFC device from the user space (CVE-2022-1734).

A flaw was found in the Linux kernel's adjust_ptr_min_max_vals in the kernel/bpf/verifier.c function. In this flaw, a missing sanity check for *_OR_NULL pointer types that perform pointer arithmetic may cause a kernel information leak issue. NOTE: Mageia kernels by default prevents unprivileged users from being able to use eBPF so this would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space (CVE-2022-23222).

The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state (CVE-2022-28893).

Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root (CVE-2022-29581).

For other upstream fixes, see the referenced changelogs.

In u32_destroy_key and related functions of cls_u32.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue (bnc#1200015, bnc#1200494).

The following non-security bugs were fixed:

• 9p: Fix refcounting during full path walks for fid lookups (git-fixes).
• 9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl (git-fixes).
• 9p: fix fid refcount leak in v9fs_vfs_get_link (git-fixes).
• ACPI: CPPC: Only probe for _CPC if CPPC v2 is acked (git-fixes).
• ACPI: video: Fix acpi_video_handles_brightness_key_presses() (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo L140PU (git-fixes).
• ALSA: hda/realtek: Fix headset mic for Acer SF313-51 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP machines (git-fixes).
• ALSA: usb-audio: Add quirk for Fiero SC-01 (fw v1.0.0) (git-fixes).
• ALSA: usb-audio: Add quirk for Fiero SC-01 (git-fixes).
• ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices (git-fixes).
• ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD (git-fixes).
• ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle (git-fixes).
• ARM: 9210/1: Mark the FDT_FIXED sections as shareable (git-fixes).
• ARM: 9213/1: Print message about disabled Spectre workarounds only once (git-fixes).
• ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction (git-fixes).
• ARM: 9216/1: Fix MAX_DMA_ADDRESS overflow (git-fixes).
• ARM: dts: at91: sama5d2: Fix typo in i2s1 node (git-fixes).
• ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count (git-fixes).
• ARM: dts: stm32: use the correct clock source for CEC on stm32mp151 (git-fixes).
• ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Intel: bytcr_wm5102: Fix GPIO related probe-ordering problem (git-fixes).
• ASoC: Intel: sof_sdw: handle errors on card registration (git-fixes).
• ASoC: Realtek/Maxim SoundWire codecs: disable pm_runtime on remove (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: SOF: Intel: hda-loader: Clarify the cl_dsp_init() flow (git-fixes).
• ASoC: codecs: rt700/rt711/rt711-sdca: initialize workqueues in probe (git-fixes).
• ASoC: codecs: rt700/rt711/rt711-sdca: resume bus/codec in .set_jack_detect (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: dapm: Initialise kcontrol data for mux/demux controls (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: rt5682: Avoid the unexpected IRQ event during going to suspend (git-fixes).
• ASoC: rt5682: Fix deadlock on resume (git-fixes).
• ASoC: rt5682: Re-detect the combo jack after resuming (git-fixes).
• ASoC: rt5682: fix an incorrect NULL check…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-36946: Fixed an incorrect packet trucation operation which could lead to denial of service (bnc#1201940).
• CVE-2022-29581: Fixed improper update of reference count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-20166: Fixed several possible memory safety issues due to unsafe operations (bsc#1200598).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of TTYs that could lead to a use-after-free (bnc#1201429).
• CVE-2021-33655: Fixed an out of bounds write by ioctl cmd FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed an out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2022-21505: Fixed a kernel lockdown bypass via IMA policy (bsc#1201458).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TTY subsystem (bnc#1198829).
• CVE-2022-1116: Fixed an integer overflow vulnerability in io_uring which allowed a local attacker to escalate privileges to root (bnc#1199647).- CVE-2022-2318: Fixed a use-after-free vulnerability in the timer handler in Rose subsystem that allowed unprivileged attackers to crash the system (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• Fixed a system crash related to the recent RETBLEED mitigation (bsc#1201644, bsc#1201664, bsc#1201672, bsc#1201673, bsc#1201676).
• qla2xxx: drop patch which prevented nvme port discovery (bsc#1200651 bsc#1200644 bsc#1201954 bsc#1201958).
• kvm: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930).
• bpf, cpumap: Remove rcpu pointer from cpu_map_build_skb signature (bsc#1199364).
• bpf: enable BPF type format (BTF) (jsc#SLE-24559).
• nfs: avoid NULL pointer dereference when there is unflushed data (bsc#1201196).
• hv_netvsc: Add (more) validation for untrusted Hyper-V values (bsc#1199364).
• hv_netvsc: Add comment of netvsc_xdp_xmit() (bsc#1199364).
• hv_netvsc: Add support for XDP_REDIRECT (bsc#1199364).
• hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer (bsc#1199364).
• hv_netvsc: Fix validation in netvsc_linkstatus_callback() (bsc#1199364).
• kvm/emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).
• lkdtm: Disable return thunks in rodata.c (bsc#1178134).
• net, xdp: Introduce __xdp_build_skb_from_frame utility routine (bsc#1199364).
• net, xdp: Introduce xdp_build_skb_from_frame utility routine (bsc#1199364).
• nvme: consider also host_iface when checking ip options (bsc#1199670).
• powerpc/mobility: wait for memory transfer to complete (bsc#1201846 ltc#198761).
• powerpc/pseries/mobility: set NMI watchdog factor during an LPM (bsc#1201846 ltc#198761).
• powerpc/watchdog: introduce a NMI watchdog's factor (bsc#1201846 ltc#198761).
• scsi: lpfc: Copyright updates for 14.2.0.5 patches (bsc#1201956).
• scsi: lpfc: Fix attempted FA-PWWN usage after feature disable (bsc#1201956).
• scsi: lpfc: Fix lost NVMe paths during LIF bounce stress test (bsc#1201956 bsc#1200521).
• scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE (bsc#1201956).
• scsi: lpfc: Fix uninitialized cqe field in lpfc_nvme_cancel_iocb() (bsc#1201956).
• scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input (bsc#1201956).
• scsi: lpfc: Refactor lpfc_nvmet_prep_abort_wqe() into lpfc_sli_prep_abort_xri() (bsc#1201956).
• scsi: lpfc: Remove Menlo/Hornet related code (bsc#1201956).
• scsi: lpfc: Remove extra atomic_inc on cmd_pending in queuecommand after VMID (bsc#1201956).
• scsi: lpfc: Revert RSCN_MEMENTO workaround for…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-2585: Fixed use-after-free in POSIX CPU timer (bnc#1202094).
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2022-26373: Fixed CPU info leak via post-barrier RSB predictions (bsc#1201726).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).

