CVE-2021-33655

When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.

The Linux Kernel, the operating system core itself.

Security Fix(es):

No description is available for this CVE.(CVE-2022-1508)

When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.(CVE-2021-33655)

When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)
• net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)
• hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)
• malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)
• possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)
• KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)
• use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882)
• KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)
• netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)
• race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)
• out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435)
• race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)
• memory leak in ipv6_renew_options() (CVE-2022-3524)
• data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)
• data races around sk->sk_prot (CVE-2022-3567)
• memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)
• denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)
• use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)
• USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)
• use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640)
• Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)
• mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128)
• l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)
• igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)
• lockdown bypass using IMA (CVE-2022-21505)
• double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)
• network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743)
• unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)
• TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189)
• u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)
• use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)
• use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)
• BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)
• Denial of service in beacon protection for P2P-device (CVE-2022-42722)
• memory corruption in usbmon driver (CVE-2022-43750)
• NULL pointer dereference in traffic control subsystem (CVE-2022-47929)
• NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)
• use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)
• use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)
• denial of service in tipc_conn_close (CVE-2023-1382)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)
• net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)
• cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)
• malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)
• possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)
• KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)
• use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882)
• KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)
• netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)
• race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)
• out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435)
• race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)
• memory leak in ipv6_renew_options() (CVE-2022-3524)
• data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)
• data races around sk->sk_prot (CVE-2022-3567)
• memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)
• denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)
• use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)
• USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)
• use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640)
• Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)
• mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128)
• l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)
• igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)
• lockdown bypass using IMA (CVE-2022-21505)
• double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)
• network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743)
• unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)
• TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189)
• u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)
• use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)
• use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)
• BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)
• Denial of service in beacon protection for P2P-device (CVE-2022-42722)
• memory corruption in usbmon driver (CVE-2022-43750)
• NULL pointer dereference in traffic control subsystem (CVE-2022-47929)
• NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)
• use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)
• use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)
• denial of service in tipc_conn_close (CVE-2023-1382)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)
• net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)
• hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)
• malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)
• when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds (CVE-2021-33656)
• possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)
• use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)
• KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)
• KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)
• netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)
• race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)
• media: em28xx: initialize refcount before kref_get (CVE-2022-3239)
• race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)
• memory leak in ipv6_renew_options() (CVE-2022-3524)
• data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)
• data races around sk->sk_prot (CVE-2022-3567)
• memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)
• denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)
• use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)
• USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)
• Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)
• l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)
• igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)
• Executable Space Protection Bypass (CVE-2022-25265)
• Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)
• unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)
• TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189)
• Report vmalloc UAF in dvb-core/dmxdev (CVE-2022-41218)
• u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)
• use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)
• use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)
• BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)
• Denial of service in beacon protection for P2P-device (CVE-2022-42722)
• memory corruption in usbmon driver (CVE-2022-43750)
• NULL pointer dereference in traffic control subsystem (CVE-2022-47929)
• NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)
• use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)
• Soft lockup occurred during __page_mapcount (CVE-2023-1582)
• slab-out-of-bounds read vulnerabilities in cbq_classify (CVE-2023-23454)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2122230, BZ#2122267)

Security Fix(es):

• use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)
• net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)
• hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)
• malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)
• when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds (CVE-2021-33656)
• possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)
• use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)
• KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)
• KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)
• netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)
• race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)
• media: em28xx: initialize refcount before kref_get (CVE-2022-3239)
• race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)
• memory leak in ipv6_renew_options() (CVE-2022-3524)
• data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)
• data races around sk->sk_prot (CVE-2022-3567)
• memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)
• denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)
• use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)
• USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)
• Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)
• l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)
• igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)
• Executable Space Protection Bypass (CVE-2022-25265)
• Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)
• unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)
• TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189)
• Report vmalloc UAF in dvb-core/dmxdev (CVE-2022-41218)
• u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)
• use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)
• use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)
• BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)
• Denial of service in beacon protection for P2P-device (CVE-2022-42722)
• memory corruption in usbmon driver (CVE-2022-43750)
• NULL pointer dereference in traffic control subsystem (CVE-2022-47929)
• NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)
• use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)
• Soft lockup occurred during __page_mapcount (CVE-2023-1582)
• slab-out-of-bounds read vulnerabilities in cbq_classify (CVE-2023-23454)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

In fbcon_set_font() of fbcon.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

• cgroup: Use open-time cgroup namespace for process migration perm checks {CVE-2021-4197}
• cgroup: Use open-time credentials for process migraton perm checks {CVE-2021-4197}
• cgroup: cgroup.{procs,threads} factor out common parts
• cgroup: unify attach permission checking
• vt: drop old FONT ioctls {CVE-2021-33656}
• fbmem: Check virtual screen sizes in fb_set_var() {CVE-2021-33655}
• fbcon: Prevent that screen size is smaller than font size {CVE-2021-33655}
• fbcon: Disallow setting font bigger than screen size {CVE-2021-33655}
• KVM: nVMX: add missing consistency checks for CR0 and CR4 {CVE-2023-30456}
• net: usb: ax88179_178a: Fix packet receiving {CVE-2022-2964}
• net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup {CVE-2022-2964}
• net: usb: ax88179_178a: fix packet alignment padding {CVE-2022-2964}
• ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32
• KVM: x86/mmu: do compare-and-exchange of gPTE via the user address {CVE-2022-1158}
• RDMA/cma: Do not change route.addr.src_addr.ss_family {CVE-2021-4028}
• RDMA/cma: Make the locking for automatic state transition more clear
• ath10k: Validate first subframe of A-MSDU before processing the list {CVE-2020-24588}
• ath10k: drop MPDU which has discard flag set by firmware for SDIO {CVE-2020-24588}
• mac80211: drop A-MSDUs on old ciphers {CVE-2020-24588}
• cfg80211: mitigate A-MSDU aggregation attacks {CVE-2020-24588}
• ipv4: make exception cache less predictible {CVE-2021-20322}
• ipv4: use siphash instead of Jenkins in fnhe_hashfun() {CVE-2021-20322}
• ipv6: make exception cache less predictible {CVE-2021-20322}
• ipv6: use siphash in rt6_exception_hash() {CVE-2021-20322}
• ipv6: use jhash2() in rt6_exception_hash()
• psi: Fix uaf issue when psi trigger is destroyed while being polled {CVE-2022-2938}
• psi: fix possible trigger missing in the window
• cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
• cgroup: make per-cgroup pressure stall tracking configurable
• netfilter: nf_tables_offload: incorrect flow offload action array size {CVE-2022-25636}
• netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create
• cgroup: fix psi monitor for root cgroup
• cgroup/cgroup.c: replace 'of->kn->priv' with of_cft()
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• devlink: Fix use-after-free after a failed reload {CVE-2022-3625}
• KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS {CVE-2022-2196}
• net/sched: tcindex: update imperfect hash filters respecting rcu {CVE-2023-1281}
• seq_buf: Fix overflow in seq_buf_putmem_hex() {CVE-2023-28772}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg {CVE-2023-31436}
• cgroup-v1: Require capabilities to set release_agent {CVE-2022-0492}
• net: sched: fix use-after-free in tc_new_tfilter() {CVE-2022-1055}
• SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() {CVE-2022-28893}
• net/sched: cls_u32: fix netns refcount changes in u32_change() {CVE-2022-29581}
• i2c: ismt: Fix an out-of-bounds bug in ismt_access() {CVE-2022-2873}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}

