CVE-2024-53150

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix out of bounds reads when finding clock sources

The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads.

For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop.

For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix out of bounds reads when finding clock sources

The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads.

For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop.

For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Fix deadlock in SGX NUMA node search When the current node doesn't have an EPC section configured by firmware and all other EPC sections are used up, CPU can get stuck inside the while loop that looks for an available EPC page from remote nodes indefinitely, leading to a soft lockup. Note how nid_of_current will never be equal to nid in that while loop because nid_of_current is not set in sgx_numa_mask. Also worth mentioning is that it's perfectly fine for the firmware not to setup an EPC section on a node. While setting up an EPC section on each node can enhance performance, it is not a requirement for functionality. Rework the loop to start and end on a node that has SGX memory. This avoids the deadlock looking for the current SGX-lacking node to show up in the loop when it never will.(CVE-2024-49856)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix user-after-free from session log off There is racy issue between smb2 session log off and smb2 session setup. It will cause user-after-free from session log off. This add session_lock when setting SMB2_SESSION_EXPIRED and referece count to session struct not to free session while it is being used.(CVE-2024-50086)

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: prevent the risk of a division by zero As reported by Coverity, the logic at tpg_precalculate_line() blindly rescales the buffer even when scaled_witdh is equal to zero. If this ever happens, this will cause a division by zero. Instead, add a WARN_ON_ONCE() to trigger such cases and return without doing any precalculation.(CVE-2024-50287)

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.(CVE-2024-53150)

In the Linux kernel, the following vulnerability has been resolved: ocfs2: free inode when ocfs2_get_init_inode() fails syzbot is reporting busy inodes after unmount, for commit 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") forgot to call iput() when new_inode() succeeded and dquot_initialize() failed.(CVE-2024-56630)

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Fix deadlock in SGX NUMA node search When the current node doesn't have an EPC section configured by firmware and all other EPC sections are used up, CPU can get stuck inside the while loop that looks for an available EPC page from remote nodes indefinitely, leading to a soft lockup. Note how nid_of_current will never be equal to nid in that while loop because nid_of_current is not set in sgx_numa_mask. Also worth mentioning is that it's perfectly fine for the firmware not to setup an EPC section on a node. While setting up an EPC section on each node can enhance performance, it is not a requirement for functionality. Rework the loop to start and end on a node that has SGX memory. This avoids the deadlock looking for the current SGX-lacking node to show up in the loop when it never will.(CVE-2024-49856)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix user-after-free from session log off There is racy issue between smb2 session log off and smb2 session setup. It will cause user-after-free from session log off. This add session_lock when setting SMB2_SESSION_EXPIRED and referece count to session struct not to free session while it is being used.(CVE-2024-50086)

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: prevent the risk of a division by zero As reported by Coverity, the logic at tpg_precalculate_line() blindly rescales the buffer even when scaled_witdh is equal to zero. If this ever happens, this will cause a division by zero. Instead, add a WARN_ON_ONCE() to trigger such cases and return without doing any precalculation.(CVE-2024-50287)

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.(CVE-2024-53150)

In the Linux kernel, the following vulnerability has been resolved: ocfs2: free inode when ocfs2_get_init_inode() fails syzbot is reporting busy inodes after unmount, for commit 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") forgot to call iput() when new_inode() succeeded and dquot_initialize() failed.(CVE-2024-56630)

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: Let probe fail when workqueue cannot be enabled

The workqueue is enabled when the appropriate driver is loaded and disabled when the driver is removed. When the driver is removed it assumes that the workqueue was enabled successfully and proceeds to free allocations made during workqueue enabling.

Failure during workqueue enabling does not prevent the driver from being loaded. This is because the error path within drv_enable_wq() returns success unless a second failure is encountered during the error path. By returning success it is possible to load the driver even if the workqueue cannot be enabled and allocations that do not exist are attempted to be freed during driver remove.

Some examples of problematic flows: (a)

idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq(): In above flow, if idxd_wq_request_irq() fails then idxd_wq_unmap_portal() is called on error exit path, but drv_enable_wq() returns 0 because idxd_wq_disable() succeeds. The driver is thus loaded successfully.

idxd_dmaengine_drv_remove()->drv_disable_wq()->idxd_wq_unmap_portal() Above flow on driver unload triggers the WARN in devm_iounmap() because the device resource has already been removed during error path of drv_enable_wq().