The following non-security bugs were fixed:

• ACPI: CPPC: Only probe for _CPC if CPPC v2 is acked (git-fixes).
• ACPI: video: Fix acpi_video_handles_brightness_key_presses() (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo L140PU (git-fixes).
• ALSA: hda/realtek: Fix headset mic for Acer SF313-51 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP machines (git-fixes).
• ALSA: usb-audio: Add quirk for Fiero SC-01 (fw v1.0.0) (git-fixes).
• ALSA: usb-audio: Add quirk for Fiero SC-01 (git-fixes).
• ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices (git-fixes).
• ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD (git-fixes).
• ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle (git-fixes).
• ARM: 9210/1: Mark the FDT_FIXED sections as shareable (git-fixes).
• ARM: 9213/1: Print message about disabled Spectre workarounds only once (git-fixes).
• ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction (git-fixes).
• ARM: dts: at91: sama5d2: Fix typo in i2s1 node (git-fixes).
• ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count (git-fixes).
• ARM: dts: stm32: use the correct clock source for CEC on stm32mp151 (git-fixes).
• ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Intel: bytcr_wm5102: Fix GPIO related probe-ordering problem (git-fixes).
• ASoC: Intel: sof_sdw: handle errors on card registration (git-fixes).
• ASoC: Realtek/Maxim SoundWire codecs: disable pm_runtime on remove (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: SOF: Intel: hda-loader: Clarify the cl_dsp_init() flow (git-fixes).
• ASoC: codecs: rt700/rt711/rt711-sdca: initialize workqueues in probe (git-fixes).
• ASoC: codecs: rt700/rt711/rt711-sdca: resume bus/codec in .set_jack_detect (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: dapm: Initialise kcontrol data for mux/demux controls (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: rt5682: Avoid the unexpected IRQ event during going to suspend (git-fixes).
• ASoC: rt5682: Fix deadlock on resume (git-fixes).
• ASoC: rt5682: Re-detect the combo jack after resuming (git-fixes).
• ASoC: rt5682: fix an incorrect NULL check on list iterator (git-fixes).
• ASoC: rt5682: move clk related code to rt5682_i2c_probe (git-fixes).
• ASoC: rt7*-sdw: harden jack_detect_handler (git-fixes).
• ASoC: rt711-sdca-sdw: fix calibrate mutex initialization (git-fixes).
• ASoC: rt711-sdca: Add endianness flag in snd_soc_component_driver (git-fixes).
• ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error (git-fixes).…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36516: Fixed TCP session data injection vulnerability via the mixed IPID assignment method (bnc#1196616).
• CVE-2020-36557: Fixed race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys that could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed race condition involving VT_RESIZEX that could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed out of bounds write with ioctl PIO_FONT (bnc#1201636).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size() (bsc#1202154).
• CVE-2022-20166: Fixed possible out of bounds write due to sprintf unsafety that could cause local escalation of privilege (bnc#1200598)
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-32250: Fixed user-after-free in net/netfilter/nf_tables_api.c that could allow local privilege escalation (bnc#1200015).
• CVE-2022-36946: Fixed incorrect packet truncation in nfqnl_mangle() that could lead to remote DoS (bnc#1201940).