• cgroup: Use open-time cgroup namespace for process migration perm checks {CVE-2021-4197}
• cgroup: Use open-time credentials for process migraton perm checks {CVE-2021-4197}
• vt: drop old FONT ioctls {CVE-2021-33656}
• fbmem: Check virtual screen sizes in fb_set_var() {CVE-2021-33655}
• fbcon: Prevent that screen size is smaller than font size {CVE-2021-33655}
• fbcon: Disallow setting font bigger than screen size {CVE-2021-33655}
• KVM: nVMX: add missing consistency checks for CR0 and CR4 {CVE-2023-30456}
• net: usb: ax88179_178a: Fix packet receiving
• ipv4: make exception cache less predictible {CVE-2021-20322}
• ipv4: use siphash instead of Jenkins in fnhe_hashfun() {CVE-2021-20322}
• ipv6: make exception cache less predictible {CVE-2021-20322}
• ipv6: use siphash in rt6_exception_hash() {CVE-2021-20322}
• ipv6: use jhash2() in rt6_exception_hash()
• psi: Fix uaf issue when psi trigger is destroyed while being polled {CVE-2022-2938}
• psi: fix possible trigger missing in the window
• cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
• cgroup: make per-cgroup pressure stall tracking configurable
• netfilter: nf_tables_offload: incorrect flow offload action array size {CVE-2022-25636}
• netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• devlink: Fix use-after-free after a failed reload {CVE-2022-3625}
• KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS {CVE-2022-2196}
• net/sched: tcindex: update imperfect hash filters respecting rcu {CVE-2023-1281}
• seq_buf: Fix overflow in seq_buf_putmem_hex() {CVE-2023-28772}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg {CVE-2023-31436}
• cgroup-v1: Require capabilities to set release_agent {CVE-2022-0492}
• net: sched: fix use-after-free in tc_new_tfilter() {CVE-2022-1055}
• SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() {CVE-2022-28893}
• net/sched: cls_u32: fix netns refcount changes in u32_change() {CVE-2022-29581}
• i2c: ismt: Fix an out-of-bounds bug in ismt_access() {CVE-2022-2873}
• RDMA/cma: Do not change route.addr.src_addr.ss_family {CVE-2021-4028}
• net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup {CVE-2022-2964}
• KVM: x86/mmu: do compare-and-exchange of gPTE via the user address {CVE-2022-1158}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36557: Fixed race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys that could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed race condition involving VT_RESIZEX that could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed out of bounds write with ioctl PIO_FONT (bnc#1201636).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-20166: Fixed possible out of bounds write due to sprintf unsafety that could cause local escalation of privilege (bnc#1200598).
• CVE-2022-36946: Fixed incorrect packet truncation in nfqnl_mangle() that could lead to remote DoS (bnc#1201940).

The following non-security bugs were fixed:

• Add missing recommends of kernel-install-tools to kernel-source-vanilla (bsc#1200442)
• Bluetooth: hci_qca: Use del_timer_sync() before freeing (git-fixes).
• Drop qla2xxx patch which prevented nvme port discovery (bsc#1200651 bsc#1200644 bsc#1201954 bsc#1201958)
• PCI: qcom: Fix runtime PM imbalance on probe errors (git-fixes).
• arch_topology: Do not set llc_sibling if llc_id is invalid (git-fixes).
• blk-cgroup: synchronize blkg creation against policy deactivation (git-fixes).
• blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN (git-fixes).
• blk-zoned: allow zone management send operations without CAP_SYS_ADMIN (git-fixes).
• block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit (git-fixes).
• bnxt_en: Re-write PCI BARs after PCI fatal error (git-fixes).
• bnxt_en: Remove the setting of dev_port (git-fixes).
• crypto: qat - disable registration of algorithms (git-fixes).
• crypto: qat - fix memory leak in RSA (git-fixes).
• crypto: qat - remove dma_free_coherent() for DH (git-fixes).
• crypto: qat - remove dma_free_coherent() for RSA (git-fixes).
• crypto: qat - set to zero DH parameters before free (git-fixes).
• cxgb3/l2t: Fix undefined behaviour (git-fixes).
• dm btree remove: fix use after free in rebalance_children() (git-fixes).
• dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS (git-fixes).
• dm crypt: make printing of the key constant-time (git-fixes).
• dm integrity: fix error code in dm_integrity_ctr() (git-fixes).
• dm mirror log: round up region bitmap size to BITS_PER_LONG (git-fixes).
• dm stats: add cond_resched when looping over entries (git-fixes).
• dm: fix mempool NULL pointer race when completing IO (git-fixes).
• do not call utsname() after ->nsproxy is NULL (bsc#1201196).
• ehea: fix error return code in ehea_restart_qps() (git-fixes).
• fsl_lpuart: Do not enable interrupts too early (git-fixes).
• hex2bin: fix access beyond string end (git-fixes).
• hex2bin: make the function hex_to_bin constant-time (git-fixes).
• irqchip/exiu: Fix acknowledgment of edge triggered interrupts (git-fixes).
• kabi/severities: add cxgb3 network driver
• kernel-binary.spec: Support radio selection for debuginfo. To disable debuginfo on 5.18 kernel a radio selection needs to be switched to a different selection. This requires disabling the currently active option and selecting NONE as debuginfo type.
• kvm/emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).
• kvm: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930).
• latent_entropy: avoid build error when plugin cflags are not set (git-fixes).
• lib/hexdump.c: return -EINVAL in case of error in hex2bin() (git-fixes).
• linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check (git-fixes).
• linux/random.h: Remove arch_has_random, arch_has_random_seed (git-fixes).
• linux/random.h: Use false with bool (git-fixes).
• lkdtm: Disable return thunks in rodata.c (bsc#1114648).
• media: dib8000: Fix a memleak in…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36946: Fixed an incorrect packet trucation operation which could lead to denial of service (bnc#1201940).
• CVE-2022-20166: Fixed several possible memory safety issues due to unsafe operations (bsc#1200598).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of TTYs could lead to a use-after-free (bnc#1201429).
• CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TTY subsystem (bnc#1198829).