(b)

idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq(): In above flow, if idxd_wq_request_irq() fails then idxd_wq_init_percpu_ref() is never called to initialize the percpu counter, yet the driver loads successfully because drv_enable_wq() returns 0.

idxd_dmaengine_drv_remove()->__idxd_wq_quiesce()->percpu_ref_kill(): Above flow on driver unload triggers a BUG when attempting to drop the initial ref of the uninitialized percpu ref: BUG: kernel NULL pointer dereference, address: 0000000000000010

Fix the drv_enable_wq() error path by returning the original error that indicates failure of workqueue enabling. This ensures that the probe fails when an error is encountered and the driver remove paths are only attempted when the workqueue was enabled successfully.(CVE-2022-48868)

In the Linux kernel, the following vulnerability has been resolved: igb: Initialize mailbox message for VF reset When a MAC address is not assigned to the VF, that portion of the message sent to the VF is not set. The memory, however, is allocated from the stack meaning that information may be leaked to the VM. Initialize the message buffer to 0 so that no information is passed to the VM in this case.(CVE-2022-48949)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix not cleanup led when bt_init fails bt_init() calls bt_leds_init() to register led, but if it fails later, bt_leds_cleanup() is not called to unregister it. This can cause panic if the argument "bluetooth-power" in text is freed and then another led_trigger_register() tries to access it: BUG: unable to handle page fault for address: ffffffffc06d3bc0 RIP: 0010:strcmp+0xc/0x30 Call Trace: <TASK> led_trigger_register+0x10d/0x4f0 led_trigger_register_simple+0x7d/0x100 bt_init+0x39/0xf7 [bluetooth] do_one_initcall+0xd0/0x4e0(CVE-2022-48971)

In the Linux kernel, the following vulnerability has been resolved: net: tun: Fix use-after-free in tun_detach() syzbot reported use-after-free in tun_detach() [1]. This causes call trace like below: ================================================================== BUG: KASAN: use-after-free in notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75 Read of size 8 at addr ffff88807324e2a8 by task syz-executor.0/3673 CPU: 0 PID: 3673 Comm: syz-executor.0 Not tainted 6.1.0-rc5-syzkaller-00044-gcc675d22e422 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.(CVE-2024-53150)

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix uninitialized value in ocfs2_file_read_iter() Syzbot has reported the following KMSAN splat: BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80 ocfs2_file_read_iter+0x9a4/0xf80 __io_read+0x8d4/0x20f0 io_read+0x3e/0xf0 io_issue_sqe+0x42b/0x22c0 io_wq_submit_work+0xaf9/0xdc0 io_worker_handle_work+0xd13/0x2110 io_wq_worker+0x447/0x1410 ret_from_fork+0x6f/0x90 ret_from_fork_asm+0x1a/0x30 Uninit was created at: __alloc_pages_noprof+0x9a7/0xe00 alloc_pages_mpol_noprof+0x299/0x990 alloc_pages_noprof+0x1bf/0x1e0 allocate_slab+0x33a/0x1250 ___slab_alloc+0x12ef/0x35e0 kmem_cache_alloc_bulk_noprof+0x486/0x1330 __io_alloc_req_refill+0x84/0x560 io_submit_sqes+0x172f/0x2f30 __se_sys_io_uring_enter+0x406/0x41c0 __x64_sys_io_uring_enter+0x11f/0x1a0 x64_sys_call+0x2b54/0x3ba0 do_syscall_64+0xcd/0x1e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Since an instance of 'struct kiocb' may be passed from the block layer with 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()' and use it from where 'ocfs2_dio_end_io()' might take care, i.e. in 'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'.(CVE-2024-53155)

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Check the DVFS OPP count returned by the firmware Fix a kernel crash with the below call trace when the SCPI firmware returns OPP count of zero. dvfs_info.opp_count may be zero on some platforms during the reboot test, and the kernel will crash after dereferencing the pointer to kcalloc(info->count, sizeof(*opp), GFP_KERNEL). | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 | Mem abort info: | ESR = 0x96000004 | Exception class = DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | Data abort info: | ISV = 0, ISS = 0x00000004 | CM = 0, WnR = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c | [0000000000000028] pgd=0000000000000000 | Internal error: Oops: 96000004 [#1] SMP | scpi-hwmon: probe of PHYT000D:00 failed with error -110 | Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c) | CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1 | Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS | pstate: 60000005 (nZCv daif -PAN -UAO) | pc : scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi] | lr : clk_register+0x438/0x720 | Call trace: | scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi] | devm_clk_hw_register+0x50/0xa0 | scpi_clk_ops_init.isra.2+0xa0/0x138 [clk_scpi] | scpi_clocks_probe+0x528/0x70c [clk_scpi] | platform_drv_probe+0x58/0xa8 | really_probe+0x260/0x3d0 | driver_probe_device+0x12c/0x148 | device_driver_attach+0x74/0x98 | __driver_attach+0xb4/0xe8 | bus_for_each_dev+0x88/0xe0 | …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new