The following non-security bugs were fixed:

• ACPI: APEI: Better fix to avoid spamming the console with old error logs (git-fixes).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• ACPI: video: Shortening quirk list by identifying Clevo by board_name only (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: sgtl5000: Fix noise on shutdown/remove (git-fixes).
• ASoC: wm5110: Fix DRE control (git-fixes).
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (git-fixes).
• Bluetooth: hci_intel: Add check for platform_driver_register (git-fixes).
• FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR (git-fixes).
• FDDI: defxx: Make MMIO the configuration default except for EISA (git-fixes).
• Fixed a system crash related to the recent RETBLEED mitigation (bsc#1201644, bsc#1201664, bsc#1201672, bsc#1201673, bsc#1201676).
• Fixed battery detection problem on macbooks (bnc#1201206).
• HID: cp2112: prevent a buffer overflow in cp2112_xfer() (git-fixes).
• KVM/emulate: Fix SETcc emulation function offsets…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36516: Fixed TCP session data injection vulnerability via the mixed IPID assignment method (bnc#1196616).
• CVE-2020-36557: Fixed race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys that could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed race condition involving VT_RESIZEX that could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed out of bounds write with ioctl PIO_FONT (bnc#1201636).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size() (bsc#1202154).
• CVE-2022-20166: Fixed possible out of bounds write due to sprintf unsafety that could cause local escalation of privilege (bnc#1200598)
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-32250: Fixed user-after-free in net/netfilter/nf_tables_api.c that could allow local privilege escalation (bnc#1200015).
• CVE-2022-36946: Fixed incorrect packet truncation in nfqnl_mangle() that could lead to remote DoS (bnc#1201940).

The following non-security bugs were fixed:

• ACPI: APEI: Better fix to avoid spamming the console with old error logs (git-fixes).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• ACPI: video: Shortening quirk list by identifying Clevo by board_name only (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: sgtl5000: Fix noise on shutdown/remove (git-fixes).
• ASoC: wm5110: Fix DRE control (git-fixes).
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (git-fixes).
• Bluetooth: hci_intel: Add check for platform_driver_register (git-fixes).
• FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR (git-fixes).
• FDDI: defxx: Make MMIO the configuration default except for EISA (git-fixes).
• Fixed a system crash related to the recent RETBLEED mitigation (bsc#1201644, bsc#1201664, bsc#1201672, bsc#1201673, bsc#1201676).
• Fixed battery detection problem on macbooks (bnc#1201206).
• HID: cp2112: prevent a buffer overflow in cp2112_xfer() (git-fixes).
• KVM/emulate: Fix SETcc emulation function offsets…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size() (bsc#1202154).
• CVE-2020-36516: Fixed TCP session data injection vulnerability via the mixed IPID assignment method (bnc#1196616).
• CVE-2022-36946: Fixed an incorrect packet trucation operation which could lead to denial of service (bnc#1201940).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-20166: Fixed several possible memory safety issues due to unsafe operations (bsc#1200598).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of TTYs could lead to a use-after-free (bnc#1201429).
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TTY subsystem (bnc#1198829).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-2318: Fixed a use-after-free vulnerability in the timer handler in Rose subsystem that allowed unprivileged attackers to crash the system (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• Fix bsc#1201644, bsc#1201664, bsc#1201672, bsc#1201673, bsc#1201676 All are reports of the same problem - the IBRS_* regs push/popping was wrong but it needs 1b331eeea7b8 ('x86/entry: Remove skip_r11rcx') too.
• ACPI: APEI: Better fix to avoid spamming the console with old error logs (git-fixes).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• ACPI: video: Shortening quirk list by identifying Clevo by board_name only (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: sgtl5000: Fix noise on shutdown/remove (git-fixes).
• ASoC: wm5110: Fix DRE control (git-fixes).
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (git-fixes).
• Bluetooth: hci_intel: Add check for platform_driver_register (git-fixes).
• Fixed a regression where smart batteries would not be detected on Mac (bsc#1201206).
• Fixed an issue where qla2xxx would prevent nvme port discovery (bsc#1200651 bsc#1200644 bsc#1201954 bsc#1201958).
• FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR (git-fixes).
• FDDI: defxx: Make MMIO the configuration default except for EISA (git-fixes).
• Fix 1201644, 1201664, 1201672, 1201673, 1201676 All are reports of the…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size() (bsc#1202154).
• CVE-2020-36516: Fixed TCP session data injection vulnerability via the mixed IPID assignment method (bnc#1196616).
• CVE-2022-36946: Fixed an incorrect packet trucation operation which could lead to denial of service (bnc#1201940).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-20166: Fixed several possible memory safety issues due to unsafe operations (bsc#1200598).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of TTYs could lead to a use-after-free (bnc#1201429).
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TTY subsystem (bnc#1198829).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-2318: Fixed a use-after-free vulnerability in the timer handler in Rose subsystem that allowed unprivileged attackers to crash the system (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• Fix bsc#1201644, bsc#1201664, bsc#1201672, bsc#1201673, bsc#1201676 All are reports of the same problem - the IBRS_* regs push/popping was wrong but it needs 1b331eeea7b8 ('x86/entry: Remove skip_r11rcx') too.
• ACPI: APEI: Better fix to avoid spamming the console with old error logs (git-fixes).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• ACPI: video: Shortening quirk list by identifying Clevo by board_name only (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: sgtl5000: Fix noise on shutdown/remove (git-fixes).
• ASoC: wm5110: Fix DRE control (git-fixes).
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (git-fixes).
• Bluetooth: hci_intel: Add check for platform_driver_register (git-fixes).
• Fixed a regression where smart batteries would not be detected on Mac (bsc#1201206).
• Fixed an issue where qla2xxx would prevent nvme port discovery (bsc#1200651 bsc#1200644 bsc#1201954 bsc#1201958).
• FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR (git-fixes).
• FDDI: defxx: Make MMIO the configuration default except for EISA (git-fixes).
• Fix 1201644, 1201664, 1201672, 1201673, 1201676 All are reports of the…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size() (bsc#1202154).
• CVE-2020-36516: Fixed TCP session data injection vulnerability via the mixed IPID assignment method (bnc#1196616).
• CVE-2022-36946: Fixed an incorrect packet trucation operation which could lead to denial of service (bnc#1201940).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-20166: Fixed several possible memory safety issues due to unsafe operations (bsc#1200598).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of TTYs could lead to a use-after-free (bnc#1201429).
• CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TTY subsystem (bnc#1198829).

The following non-security bugs were fixed:

• Add missing recommends of kernel-install-tools to kernel-source-vanilla (bsc#1200442)
• Bluetooth: hci_qca: Use del_timer_sync() before freeing (git-fixes).
• Fixed an issue where qla2xxx would prevent nvme port discovery (bsc#1200651 bsc#1200644 bsc#1201954 bsc#1201958).
• Fix parsing of rpm/macros.kernel-source on SLE12 (bsc#1201019).
• KVM: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930).
• PCI: qcom: Fix runtime PM imbalance on probe errors (git-fixes).
• SUNRPC: Fix READ_PLUS crasher (git-fixes).
• arch_topology: Do not set llc_sibling if llc_id is invalid (git-fixes).
• blk-cgroup: synchronize blkg creation against policy deactivation (git-fixes).
• blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN (git-fixes).
• blk-zoned: allow zone management send operations without CAP_SYS_ADMIN (git-fixes).
• block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit (git-fixes).
• bnxt_en: Re-write PCI BARs after PCI fatal error (git-fixes).
• bnxt_en: Remove the setting of dev_port (git-fixes).
• crypto: qat - disable registration of algorithms (git-fixes).
• crypto: qat - fix memory leak in RSA (git-fixes).
• crypto: qat - remove dma_free_coherent() for DH (git-fixes).
• crypto: qat - remove dma_free_coherent() for RSA (git-fixes).
• crypto: qat - set to zero DH parameters before free (git-fixes).
• cxgb3/l2t: Fix undefined behaviour (git-fixes).
• dm btree remove: fix use after free in rebalance_children() (git-fixes).
• dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS (git-fixes).
• dm crypt: make printing of the key constant-time (git-fixes).
• dm integrity: fix error code in dm_integrity_ctr() (git-fixes).
• dm mirror log: round up region bitmap size to BITS_PER_LONG (git-fixes).
• dm raid: fix KASAN warning in raid5_add_disks (git-fixes).
• dm stats: add cond_resched when looping over entries (git-fixes).
• dm: fix mempool NULL pointer race when completing IO (git-fixes).
• do not call utsname() after ->nsproxy is NULL (bsc#1201196).
• ehea: fix error return code in ehea_restart_qps() (git-fixes).
• fsl_lpuart: Do not enable interrupts too early (git-fixes).
• hex2bin: fix access beyond string end (git-fixes).
• hex2bin: make the function hex_to_bin constant-time (git-fixes).
• irqchip/exiu: Fix acknowledgment of edge triggered interrupts (git-fixes).
• kernel-obs-build: include qemu_fw_cfg (boo#1201705)
• kvm/emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).
• latent_entropy: avoid build error when plugin cflags are not set (git-fixes).
• lib/hexdump.c: return -EINVAL in case of error in hex2bin() (git-fixes).
• linux/random.h: Mark…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2022-29581: Fixed improper update of reference count vulnerability in net/sched that allowed a local attacker to cause privilege escalation to root (bnc#1199665).
• CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module (bnc#1202154).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the machine (bnc#1202897).
• CVE-2022-20369: Fixed possible out of bounds write due to improper input validation in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).

The following non-security bugs were fixed:

• 9p: migrate from sync_inode to filemap_fdatawrite_wbc (bsc#1202528).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• Fix parsing of rpm/macros.kernel-source on SLE12 (bsc#1201019).
• Fix releasing of old bundles in xfrm_bundle_lookup() (bsc#1201264 bsc#1190397 bsc#1199617).
• KABI: cgroup: Restore KABI of css_set (bsc#1201610).
• KVM: PPC: Book3S HV: Context tracking exit guest context before enabling irqs (bsc#1065729).
• KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 (bsc#1201442)
• KVM: nVMX: Set UMIP bit CR4_FIXED1 MSR when emulating UMIP (bsc#1120716).
• KVM: x86: Mark TSS busy during LTR emulation after all fault checks (git-fixes).
• KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP (git-fixes).
• PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors (git-fixes).
• README, patch-tag-template, header.py: Abolish Novell and FATE (bsc#1189904).
• SUNRPC: Fix READ_PLUS crasher (git-fixes).
• SUNRPC: Fix the svc_deferred_event trace class (git-fixes).
• USB: new quirk for Dell Gen 2 devices (git-fixes).
• USB: serial: io_ti: add Agilent E5805A support (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• bs-upload-kernel: Workaround for vim syntax highlighting
• bs-upload-kernel: build klp_symbols when supported. cherry-picked from kbuild
• btrfs: Convert fs_info->free_chunk_space to atomic64_t (bsc#1202528).
• btrfs: add a trace class for dumping the current ENOSPC state (bsc#1202528).
• btrfs: add a trace point for reserve tickets (bsc#1202528).
• btrfs: adjust the flush trace point to include the source (bsc#1202528).
• btrfs: check reclaim_size in need_preemptive_reclaim (bsc#1202528).
• btrfs: check worker before need_preemptive_reclaim (bsc#1202528).
• btrfs: do not do preemptive flushing if the majority is global rsv (bsc#1202528).
• btrfs: do not include the global rsv size in the preemptive used amount (bsc#1202528).
• btrfs: enable a tracepoint when we fail tickets (bsc#1202528).
• btrfs: handle preemptive delalloc flushing slightly differently (bsc#1202528).
• btrfs: implement space clamping for preemptive flushing (bsc#1202528).
• btrfs: improve preemptive background space flushing (bsc#1202528).
• btrfs: include…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2022-29581: Fixed improper update of reference count vulnerability in net/sched that allowed a local attacker to cause privilege escalation to root (bnc#1199665).
• CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module (bnc#1202154).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the machine (bnc#1202897).
• CVE-2022-20369: Fixed possible out of bounds write due to improper input validation in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).