The following non-security bugs were fixed:

• Add missing recommends of kernel-install-tools (bsc#1200442)
• qla2xxx: drop patch which prevented nvme port discovery (bsc#1200651 bsc#1200644 bsc#1201954 bsc#1201958).
• kvm: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930).
• nfs: avoid NULL pointer dereference when there is unflushed data (bsc#1201196).
• kvm: emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).
• lkdtm: Disable return thunks in rodata.c (bsc#1114648).
• powerpc/64: Move paca allocation later in boot (bsc#1190812).
• powerpc/fadump: fix PT_LOAD segment for boot memory area (bsc#1103269 ltc#169948).
• powerpc/fadump: make crash memory ranges array allocation generic (bsc#1103269 ltc#169948).
• powerpc: Set crashkernel offset to mid of RMA region (bsc#1190812).
• rpm/kernel-obs-build.spec.in: Also depend on dracut-systemd (bsc#1195775)
• rpm/kernel-obs-build.spec.in: add systemd-initrd and terminfo dracut module (bsc#1195775)
• rpm/kernel-obs-build.spec.in: use default dracut modules (bsc#1195926, bsc#1198484) Let's iron out the reduced initrd optimisation in Tumbleweed. Build full blown dracut initrd with systemd for SLE15 SP4.
• scsi: qla2xxx: Add a new v2 dport diagnostic feature (bsc#1201958).
• scsi: qla2xxx: Add debug prints in the device remove path (bsc#1201958).
• scsi: qla2xxx: Check correct variable in qla24xx_async_gffid() (bsc#1201958).
• scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts (bsc#1201958).
• scsi: qla2xxx: Fix discovery issues in FC-AL topology (bsc#1201651).
• scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection (bsc#1201958).
• scsi: qla2xxx: Fix excessive I/O error messages by default (bsc#1201958).
• scsi: qla2xxx: Fix imbalance vha->vref_count (bsc#1201651).
• scsi: qla2xxx: Fix incorrect display of max frame size (bsc#1201958).
• scsi: qla2xxx: Fix losing FCP-2 targets during port perturbation tests (bsc#1201958).
• scsi: qla2xxx: Fix losing FCP-2 targets on long port disable with I/Os (bsc#1201958).
• scsi: qla2xxx: Fix losing target when it reappears during delete (bsc#1201958).
• scsi: qla2xxx: Fix response queue handler reading stale packets (bsc#1201651).
• scsi: qla2xxx: Fix sparse warning for dport_data (bsc#1201651).
• scsi: qla2xxx: Remove setting of 'req' and 'rsp' parameters (bsc#1201958).
• scsi: qla2xxx: Remove unused 'ql_dm_tgt_ex_pct' parameter (bsc#1201958).
• scsi: qla2xxx: Turn off multi-queue for 8G adapters (bsc#1201958).
• scsi: qla2xxx: Update manufacturer details (bsc#1201958).
• scsi: qla2xxx: Update version to 10.02.07.500-k (bsc#1201958).
• scsi: qla2xxx: Update version to 10.02.07.600-k (bsc#1201958).
• scsi: qla2xxx: Update version to 10.02.07.700-k (bsc#1201958).
• scsi: qla2xxx: Update version to 10.02.07.800-k (bsc#1201958).
• scsi: qla2xxx: Wind down adapter after PCIe error (bsc#1201958).
• scsi: qla2xxx: Zero undefined mailbox IN registers (bsc#1201651).
• scsi: qla2xxx: edif: Add bsg interface to read doorbell events (bsc#1201958).
• scsi: qla2xxx: edif:…

The SUSE Linux Enterprise 12 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-36946: Fixed an incorrect packet trucation operation which could lead to denial of service (bnc#1201940).
• CVE-2022-20166: Fixed several possible memory safety issues due to unsafe operations (bsc#1200598).
• CVE-2020-15393: Fixed a memory leak in the usbtest driver which could lead to denial of service (bnc#1173514).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of TTYs could lead to a use-after-free (bnc#1201429).
• CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TTY subsystem (bnc#1198829).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-2318: Fixed a use-after-free vulnerability in the timer handler in Rose subsystem that allowed unprivileged attackers to crash the system (bsc#1201251).
• CVE-2021-39713: Fixed a race condition in the network scheduling subsystem which could lead to a use-after-free (bnc#1196973).

The following non-security bugs were fixed:

• kvm: emulate: Do not adjust size of fastop and setcc subroutines (bsc#1201930).
• kvm: emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue (bnc#1200015, bnc#1200494).

The following non-security bugs were fixed:

• 9p: Fix refcounting during full path walks for fid lookups (git-fixes).
• 9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl (git-fixes).
• 9p: fix fid refcount leak in v9fs_vfs_get_link (git-fixes).
• ACPI: CPPC: Only probe for _CPC if CPPC v2 is acked (git-fixes).
• ACPI: video: Fix acpi_video_handles_brightness_key_presses() (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo L140PU (git-fixes).
• ALSA: hda/realtek: Fix headset mic for Acer SF313-51 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP machines (git-fixes).
• ALSA: usb-audio: Add quirk for Fiero SC-01 (fw v1.0.0) (git-fixes).
• ALSA: usb-audio: Add quirk for Fiero SC-01 (git-fixes).
• ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices (git-fixes).
• ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD (git-fixes).
• ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle (git-fixes).
• ARM: 9210/1: Mark the FDT_FIXED sections as shareable (git-fixes).
• ARM: 9213/1: Print message about disabled Spectre workarounds only once (git-fixes).
• ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction (git-fixes).
• ARM: 9216/1: Fix MAX_DMA_ADDRESS overflow (git-fixes).
• ARM: dts: at91: sama5d2: Fix typo in i2s1 node (git-fixes).
• ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count (git-fixes).
• ARM: dts: stm32: use the correct clock source for CEC on stm32mp151 (git-fixes).
• ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Intel: bytcr_wm5102: Fix GPIO related probe-ordering problem (git-fixes).
• ASoC: Intel: sof_sdw: handle errors on card registration (git-fixes).
• ASoC: Realtek/Maxim SoundWire codecs: disable pm_runtime on remove (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: SOF: Intel: hda-loader: Clarify the cl_dsp_init() flow (git-fixes).
• ASoC: codecs: rt700/rt711/rt711-sdca: initialize workqueues in probe (git-fixes).
• ASoC: codecs: rt700/rt711/rt711-sdca: resume bus/codec in .set_jack_detect (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: dapm: Initialise kcontrol data for mux/demux controls (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: rt5682: Avoid the unexpected IRQ event during going to suspend (git-fixes).
• ASoC: rt5682: Fix deadlock on resume (git-fixes).
• ASoC: rt5682: Re-detect the combo jack after resuming (git-fixes).
• ASoC: rt5682: fix an incorrect NULL check…

The SUSE Linux Enterprise 15 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36557: Fixed race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys that could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed race condition involving VT_RESIZEX that could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed out of bounds write with ioctl PIO_FONT (bnc#1201636).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-20166: Fixed possible out of bounds write due to sprintf unsafety that could cause local escalation of privilege (bnc#1200598).
• CVE-2022-36946: Fixed incorrect packet truncation in nfqnl_mangle() that could lead to remote DoS (bnc#1201940).