This patch enhances error handling in scenarios with RTS (Request to Send) messages arriving closely. It replaces the less informative WARN_ON_ONCE backtraces with a new error handling method. This provides clearer error messages and allows for the early termination of problematic sessions. Previously, sessions were only released at the end of j1939_xtp_rx_rts().

Potentially this could be reproduced with something like: testj1939 -r vcan0:0x80 & while true; do # send first RTS cansend vcan0 18EC8090#1014000303002301; # send second RTS cansend vcan0 18EC8090#1014000303002301; # send abort cansend vcan0 18EC8090#ff00000000002301; done(CVE-2023-52887)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()

Extend a critical section to prevent chan from early freeing. Also make the l2cap_connect() return type void. Nothing is using the returned value but it is ugly to return a potentially freed pointer. Making it void will help with backports because earlier kernels did use the return value. Now the compile will break for kernels where this patch is not a complete fix.

Call stack summary:

[use] l2cap_bredr_sig_cmd l2cap_connect ┌ mutex_lock(&conn->chan_lock); │ chan = pchan->ops->new_connection(pchan); <- alloc chan │ __l2cap_chan_add(conn, chan); │ l2cap_chan_hold(chan); │ list_add(&chan->list, &conn->chan_l); ... (1) └ mutex_unlock(&conn->chan_lock); chan->conf_state ... (4) <- use after free

[free] l2cap_conn_del ┌ mutex_lock(&conn->chan_lock); │ foreach chan in conn->chan_l: ... (2) │ l2cap_chan_put(chan); │ l2cap_chan_destroy │ kfree(chan) ... (3) <- chan freed └ mutex_unlock(&conn->chan_lock);

================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0 net/bluetooth/l2cap_core.c:4260 Read of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311(CVE-2024-36013)

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: fix kernel crash when devlink reload during pf initialization

The devlink reload process will access the hardware resources, but the register operation is done before the hardware is initialized. So, processing the devlink reload during initialization may lead to kernel crash. This patch fixes this by taking devl_lock during initialization.(CVE-2024-36021)

In the Linux kernel, the following vulnerability has been resolved:

bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq

Undefined behavior is triggered when bnxt_qplib_alloc_init_hwq is called with hwq_attr->aux_depth != 0 and hwq_attr->aux_stride == 0. In that case, "roundup_pow_of_two(hwq_attr->aux_stride)" gets called. roundup_pow_of_two is documented as undefined for 0.

Fix it in the one caller that had this combination.

The undefined behavior was detected by UBSAN: UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13 shift exponent 64 is too large for 64-bit type 'long unsigned int' CPU: 24 PID: 1075 Comm: (udev-worker) Not tainted 6.9.0-rc6+ #4 Hardware name: Abacus electric, s.r.o. - [email protected] Super Server/H12SSW-iN, BIOS 2.7 10/25/2023 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ubsan_epilogue+0x5/0x30 __ubsan_handle_shift_out_of_bounds.cold+0x61/0xec …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ext4: don't set SB_RDONLY after filesystem errors

When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this misses proper locking (sb->s_umount) and does not go through proper filesystem remount procedure but it has been the way this worked since early ext2 days and it was good enough for catastrophic situation damage mitigation. Recently, syzbot has found a way (see link) to trigger warnings in filesystem freezing because the code got confused by SB_RDONLY changing under its hands. Since these days we set EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all filesystem modifications, modifying SB_RDONLY shouldn't be needed. So stop doing that.(CVE-2024-50191)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/hdcp: Add encoder check in hdcp2_get_capability

Add encoder check in intel_hdcp2_get_capability to avoid null pointer error.(CVE-2024-53050)

In the Linux kernel, the following vulnerability has been resolved:

sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers

When CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, the object_is_on_stack() function may produce incorrect results due to the presence of tags in the obj pointer, while the stack pointer does not have tags. This discrepancy can lead to incorrect stack object detection and subsequently trigger warnings if CONFIG_DEBUG_OBJECTS is also enabled.