The following non-security bugs were fixed:

• 9p: migrate from sync_inode to filemap_fdatawrite_wbc (bsc#1202528).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• Fix releasing of old bundles in xfrm_bundle_lookup() (bsc#1201264 bsc#1190397 bsc#1199617).
• KABI: cgroup: Restore KABI of css_set (bsc#1201610).
• KVM: PPC: Book3S HV: Context tracking exit guest context before enabling irqs (bsc#1065729).
• KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 (bsc#1201442)
• KVM: nVMX: Set UMIP bit CR4_FIXED1 MSR when emulating UMIP (bsc#1120716).
• KVM: x86: Mark TSS busy during LTR emulation after all fault checks (git-fixes).
• KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP (git-fixes).
• PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors (git-fixes).
• Revert 'USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set' (git-fixes).
• Revert 'r8152: adjust the settings about MAC clock speed down for RTL8153' (git-fixes).
• SUNRPC: Fix READ_PLUS crasher (git-fixes).
• SUNRPC: Fix the svc_deferred_event trace class (git-fixes).
• USB: new quirk for Dell Gen 2 devices (git-fixes).
• USB: serial: io_ti: add Agilent E5805A support (git-fixes).
• add Kirk Allan as branch maintainer
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• btrfs: Convert fs_info->free_chunk_space to atomic64_t (bsc#1202528).
• btrfs: add a trace class for dumping the current ENOSPC state (bsc#1202528).
• btrfs: add a trace point for reserve tickets (bsc#1202528).
• btrfs: adjust the flush trace point to include the source (bsc#1202528).
• btrfs: check reclaim_size in need_preemptive_reclaim (bsc#1202528).
• btrfs: check worker before need_preemptive_reclaim (bsc#1202528).
• btrfs: do not do preemptive flushing if the majority is global rsv (bsc#1202528).
• btrfs: do not include the global rsv size in the preemptive used amount (bsc#1202528).
• btrfs: enable a tracepoint when we fail tickets (bsc#1202528).
• btrfs: handle preemptive delalloc flushing slightly differently (bsc#1202528).
• btrfs: implement space clamping for preemptive flushing (bsc#1202528).
• btrfs: improve preemptive background space flushing (bsc#1202528).
• btrfs: include delalloc related info in dump space info tracepoint…

This update for the Linux Kernel 4.12.14-122_98 fixes several issues.

The following security issues were fixed:

• CVE-2022-39188: Fixed a race condition between unmap_mapping_range() and munmap() on VM_PFNMAP mappings leads to stale TLB entry (bsc#1203116).
• CVE-2022-29581: Fixed an improper Update of Reference Count vulnerability in net/sched that causes privilege escalation to root (bsc#1199695).
• CVE-2022-1652: Fixed a use-after-free in bad_flp_intr (bsc#1200057).

This update for the Linux Kernel 4.12.14-150100_197_111 fixes several issues.

The following security issues were fixed:

• CVE-2022-39188: Fixed a race condition between unmap_mapping_range() and munmap() on VM_PFNMAP mappings leads to stale TLB entry (bsc#1203116).
• CVE-2022-29581: Fixed an improper Update of Reference Count vulnerability in net/sched that causes privilege escalation to root (bsc#1199695).
• CVE-2022-1652: Fixed a use-after-free in bad_flp_intr (bsc#1200057).

This update for the Linux Kernel 4.12.14-150100_197_120 fixes several issues.

The following security issues were fixed:

• CVE-2022-39188: Fixed a race condition between unmap_mapping_range() and munmap() on VM_PFNMAP mappings leads to stale TLB entry (bsc#1203116).
• CVE-2022-29581: Fixed an improper Update of Reference Count vulnerability in net/sched that causes privilege escalation to root (bsc#1199695).

This update for the Linux Kernel 5.3.18-150300_59_49 fixes several issues.

The following security issues were fixed:

• CVE-2022-39188: Fixed a race condition between unmap_mapping_range() and munmap() on VM_PFNMAP mappings leads to stale TLB entry (bsc#1203116).
• CVE-2022-29581: Fixed an improper Update of Reference Count vulnerability in net/sched that causes privilege escalation to root (bsc#1199695).
• CVE-2022-1652: Fixed a use-after-free in bad_flp_intr (bsc#1200057).

This update for the Linux Kernel 5.3.18-150300_59_76 fixes several issues.

The following security issues were fixed:

• CVE-2022-39188: Fixed a race condition between unmap_mapping_range() and munmap() on VM_PFNMAP mappings leads to stale TLB entry (bsc#1203116).
• CVE-2022-29581: Fixed an improper Update of Reference Count vulnerability in net/sched that causes privilege escalation to root (bsc#1199695).