The following non-security bugs were fixed:

• Add missing recommends of kernel-install-tools to kernel-source-vanilla (bsc#1200442)
• cifs: On cifs_reconnect, resolve the hostname again (bsc#1201926).
• cifs: Simplify reconnect code when dfs upcall is enabled (bsc#1201926).
• cifs: To match file servers, make sure the server hostname matches (bsc#1201926).
• cifs: fix memory leak of smb3_fs_context_dup::server_hostname (bsc#1201926).
• cifs: fix potential use-after-free in cifs_echo_request() (bsc#1201926).
• cifs: set a minimum of 120s for next dns resolution (bsc#1201926).
• cifs: use the expiry output of dns_query to schedule next resolution (bsc#1201926).
• kernel-binary.spec: Support radio selection for debuginfo. To disable debuginfo on 5.18 kernel a radio selection needs to be switched to a different selection. This requires disabling the currently active option and selecting NONE as debuginfo type.
• kernel-binary.spec: check s390x vmlinux location As a side effect of mainline commit edd4a8667355 ('s390/boot: get rid of startup archive'), vmlinux on s390x moved from 'compressed' subdirectory directly into arch/s390/boot. As the specfile is shared among branches, check both locations and let objcopy use one that exists.
• kvm: emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).
• kvm: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930).
• pahole 1.22 required for full BTF features. also recommend pahole for kernel-source to make the kernel buildable with standard config
• rpm/*.spec.in: remove backtick usage
• rpm/constraints.in: skip SLOW_DISK workers for kernel-source
• rpm/kernel-obs-build.spec.in: Also depend on dracut-systemd (bsc#1195775)
• rpm/kernel-obs-build.spec.in: add systemd-initrd and terminfo dracut module (bsc#1195775)
• rpm/kernel-obs-build.spec.in: use default dracut modules (bsc#1195926, bsc#1198484).

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-36946: Fixed an incorrect packet trucation operation which could lead to denial of service (bnc#1201940).
• CVE-2022-29581: Fixed improper update of reference count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-20166: Fixed several possible memory safety issues due to unsafe operations (bsc#1200598).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of TTYs that could lead to a use-after-free (bnc#1201429).
• CVE-2021-33655: Fixed an out of bounds write by ioctl cmd FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed an out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2022-21505: Fixed a kernel lockdown bypass via IMA policy (bsc#1201458).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TTY subsystem (bnc#1198829).
• CVE-2022-1116: Fixed an integer overflow vulnerability in io_uring which allowed a local attacker to escalate privileges to root (bnc#1199647).- CVE-2022-2318: Fixed a use-after-free vulnerability in the timer handler in Rose subsystem that allowed unprivileged attackers to crash the system (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• Fixed a system crash related to the recent RETBLEED mitigation (bsc#1201644, bsc#1201664, bsc#1201672, bsc#1201673, bsc#1201676).
• qla2xxx: drop patch which prevented nvme port discovery (bsc#1200651 bsc#1200644 bsc#1201954 bsc#1201958).
• kvm: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930).
• bpf, cpumap: Remove rcpu pointer from cpu_map_build_skb signature (bsc#1199364).
• bpf: enable BPF type format (BTF) (jsc#SLE-24559).
• nfs: avoid NULL pointer dereference when there is unflushed data (bsc#1201196).
• hv_netvsc: Add (more) validation for untrusted Hyper-V values (bsc#1199364).
• hv_netvsc: Add comment of netvsc_xdp_xmit() (bsc#1199364).
• hv_netvsc: Add support for XDP_REDIRECT (bsc#1199364).
• hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer (bsc#1199364).
• hv_netvsc: Fix validation in netvsc_linkstatus_callback() (bsc#1199364).
• kvm/emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).
• lkdtm: Disable return thunks in rodata.c (bsc#1178134).
• net, xdp: Introduce __xdp_build_skb_from_frame utility routine (bsc#1199364).
• net, xdp: Introduce xdp_build_skb_from_frame utility routine (bsc#1199364).
• nvme: consider also host_iface when checking ip options (bsc#1199670).
• powerpc/mobility: wait for memory transfer to complete (bsc#1201846 ltc#198761).
• powerpc/pseries/mobility: set NMI watchdog factor during an LPM (bsc#1201846 ltc#198761).
• powerpc/watchdog: introduce a NMI watchdog's factor (bsc#1201846 ltc#198761).
• scsi: lpfc: Copyright updates for 14.2.0.5 patches (bsc#1201956).
• scsi: lpfc: Fix attempted FA-PWWN usage after feature disable (bsc#1201956).
• scsi: lpfc: Fix lost NVMe paths during LIF bounce stress test (bsc#1201956 bsc#1200521).
• scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE (bsc#1201956).
• scsi: lpfc: Fix uninitialized cqe field in lpfc_nvme_cancel_iocb() (bsc#1201956).
• scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input (bsc#1201956).
• scsi: lpfc: Refactor lpfc_nvmet_prep_abort_wqe() into lpfc_sli_prep_abort_xri() (bsc#1201956).
• scsi: lpfc: Remove Menlo/Hornet related code (bsc#1201956).
• scsi: lpfc: Remove extra atomic_inc on cmd_pending in queuecommand after VMID (bsc#1201956).
• scsi: lpfc: Revert RSCN_MEMENTO workaround for…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-2585: Fixed use-after-free in POSIX CPU timer (bnc#1202094).
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2022-26373: Fixed CPU info leak via post-barrier RSB predictions (bsc#1201726).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).