Example of the warning:

ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1 at lib/debugobjects.c:557 __debug_object_init+0x330/0x364 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc5 #4 Hardware name: linux,dummy-virt (DT) pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __debug_object_init+0x330/0x364 lr : __debug_object_init+0x330/0x364 sp : ffff800082ea7b40 x29: ffff800082ea7b40 x28: 98ff0000c0164518 x27: 98ff0000c0164534 x26: ffff800082d93ec8 x25: 0000000000000001 x24: 1cff0000c00172a0 x23: 0000000000000000 x22: ffff800082d93ed0 x21: ffff800081a24418 x20: 3eff800082ea7bb0 x19: efff800000000000 x18: 0000000000000000 x17: 00000000000000ff x16: 0000000000000047 x15: 206b63617473206e x14: 0000000000000018 x13: ffff800082ea7780 x12: 0ffff800082ea78e x11: 0ffff800082ea790 x10: 0ffff800082ea79d x9 : 34d77febe173e800 x8 : 34d77febe173e800 x7 : 0000000000000001 x6 : 0000000000000001 x5 : feff800082ea74b8 x4 : ffff800082870a90 x3 : ffff80008018d3c4 x2 : 0000000000000001 x1 : ffff800082858810 x0 : 0000000000000050 Call trace: __debug_object_init+0x330/0x364 debug_object_init_on_stack+0x30/0x3c schedule_hrtimeout_range_clock+0xac/0x26c schedule_hrtimeout+0x1c/0x30 wait_task_inactive+0x1d4/0x25c kthread_bind_mask+0x28/0x98 init_rescuer+0x1e8/0x280 workqueue_init+0x1a0/0x3cc kernel_init_freeable+0x118/0x200 kernel_init+0x28/0x1f0 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------(CVE-2024-53128)

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix out of bounds reads when finding clock sources

The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads.

For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop.

For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof()…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466) (CVE-2024-53241)

• kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock sources (CVE-2024-53150)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466) (CVE-2024-53241)

• kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock sources (CVE-2024-53150)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466) (CVE-2024-53241)
• kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock sources (CVE-2024-53150)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466) (CVE-2024-53241)
• kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock sources (CVE-2024-53150)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock sources (CVE-2024-53150)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In validate_clock_selector of clock.c, there is a possible out of bounds read due to memory corruption. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

• xsk: fix OOB map writes when deleting elements {CVE-2024-56614}
• hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer {CVE-2024-53103}
• scsi: sg: Fix slab-use-after-free read in sg_release() {CVE-2024-56631}
• net: inet: do not leave a dangling sk pointer in inet_create() {CVE-2024-56601}
• initramfs: avoid filename buffer overrun {CVE-2024-53142}
• wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() {CVE-2024-53156}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() {CVE-2024-56604}
• Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() {CVE-2024-56605}
• af_packet: avoid erroring out after sock_init_data() in packet_create() {CVE-2024-56606}
• af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET {CVE-2024-56606}
• scsi: bfa: Fix use-after-free in bfad_im_module_exit() {CVE-2024-53227}
• net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() {CVE-2024-56602}
• net: inet6: do not leave a dangling sk pointer in inet6_create() {CVE-2024-56600}
• NFSv4.0: Fix a use-after-free problem in the asynchronous open() {CVE-2024-53173}
• net: af_can: do not leave a dangling sk pointer in can_create() {CVE-2024-56603}
• ceph: prevent use-after-free in encode_cap_msg() {CVE-2024-26689}
• drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' {CVE-2024-56608}
• netfilter: ipset: add missing range check in bitmap_ip_uadt {CVE-2024-53141}
• tipc: Fix use-after-free of kernel socket in cleanup_bearer(). {CVE-2024-27043}
• smb: client: fix potential UAF in cifs_stats_proc_write() {CVE-2024-35868}
• smb: client: fix potential UAF in cifs_stats_proc_show() {CVE-2024-35867}
• smb: client: fix potential UAF in smb2_is_valid_lease_break() {CVE-2024-35864}
• smb: client: fix potential UAF in smb2_is_valid_oplock_break() {CVE-2024-35863}
• smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() {CVE-2024-35861}
• smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
• smb: client: fix potential UAF in cifs_debug_files_proc_show() {CVE-2024-26928}