This update for the Linux Kernel 5.14.21-150400_22 fixes several issues.

The following security issues were fixed:

• CVE-2022-29581: Fixed an improper Update of Reference Count vulnerability in net/sched that causes privilege escalation to root (bsc#1199695).
• CVE-2022-39188: Fixed a race condition between unmap_mapping_range() and munmap() on VM_PFNMAP mappings leads to stale TLB entry (bsc#1203116).
• CVE-2022-1652: Fixed a use-after-free in bad_flp_intr (bsc#1200057).

This update for the Linux Kernel 5.3.18-150300_59_87 fixes several issues.

The following security issues were fixed:

• CVE-2022-39188: Fixed a race condition between unmap_mapping_range() and munmap() on VM_PFNMAP mappings leads to stale TLB entry (bsc#1203116).
• CVE-2022-29581: Fixed an improper Update of Reference Count vulnerability in net/sched that causes privilege escalation to root (bsc#1199695).

This update for the Linux Kernel 5.3.18-59_34 fixes several issues.

The following security issues were fixed:

• CVE-2022-39188: Fixed a race condition between unmap_mapping_range() and munmap() on VM_PFNMAP mappings leads to stale TLB entry (bsc#1203116).
• CVE-2022-29581: Fixed an improper Update of Reference Count vulnerability in net/sched that causes privilege escalation to root (bsc#1199695).
• CVE-2022-1652: Fixed a use-after-free in bad_flp_intr (bsc#1200057).

The SUSE Linux Enterprise 15 SP1 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
• CVE-2022-1012: Fixed a memory leak problem that was found in the TCP source port generation algorithm in net/ipv4/tcp.c (bnc#1199482).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the machine (bnc#1202897).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module (bnc#1202154).
• CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be confused and incorrectly matches the message (bnc#1202097).
• CVE-2022-29581: Fixed improper update of reference count vulnerability in net/sched that allowed a local attacker to cause privilege escalation to root (bnc#1199665).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page while it still has stale TLB entries (bnc#1203107).

The following non-security bugs were fixed:

• rpm: Fix parsing of rpm/macros.kernel-source on SLE12 (bsc#1201019).
• cifs: fix error paths in cifs_tree_connect() (bsc#1177440).
• cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (bsc#1188944).
• cifs: report error instead of invalid when revalidating a dentry fails (bsc#1177440).
• cifs: skip trailing separators of prefix paths (bsc#1188944).
• kernel-obs-build: include qemu_fw_cfg (boo#1201705)
• lightnvm: Remove lightnvm implemenation (bsc#1191881 bsc#1201420 ZDI-CAN-17325).
• md/bitmap: do not set sb values if can't pass sanity check (bsc#1197158).
• mm/rmap.c: do not reuse anon_vma if we just want a copy (git-fixes, bsc#1203098).
• mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (git-fixes, bsc#1203098).
• net_sched: cls_route: disallow handle of 0 (bsc#1202393).
• net_sched: cls_route: disallow handle of 0 (bsc#1202393).
• objtool: Add --backtrace support (bsc#1202396).
• objtool: Add support for intra-function calls (bsc#1202396).
• objtool: Allow no-op CFI ops in alternatives (bsc#1202396).
• objtool: Convert insn type to enum (bsc#1202396).
• objtool: Do not use ignore flag for fake jumps (bsc#1202396).
• objtool: Fix !CFI insn_state propagation (bsc#1202396).
• objtool: Fix ORC vs alternatives (bsc#1202396).
• objtool: Fix sibling call detection (bsc#1202396).
• objtool: Make handle_insn_ops() unconditional (bsc#1202396).
• objtool: Remove INSN_STACK (bsc#1202396).
• objtool: Remove check preventing branches within alternative (bsc#1202396).
• objtool: Rename elf_open() to prevent conflict with libelf from elftoolchain (bsc#1202396).
• objtool: Rename struct cfi_state (bsc#1202396).
• objtool: Rework allocating stack_ops on decode (bsc#1202396).
• objtool: Rewrite alt->skip_orig (bsc#1202396).
• objtool: Set insn->func for alternatives (bsc#1202396).
• objtool: Support conditional…

This update for the Linux Kernel 5.14.21-150400_24_11 fixes several issues.