The following non-security bugs were fixed:

• ACPI: CPPC: Only probe for _CPC if CPPC v2 is acked (git-fixes).
• ACPI: video: Fix acpi_video_handles_brightness_key_presses() (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo L140PU (git-fixes).
• ALSA: hda/realtek: Fix headset mic for Acer SF313-51 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP machines (git-fixes).
• ALSA: usb-audio: Add quirk for Fiero SC-01 (fw v1.0.0) (git-fixes).
• ALSA: usb-audio: Add quirk for Fiero SC-01 (git-fixes).
• ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices (git-fixes).
• ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD (git-fixes).
• ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle (git-fixes).
• ARM: 9210/1: Mark the FDT_FIXED sections as shareable (git-fixes).
• ARM: 9213/1: Print message about disabled Spectre workarounds only once (git-fixes).
• ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction (git-fixes).
• ARM: dts: at91: sama5d2: Fix typo in i2s1 node (git-fixes).
• ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count (git-fixes).
• ARM: dts: stm32: use the correct clock source for CEC on stm32mp151 (git-fixes).
• ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Intel: bytcr_wm5102: Fix GPIO related probe-ordering problem (git-fixes).
• ASoC: Intel: sof_sdw: handle errors on card registration (git-fixes).
• ASoC: Realtek/Maxim SoundWire codecs: disable pm_runtime on remove (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: SOF: Intel: hda-loader: Clarify the cl_dsp_init() flow (git-fixes).
• ASoC: codecs: rt700/rt711/rt711-sdca: initialize workqueues in probe (git-fixes).
• ASoC: codecs: rt700/rt711/rt711-sdca: resume bus/codec in .set_jack_detect (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: dapm: Initialise kcontrol data for mux/demux controls (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: rt5682: Avoid the unexpected IRQ event during going to suspend (git-fixes).
• ASoC: rt5682: Fix deadlock on resume (git-fixes).
• ASoC: rt5682: Re-detect the combo jack after resuming (git-fixes).
• ASoC: rt5682: fix an incorrect NULL check on list iterator (git-fixes).
• ASoC: rt5682: move clk related code to rt5682_i2c_probe (git-fixes).
• ASoC: rt7*-sdw: harden jack_detect_handler (git-fixes).
• ASoC: rt711-sdca-sdw: fix calibrate mutex initialization (git-fixes).
• ASoC: rt711-sdca: Add endianness flag in snd_soc_component_driver (git-fixes).
• ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error (git-fixes).…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed out of bounds write with ioctl PIO_FONT (bnc#1201636).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).

The following non-security bugs were fixed:

• Add missing recommends of kernel-install-tools to kernel-source-vanilla (bsc#1200442)
• cifs: On cifs_reconnect, resolve the hostname again (bsc#1201926).
• cifs: Simplify reconnect code when dfs upcall is enabled (bsc#1201926).
• cifs: To match file servers, make sure the server hostname matches (bsc#1201926).
• cifs: fix memory leak of smb3_fs_context_dup::server_hostname (bsc#1201926).
• cifs: fix potential use-after-free in cifs_echo_request() (bsc#1201926).
• cifs: set a minimum of 120s for next dns resolution (bsc#1201926).
• cifs: use the expiry output of dns_query to schedule next resolution (bsc#1201926).
• kernel-binary.spec: Support radio selection for debuginfo. To disable debuginfo on 5.18 kernel a radio selection needs to be switched to a different selection. This requires disabling the currently active option and selecting NONE as debuginfo type.
• kvm: emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).
• kvm: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930).
• pahole 1.22 required for full BTF features. also recommend pahole for kernel-source to make the kernel buildable with standard config
• rpm/*.spec.in: remove backtick usage
• rpm/constraints.in: skip SLOW_DISK workers for kernel-source
• rpm/kernel-obs-build.spec.in: Also depend on dracut-systemd (bsc#1195775)
• rpm/kernel-obs-build.spec.in: add systemd-initrd and terminfo dracut module (bsc#1195775)
• rpm/kernel-obs-build.spec.in: use default dracut modules (bsc#1195926, bsc#1198484).

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2021-33655: Fixed memory out of bounds write by ioctl cmd FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem. This flaw allowed a local user to crash the system or read unauthorized random data from memory. (bnc#1198829)
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-21505: Fixed kexec lockdown bypass with ima policy (bsc#1201458).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-36946: Fixed incorrect packet truncation in nfqnl_mangle() that could lead to remote DoS (bnc#1201940).

The following non-security bugs were fixed:

• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• blk-mq: Fix wrong wakeup batch configuration which will cause hang (bsc#1200263).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
• dma-direct: Fix potential NULL pointer dereference (bsc#1196472 ltc#192278).
• dma-mapping: Allow mixing bypass and mapped DMA operation (bsc#1196472 ltc#192278).
• dma-mapping: add a dma_ops_bypass flag to struct device (bsc#1196472 ltc#192278).
• dma-mapping: move the remaining DMA API calls out of line (bsc#1196472 ltc#192278).
• dma: kABI: Add back removed exports (bsc#1196472 ltc#192278).
• exec: Force single empty string when argv is empty (bsc#1200571).
• fsnotify: invalidate dcache before IN_DELETE event (bsc#1195478 bsc#1200905).
• kvm: emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).
• kvm: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930).
• powerpc/dma: Fallback to dma_ops when persistent memory present (bsc#1196472 ltc#192278).
• powerpc/pseries/iommu: Create defines for…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36557: Fixed race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys that could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed race condition involving VT_RESIZEX that could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed out of bounds write with ioctl PIO_FONT (bnc#1201636).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-20166: Fixed possible out of bounds write due to sprintf unsafety that could cause local escalation of privilege (bnc#1200598).
• CVE-2022-36946: Fixed incorrect packet truncation in nfqnl_mangle() that could lead to remote DoS (bnc#1201940).

The following non-security bugs were fixed:

• cifs: On cifs_reconnect, resolve the hostname again (bsc#1201926).
• cifs: Simplify reconnect code when dfs upcall is enabled (bsc#1201926).
• cifs: To match file servers, make sure the server hostname matches (bsc#1201926).
• cifs: fix memory leak of smb3_fs_context_dup::server_hostname (bsc#1201926).
• cifs: set a minimum of 120s for next dns resolution (bsc#1201926).
• cifs: use the expiry output of dns_query to schedule next resolution (bsc#1201926).
• kvm: emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).
• kvm: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930).
• rpm/*.spec.in: remove backtick usage
• rpm/constraints.in: skip SLOW_DISK workers for kernel-source
• rpm/kernel-obs-build.spec.in: Also depend on dracut-systemd (bsc#1195775)
• rpm/kernel-obs-build.spec.in: add systemd-initrd and terminfo dracut module (bsc#1195775)
• rpm/kernel-obs-build.spec.in: use default dracut modules (bsc#1195926, bsc#1198484)
• x86/entry: Remove skip_r11rcx (bsc#1201644).

The SUSE Linux Enterprise 12 SP3 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-15393: CVE-2020-15393: Fixed a memory leak in usbtest_disconnect (bnc#1173514).
• CVE-2020-36557: Fixed race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys that could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed race condition involving VT_RESIZEX that could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed out of bounds write with ioctl PIO_FONT (bnc#1201636).
• CVE-2021-39713: Fixed a race condition in the network scheduling subsystem which could lead to a use-after-free. (bnc#1196973)
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-20166: Fixed possible out of bounds write due to sprintf unsafety that could cause local escalation of privilege (bnc#1200598).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-36946: Fixed incorrect packet truncation in nfqnl_mangle() that could lead to remote DoS (bnc#1201940).