• smb: client: fix use-after-free of signing key {CVE-2024-53179}
• smb: client: stop flooding dmesg in smb2_calc_signature() {CVE-2024-53179}
• smb3: fix oops in calculating shash_setkey {CVE-2024-53179}
• cifs: return correct error in ->calc_signature() {CVE-2024-53179}
• cifs: secmech: use shash_desc directly, remove sdesc {CVE-2024-53179}
• cifs: replace kfree() with kfree_sensitive() for sensitive data {CVE-2024-53179}
• xsk: fix OOB map writes when deleting elements {CVE-2024-56614}
• hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer {CVE-2024-53103}
• scsi: sg: Fix slab-use-after-free read in sg_release() {CVE-2024-56631}
• EDAC/igen6: Avoid segmentation fault on module unload {CVE-2024-56708}
• acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl {CVE-2024-56662}
• net: inet: do not leave a dangling sk pointer in inet_create() {CVE-2024-56601}
• initramfs: avoid filename buffer overrun {CVE-2024-53142}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() {CVE-2024-56604}
• wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() {CVE-2024-53156}
• Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() {CVE-2024-56605}
• Bluetooth: msft: fix slab-use-after-free in msft_do_close() {CVE-2024-36012}
• Bluetooth: Fix support for Read Local Supported Codecs V2 {CVE-2024-36012}
• Bluetooth: hci_codec: Fix leaking content of local_codecs {CVE-2024-36012}
• blk-cgroup: Fix UAF in blkcg_unpin_online() {CVE-2024-56672}
• net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() {CVE-2024-56602}
• net: inet6: do not leave a dangling sk pointer in inet6_create() {CVE-2024-56600}
• NFSv4.0: Fix a use-after-free problem in the asynchronous open() {CVE-2024-53173}
• net: af_can: do not leave a dangling sk pointer in can_create() {CVE-2024-56603}
• drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 {CVE-2023-52818}
• bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
• ceph: prevent use-after-free in encode_cap_msg() {CVE-2024-26689}
• drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' {CVE-2024-56608}
• netfilter: ipset: add missing range check in bitmap_ip_uadt {CVE-2024-53141}
• HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit {CVE-2023-52519}
• tipc: Fix use-after-free of kernel socket in cleanup_bearer(). {CVE-2024-56642}
• cifs: Fix buffer overflow when parsing NFS reparse points {CVE-2024-49996}
• Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
• PM / devfreq: Fix buffer overflow in trans_stat_show {CVE-2023-52614}
• PM / devfreq: Rework freq_table to be local to devfreq struct {CVE-2023-52614}
• cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() {CVE-2024-41057}
• cachefiles: fix slab-use-after-free in fscache_withdraw_volume() {CVE-2024-41058}
• [ELSCVE-37480] netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume() {CVE-2024-41058}
• memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
• Bluetooth: ISO: Fix UAF on iso_sock_timeout {CVE-2024-50124}
• Bluetooth: SCO: Fix UAF on sco_sock_timeout {CVE-2024-50125}
• Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout {CVE-2024-50125}
• Bluetooth: Consolidate code around sk_alloc into a helper function {CVE-2024-50125}
• smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() {CVE-2024-35861}
• gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() {CVE-2024-26754}
• smb: client: fix potential UAF in cifs_stats_proc_write() {CVE-2024-35868}
• smb: client: fix potential UAF in cifs_debug_files_proc_show() {CVE-2024-35868}
• vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans {CVE-2024-50264}
• net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT {CVE-2024-53057}
• wifi:…

• NFSv4.0: Fix a use-after-free problem in the asynchronous open() {CVE-2024-53173}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• misc/libmasm/module: Fix two use after free in ibmasm_init_one {CVE-2021-47334}

• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() {CVE-2024-57798}
• els15 crashes accessing CephFS storage from a cluster {CVE-2024-26689}

• NFSv4.0: Fix a use-after-free problem in the asynchronous open() {CVE-2024-53173}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• misc/libmasm/module: Fix two use after free in ibmasm_init_one {CVE-2021-47334}