The following security issues were fixed:

• CVE-2022-29581: Fixed an improper Update of Reference Count vulnerability in net/sched that causes privilege escalation to root (bsc#1199695).
• CVE-2022-39188: Fixed a race condition between unmap_mapping_range() and munmap() on VM_PFNMAP mappings leads to stale TLB entry (bsc#1203116).

This update for the Linux Kernel 5.3.18-150300_59_71 fixes several issues.

The following security issues were fixed:

• CVE-2022-39188: Fixed a race condition between unmap_mapping_range() and munmap() on VM_PFNMAP mappings leads to stale TLB entry (bsc#1203116).
• CVE-2022-29581: Fixed an improper Update of Reference Count vulnerability in net/sched that causes privilege escalation to root (bsc#1199695).

This update for the Linux Kernel 5.3.18-150300_59_46 fixes several issues.

The following security issues were fixed:

• CVE-2022-39188: Fixed a race condition between unmap_mapping_range() and munmap() on VM_PFNMAP mappings leads to stale TLB entry (bsc#1203116).
• CVE-2022-29581: Fixed an improper Update of Reference Count vulnerability in net/sched that causes privilege escalation to root (bsc#1199695).
• CVE-2022-1652: Fixed a use-after-free in bad_flp_intr (bsc#1200057).

This update for the Linux Kernel 5.3.18-59_37 fixes several issues.

The following security issues were fixed:

• CVE-2022-39188: Fixed a race condition between unmap_mapping_range() and munmap() on VM_PFNMAP mappings leads to stale TLB entry (bsc#1203116).
• CVE-2022-29581: Fixed an improper Update of Reference Count vulnerability in net/sched that causes privilege escalation to root (bsc#1199695).
• CVE-2022-1652: Fixed a use-after-free in bad_flp_intr (bsc#1200057).

The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page while it still has stale TLB entries (bnc#1203107).
• CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be confused and incorrectly matches the message (bnc#1202097).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2020-27784: Fixed a vulnerability that was found in printer_ioctl() printer_ioctl() when accessing a deallocated instance (bnc#1202895).
• CVE-2021-4155: Fixed a data leak flaw that was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem (bnc#1194272).
• CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564, bsc#1202860).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-1012: Fixed a memory leak problem that was found in the TCP source port generation algorithm in net/ipv4/tcp.c (bnc#1199482).
• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).
• CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module (bnc#1202154).
• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).
• CVE-2022-32250: Fixed a privilege escalation issue in net/netfilter/nf_tables_api.c that allowed a local user to became root (bnc#1200015)
• CVE-2022-29581: Fixed improper update of reference count vulnerability in net/sched that allowed a local attacker to cause privilege escalation to root (bnc#1199665).
• CVE-2022-20166: Fixed possible out of bounds write due to a heap buffer overflow in various methods of kernel base drivers (bnc#1200598).

The following non-security bugs were fixed:

• cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (bsc#1188944).
• cifs: skip trailing separators of prefix paths (bsc#1188944).
• config: Update files NVRAM=y (bsc#1201361 bsc#1192968).
• kernel-obs-build: include qemu_fw_cfg (boo#1201705)
• lightnvm: Remove lightnvm implemenation (bsc#1191881 bsc#1201420 ZDI-CAN-17325).
• md/bitmap: do not set sb values if can't pass sanity check (bsc#1197158).
• mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (git-fixes, bsc#1203098).
• mm: pagewalk: Fix race between unmap and page walker (git-fixes, bsc#1203159).
• net_sched: cls_route: disallow handle of 0 (bsc#1202393).
• objtool: Add support for intra-function calls (bsc#1202396).
• objtool: Make handle_insn_ops() unconditional (bsc#1202396).
• objtool: Remove INSN_STACK (bsc#1202396).
• objtool: Rework allocating stack_ops on decode (bsc#1202396).
• objtool: Support multiple stack_op per instruction (bsc#1202396).
• rpm: Fix parsing of rpm/macros.kernel-source on SLE12 (bsc#1201019).
• tcp: add some entropy in __inet_hash_connect() (bsc#1180153).
• tcp: change source port randomizarion at…

This update for the Linux Kernel 5.3.18-150200_24_115 fixes several issues.

The following security issues were fixed:

• CVE-2022-39188: Fixed a race condition between unmap_mapping_range() and munmap() on VM_PFNMAP mappings leads to stale TLB entry (bsc#1203116).
• CVE-2022-29581: Fixed an improper Update of Reference Count vulnerability in net/sched that causes privilege escalation to root (bsc#1199695).