The following non-security bugs were fixed:

• kvm: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930).
• kvm: emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36516: Fixed TCP session data injection vulnerability via the mixed IPID assignment method (bnc#1196616).
• CVE-2020-36557: Fixed race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys that could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed race condition involving VT_RESIZEX that could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed out of bounds write with ioctl PIO_FONT (bnc#1201636).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size() (bsc#1202154).
• CVE-2022-20166: Fixed possible out of bounds write due to sprintf unsafety that could cause local escalation of privilege (bnc#1200598)
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-32250: Fixed user-after-free in net/netfilter/nf_tables_api.c that could allow local privilege escalation (bnc#1200015).
• CVE-2022-36946: Fixed incorrect packet truncation in nfqnl_mangle() that could lead to remote DoS (bnc#1201940).

The following non-security bugs were fixed:

• ACPI: APEI: Better fix to avoid spamming the console with old error logs (git-fixes).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• ACPI: video: Shortening quirk list by identifying Clevo by board_name only (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: sgtl5000: Fix noise on shutdown/remove (git-fixes).
• ASoC: wm5110: Fix DRE control (git-fixes).
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (git-fixes).
• Bluetooth: hci_intel: Add check for platform_driver_register (git-fixes).
• FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR (git-fixes).
• FDDI: defxx: Make MMIO the configuration default except for EISA (git-fixes).
• Fixed a system crash related to the recent RETBLEED mitigation (bsc#1201644, bsc#1201664, bsc#1201672, bsc#1201673, bsc#1201676).
• Fixed battery detection problem on macbooks (bnc#1201206).
• HID: cp2112: prevent a buffer overflow in cp2112_xfer() (git-fixes).
• KVM/emulate: Fix SETcc emulation function offsets…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36516: Fixed TCP session data injection vulnerability via the mixed IPID assignment method (bnc#1196616).
• CVE-2020-36557: Fixed race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys that could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed race condition involving VT_RESIZEX that could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed out of bounds write with ioctl PIO_FONT (bnc#1201636).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size() (bsc#1202154).
• CVE-2022-20166: Fixed possible out of bounds write due to sprintf unsafety that could cause local escalation of privilege (bnc#1200598)
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-32250: Fixed user-after-free in net/netfilter/nf_tables_api.c that could allow local privilege escalation (bnc#1200015).
• CVE-2022-36946: Fixed incorrect packet truncation in nfqnl_mangle() that could lead to remote DoS (bnc#1201940).

The following non-security bugs were fixed:

• ACPI: APEI: Better fix to avoid spamming the console with old error logs (git-fixes).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• ACPI: video: Shortening quirk list by identifying Clevo by board_name only (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: sgtl5000: Fix noise on shutdown/remove (git-fixes).
• ASoC: wm5110: Fix DRE control (git-fixes).
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (git-fixes).
• Bluetooth: hci_intel: Add check for platform_driver_register (git-fixes).
• FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR (git-fixes).
• FDDI: defxx: Make MMIO the configuration default except for EISA (git-fixes).
• Fixed a system crash related to the recent RETBLEED mitigation (bsc#1201644, bsc#1201664, bsc#1201672, bsc#1201673, bsc#1201676).
• Fixed battery detection problem on macbooks (bnc#1201206).
• HID: cp2112: prevent a buffer overflow in cp2112_xfer() (git-fixes).
• KVM/emulate: Fix SETcc emulation function offsets…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size() (bsc#1202154).
• CVE-2020-36516: Fixed TCP session data injection vulnerability via the mixed IPID assignment method (bnc#1196616).
• CVE-2022-36946: Fixed an incorrect packet trucation operation which could lead to denial of service (bnc#1201940).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-20166: Fixed several possible memory safety issues due to unsafe operations (bsc#1200598).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of TTYs could lead to a use-after-free (bnc#1201429).
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TTY subsystem (bnc#1198829).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-2318: Fixed a use-after-free vulnerability in the timer handler in Rose subsystem that allowed unprivileged attackers to crash the system (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• Fix bsc#1201644, bsc#1201664, bsc#1201672, bsc#1201673, bsc#1201676 All are reports of the same problem - the IBRS_* regs push/popping was wrong but it needs 1b331eeea7b8 ('x86/entry: Remove skip_r11rcx') too.
• ACPI: APEI: Better fix to avoid spamming the console with old error logs (git-fixes).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• ACPI: video: Shortening quirk list by identifying Clevo by board_name only (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: sgtl5000: Fix noise on shutdown/remove (git-fixes).
• ASoC: wm5110: Fix DRE control (git-fixes).
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (git-fixes).
• Bluetooth: hci_intel: Add check for platform_driver_register (git-fixes).
• Fixed a regression where smart batteries would not be detected on Mac (bsc#1201206).
• Fixed an issue where qla2xxx would prevent nvme port discovery (bsc#1200651 bsc#1200644 bsc#1201954 bsc#1201958).
• FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR (git-fixes).
• FDDI: defxx: Make MMIO the configuration default except for EISA (git-fixes).
• Fix 1201644, 1201664, 1201672, 1201673, 1201676 All are reports of the…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size() (bsc#1202154).
• CVE-2020-36516: Fixed TCP session data injection vulnerability via the mixed IPID assignment method (bnc#1196616).
• CVE-2022-36946: Fixed an incorrect packet trucation operation which could lead to denial of service (bnc#1201940).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-20166: Fixed several possible memory safety issues due to unsafe operations (bsc#1200598).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of TTYs could lead to a use-after-free (bnc#1201429).
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TTY subsystem (bnc#1198829).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-2318: Fixed a use-after-free vulnerability in the timer handler in Rose subsystem that allowed unprivileged attackers to crash the system (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• Fix bsc#1201644, bsc#1201664, bsc#1201672, bsc#1201673, bsc#1201676 All are reports of the same problem - the IBRS_* regs push/popping was wrong but it needs 1b331eeea7b8 ('x86/entry: Remove skip_r11rcx') too.
• ACPI: APEI: Better fix to avoid spamming the console with old error logs (git-fixes).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• ACPI: video: Shortening quirk list by identifying Clevo by board_name only (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: sgtl5000: Fix noise on shutdown/remove (git-fixes).
• ASoC: wm5110: Fix DRE control (git-fixes).
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (git-fixes).
• Bluetooth: hci_intel: Add check for platform_driver_register (git-fixes).
• Fixed a regression where smart batteries would not be detected on Mac (bsc#1201206).
• Fixed an issue where qla2xxx would prevent nvme port discovery (bsc#1200651 bsc#1200644 bsc#1201954 bsc#1201958).
• FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR (git-fixes).
• FDDI: defxx: Make MMIO the configuration default except for EISA (git-fixes).
• Fix 1201644, 1201664, 1201672, 1201673, 1201676 All are reports of the…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size() (bsc#1202154).
• CVE-2020-36516: Fixed TCP session data injection vulnerability via the mixed IPID assignment method (bnc#1196616).
• CVE-2022-36946: Fixed an incorrect packet trucation operation which could lead to denial of service (bnc#1201940).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-20166: Fixed several possible memory safety issues due to unsafe operations (bsc#1200598).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of TTYs could lead to a use-after-free (bnc#1201429).
• CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TTY subsystem (bnc#1198829).

The following non-security bugs were fixed:

• Add missing recommends of kernel-install-tools to kernel-source-vanilla (bsc#1200442)
• Bluetooth: hci_qca: Use del_timer_sync() before freeing (git-fixes).
• Fixed an issue where qla2xxx would prevent nvme port discovery (bsc#1200651 bsc#1200644 bsc#1201954 bsc#1201958).
• Fix parsing of rpm/macros.kernel-source on SLE12 (bsc#1201019).
• KVM: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930).
• PCI: qcom: Fix runtime PM imbalance on probe errors (git-fixes).
• SUNRPC: Fix READ_PLUS crasher (git-fixes).
• arch_topology: Do not set llc_sibling if llc_id is invalid (git-fixes).
• blk-cgroup: synchronize blkg creation against policy deactivation (git-fixes).
• blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN (git-fixes).
• blk-zoned: allow zone management send operations without CAP_SYS_ADMIN (git-fixes).
• block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit (git-fixes).
• bnxt_en: Re-write PCI BARs after PCI fatal error (git-fixes).
• bnxt_en: Remove the setting of dev_port (git-fixes).
• crypto: qat - disable registration of algorithms (git-fixes).
• crypto: qat - fix memory leak in RSA (git-fixes).
• crypto: qat - remove dma_free_coherent() for DH (git-fixes).
• crypto: qat - remove dma_free_coherent() for RSA (git-fixes).
• crypto: qat - set to zero DH parameters before free (git-fixes).
• cxgb3/l2t: Fix undefined behaviour (git-fixes).
• dm btree remove: fix use after free in rebalance_children() (git-fixes).
• dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS (git-fixes).
• dm crypt: make printing of the key constant-time (git-fixes).
• dm integrity: fix error code in dm_integrity_ctr() (git-fixes).
• dm mirror log: round up region bitmap size to BITS_PER_LONG (git-fixes).
• dm raid: fix KASAN warning in raid5_add_disks (git-fixes).
• dm stats: add cond_resched when looping over entries (git-fixes).
• dm: fix mempool NULL pointer race when completing IO (git-fixes).
• do not call utsname() after ->nsproxy is NULL (bsc#1201196).
• ehea: fix error return code in ehea_restart_qps() (git-fixes).
• fsl_lpuart: Do not enable interrupts too early (git-fixes).
• hex2bin: fix access beyond string end (git-fixes).
• hex2bin: make the function hex_to_bin constant-time (git-fixes).
• irqchip/exiu: Fix acknowledgment of edge triggered interrupts (git-fixes).
• kernel-obs-build: include qemu_fw_cfg (boo#1201705)
• kvm/emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).
• latent_entropy: avoid build error when plugin cflags are not set (git-fixes).
• lib/hexdump.c: return -EINVAL in case of error in hex2bin() (git-fixes).
• linux/random.h: Mark…

This update for the Linux Kernel 4.12.14-150100_197_117 fixes several issues.

The following security issues were fixed:

• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).

This update for the Linux Kernel 4.12.14-150000_150_95 fixes several issues.

The following security issues were fixed:

• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys that could have led to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).

This update for the Linux Kernel 5.3.18-150300_59_87 fixes several issues.

The following security issues were fixed:

• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).
• CVE-2022-42722: Fixed crash in beacon protection for P2P-device. (bsc#1204125)

This update for the Linux Kernel 5.14.21-150400_24_11 fixes several issues.

The following security issues were fixed:

• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-1882: Fixed a use-after-free flaw in free_pipe_info() that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1199904).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).
• CVE-2022-42722: Fixed crash in beacon protection for P2P-device. (bsc#1204125)

This update for the Linux Kernel 5.3.18-150300_59_76 fixes several issues.

The following security issues were fixed:

• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).

• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).

• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).

• CVE-2022-42722: Fixed crash in beacon protection for P2P-device. (bsc#1204125)

• Fixed incorrect handling of empty arguments array in execve() (bsc#1200571).

This update for the Linux Kernel 5.3.18-150200_24_115 fixes several issues.

The following security issues were fixed:

• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).

• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).

• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).

• Fixed incorrect handling of empty arguments array in execve() (bsc#1200571).

This update for the Linux Kernel 5.14.21-150400_22 fixes several issues.

The following security issues were fixed:

• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).

• CVE-2022-1882: Fixed a use-after-free flaw in free_pipe_info() that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1199904).

• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).

• CVE-2022-2959: Fixed a race condition that was found inside the watch queue due to a missing lock in pipe_resize_ring() (bnc#1202681).

• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).

• CVE-2022-42722: Fixed crash in beacon protection for P2P-device. (bsc#1204125)

• Fixed incorrect handling of empty arguments array in execve() (bsc#1200571).

This update for the Linux Kernel 4.12.14-150000_150_92 fixes several issues.

The following security issues were fixed:

• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys that could have led to a use-after-free (bnc#1201429).

• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).

• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).

• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).

• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).

• Fixed incorrect handling of empty arguments array in execve() (bsc#1200571).

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-13695: Fixed fix acpi operand cache leak in nseval.c (bsc#1055710).
• CVE-2018-7755: Fixed bypass of kernel security protections such as KASLR using fd_locked_ioctl function in drivers/block/floppy.c (bnc#1084513).
• CVE-2019-3837: Fixed memory leak due to thread-unsafe implementation of the net_dma code in tcp_recvmsg() (bnc#1131430).
• CVE-2019-3900: Fixed infinite loop while receiving packets in vhost_net (bnc#1133374).
• CVE-2020-15393: Fixed memory leak in usbtest_disconnect in drivers/usb/misc/usbtest.c (bnc#1173514).
• CVE-2020-16119: Fixed use-after-free exploitable by a local attacker due to reuse of a DCCP socket (bnc#1177471).
• CVE-2020-36557: Fixed race condition in the VT_DISALLOCATE ioctl and closing/opening of ttys which could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed race condition in VT_RESIZEX (bsc#1200910).
• CVE-2021-26341: Fixed vulnerablity where some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bnc#1201050).
• CVE-2021-33655: When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds (bnc#1201635).
• CVE-2021-33656: Fixed memory out of bounds write when setting font with malicous data by ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2021-34981: Fixed file refcounter in bluetooth cmtp when cmtp_attach_device fails (bsc#1191961).
• CVE-2021-39713: Fixed race condition in the network scheduling subsystem which could lead to a use-after-free (bsc#1196973).
• CVE-2021-45868: Fixed use-after-free in fs/quota/quota_tree.c (bnc#1197366).
• CVE-2022-1011: Fixed UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (bsc#1197343).
• CVE-2022-1048: Fixed potential AB/BA lock with buffer_mutex and mmap_lock (bsc#1197331).
• CVE-2022-1353: Fixed denial of service in the pfkey_register function in net/key/af_key.c (bnc#1198516).
• CVE-2022-1462: Fixed out-of-bounds read in the TeleTYpe subsystem allowing local user to crash the system or read unauthorized random data from memory (bnc#1198829).
• CVE-2022-1652: Fixed use after free in floppy (bsc#1199063).
• CVE-2022-1679: Fixed use-after-free in the atheros wireless adapter driver (bnc#1199487).
• CVE-2022-20132: Fixed out of bounds read in lg_probe and related functions of hid-lg.c and other USB HID files (bnc#1200619).
• CVE-2022-20166: Fixed out of bounds write due to a heap buffer overflow which could lead to local escalation of privilege with System execution privileges needed (bnc#1200598).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bnc#1202346).
• CVE-2022-20369: Fixed out of bounds write due to improper input validation in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-21166, CVE-2022-21127, CVE-2022-21123, CVE-2022-21125, CVE-2022-21180: Fixed stale MMIO data transient information leaks (INTEL-TA-00615) (bnc#1199650).
• CVE-2022-21385: Fixed warn in rds_message_alloc_sgs (bnc#1202897).
• CVE-2022-21499: Fixed issue where it was trivial to break out of lockdown using kgdb (bsc#1199426).
• CVE-2022-2318: Fixed use-after-free caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges (bnc#1201251).
• CVE-2022-2663: Fixed possible firewall bypass when users are using unencrypted IRC due to message handling confusion in nf_conntrack_irc (bnc#1202097).
• CVE-2022-28356: Fixed refcount leak bug in net/llc/af_llc.c (bnc#1197391).
• CVE-2022-29900: Fixed mis-trained branch predictions for return instructions that may have allowed arbitrary speculative code execution under certain microarchitecture-dependent conditions (bnc#1199657).
• CVE-2022-29901: Fixed vulnerability where an attacker with unprivileged user access can hijack return instructions to…

Asaf Modelevsky discovered that the Intel(R) 10GbE PCI Express (ixgbe) Ethernet driver for the Linux kernel performed insufficient control flow management. A local attacker could possibly use this to cause a denial of service. (CVE-2021-33061)

It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33655)

It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33655)

It was discovered that the virtual terminal driver in the Linux kernel did not properly handle VGA console font changes, leading to an out-of-bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33656)

It was discovered that the Packet network protocol implementation in the Linux kernel contained an out-of-bounds access. A remote attacker could use this to expose sensitive information (kernel memory). (CVE-2022-20368)

Domingo Dirutigliano and Nicola Guerrera discovered that the netfilter subsystem in the Linux kernel did not properly handle rules that truncated packets below the packet header size. When such rules are in place, a remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-36946)

Asaf Modelevsky discovered that the Intel(R) 10GbE PCI Express (ixgbe) Ethernet driver for the Linux kernel performed insufficient control flow management. A local attacker could possibly use this to cause a denial of service. (CVE-2021-33061)

It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33655)

It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33655)

Domingo Dirutigliano and Nicola Guerrera discovered that the netfilter subsystem in the Linux kernel did not properly handle rules that truncated packets below the packet header size. When such rules are in place, a remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-36946)

It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33655)

Moshe Kol, Amit Klein and Yossi Gilad discovered that the IP implementation in the Linux kernel did not provide sufficient randomization when calculating port offsets. An attacker could possibly use this to expose sensitive information. (CVE-2022-1012, CVE-2022-32296)

Norbert Slusarek discovered that a race condition existed in the perf subsystem in the Linux kernel, resulting in a use-after-free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1729)

It was discovered that the device-mapper verity (dm-verity) driver in the Linux kernel did not properly verify targets being loaded into the device- mapper table. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-2503)

Domingo Dirutigliano and Nicola Guerrera discovered that the netfilter subsystem in the Linux kernel did not properly handle rules that truncated packets below the packet header size. When such rules are in place, a remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-36946)

Asaf Modelevsky discovered that the Intel(R) 10GbE PCI Express (ixgbe) Ethernet driver for the Linux kernel performed insufficient control flow management. A local attacker could possibly use this to cause a denial of service. (CVE-2021-33061)

It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33655)

Moshe Kol, Amit Klein and Yossi Gilad discovered that the IP implementation in the Linux kernel did not provide sufficient randomization when calculating port offsets. An attacker could possibly use this to expose sensitive information. (CVE-2022-1012, CVE-2022-32296)

Norbert Slusarek discovered that a race condition existed in the perf subsystem in the Linux kernel, resulting in a use-after-free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1729)

Qiuhao Li, Gaoning Pan, and Yongkang Jia discovered that the KVM hypervisor implementation in the Linux kernel did not properly handle an illegal instruction in a guest, resulting in a null pointer dereference. An attacker in a guest VM could use this to cause a denial of service (system crash) in the host OS. (CVE-2022-1852)

It was discovered that the UDF file system implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1943)

Gerald Lee discovered that the NTFS file system implementation in the Linux kernel did not properly handle certain error conditions, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2022-1973)

Duoming Zhou discovered that race conditions existed in the timer handling implementation of the Linux kernel's Rose X.25 protocol layer, resulting in use-after-free vulnerabilities. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-2318)

It was discovered that the device-mapper verity (dm-verity) driver in the Linux kernel did not properly verify targets being loaded into the device- mapper table. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-2503)

Roger Pau Monné discovered that the Xen virtual block driver in the Linux kernel did not properly initialize memory pages to be used for shared communication with the backend. A local attacker could use this to expose sensitive information (guest kernel memory). (CVE-2022-26365)

Zheyu Ma discovered that the Intel iSMT SMBus host controller driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-2873)

Selim Enes Karaduman discovered that a race condition existed in the pipe buffers implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly escalate privileges. (CVE-2022-2959)

Roger Pau Monné discovered that the Xen paravirtualization frontend in the Linux kernel did not properly initialize memory pages to be used for shared communication with the backend. A local attacker could use this to expose sensitive information (guest kernel memory). (CVE-2022-33740)

It was discovered that the Xen paravirtualization frontend in the Linux kernel incorrectly shared unrelated data when communicating with certain backends. A local attacker could use this to cause a denial of service (guest crash) or expose sensitive information (guest kernel memory). (CVE-2022-33741, CVE-2022-33742)

Jan Beulich discovered that the Xen network device frontend driver in…