• sctp: sysctl: auth_enable: avoid using current->nsproxy
• sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy {CVE-2025-21640}
• bpf: Use preempt_count() directly in bpf_send_signal_common()
• Revert "sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy"
• jfs: fix slab-out-of-bounds read in ea_get()
• serial: 8250_dma: terminate correct DMA in tx_dma_flush()
• Revert "sctp: sysctl: auth_enable: avoid using current->nsproxy"
• net: usb: usbnet: restore usb%d name exception for local mac addresses
• vlan: fix memory leak in vlan_newlink() {CVE-2022-49636}
• rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity
• LTS tag: v5.4.291
• eeprom: digsy_mtc: Make GPIO lookup table match the device
• slimbus: messaging: Free transaction ID in delayed interrupt scenario {CVE-2025-21914}
• intel_th: pci: Add Panther Lake-P/U support
• intel_th: pci: Add Panther Lake-H support
• intel_th: pci: Add Arrow Lake support
• Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
• xhci: pci: Fix indentation in the PCI device ID definitions
• usb: gadget: Check bmAttributes only if configuration is valid
• usb: gadget: Fix setting self-powered state on suspend
• usb: gadget: Set self-powered based on MaxPower and bmAttributes
• usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality
• usb: typec: ucsi: increase timeout for PPM reset operations
• usb: atm: cxacru: fix a flaw in existing endpoint checks {CVE-2025-21916}
• usb: renesas_usbhs: Flush the notify_hotplug_work {CVE-2025-21917}
• usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader
• usb: renesas_usbhs: Use devm_usb_get_phy()
• usb: renesas_usbhs: Call clk_put()
• Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"
• gpio: rcar: Fix missing of_node_put() call
• net: ipv6: fix missing dst ref drop in ila lwtunnel
• net: ipv6: fix dst ref loop in ila lwtunnel
• net-timestamp: support TCP GSO case for a few missing flags
• vlan: enforce underlying device type {CVE-2025-21920}
• ppp: Fix KMSAN uninit-value warning with bpf {CVE-2025-21922}
• be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
• drm/sched: Fix preprocessor guard
• hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()
• llc: do not use skb_get() before dev_queue_xmit() {CVE-2025-21925}
• hwmon: (ad7314) Validate leading zero bits and return error
• hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
• hwmon: (pmbus) Initialise page count in pmbus_identify()
• caif_virtio: fix wrong pointer check in cfv_probe() {CVE-2025-21904}
• net: gso: fix ownership in __udp_gso_segment {CVE-2025-21926}
• HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
• HID: google: fix unused variable warning under !CONFIG_ACPI
• wifi: iwlwifi: limit printed string from FW file {CVE-2025-21905}
• mm/page_alloc: fix uninitialized variable
• rapidio: fix an API misues when rio_add_net() fails {CVE-2025-21934}
• rapidio: add check for rio_add_net() in rio_scan_alloc_net()
• wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
• wifi: cfg80211: regulatory: improve invalid hints checking {CVE-2025-21910}
• x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
• x86/cpu: Validate CPUID leaf 0x2 EDX output
• x86/cacheinfo: Validate CPUID leaf 0x2 EDX output
• platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
• drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
• ALSA: hda/realtek: update ALC222 depop optimize
• ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
• HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
• Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'"
• drm/amdgpu: disable BAR resize on Dell G5 SE
• drm/amdgpu: Check extended configuration space register when system uses large bar
• drm/amdgpu: skip BAR resizing if the bios already…

• inet: fully convert sk->sk_rx_dst to RCU rules {CVE-2021-47103}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• can: peak_usb: fix use after free bugs {CVE-2021-47670}
• wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}
• RDMA/rxe: Fix error unwind in rxe_create_qp() {CVE-2022-50127}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
• udp: Fix memory accounting leak. {CVE-2025-22058}
• ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50083}
• ext4: correct the misjudgment in ext4_iget_extra_inode {CVE-2022-50083}
• ext4: correct max_inline_xattr_value_size computing {CVE-2022-50083}
• ext4: fix use-after-free in ext4_xattr_set_entry {CVE-2022-50083}
• ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h {CVE-2022-50083}
• Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
• net_sched: ets: Fix double list add in class with netem as child qdisc {CVE-2025-38085}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• padata: fix UAF in padata_reorder {CVE-2025-21727}
• net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
• codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-38177}
• sch_ets: make est_qlen_notify() idempotent {CVE-2025-38177}
• sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38177}
• sch_htb: make htb_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• mptcp: do not queue data on closed subflows {CVE-2022-50070}
• mptcp: export mptcp_subflow_active {CVE-2022-50070}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
• tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
• RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273}
• ice: xsk: prohibit usage of non-balanced queue id {CVE-2022-50003}
• net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052}
• virtio-gpu: fix a missing check to avoid NULL dereference {CVE-2022-50181}
• usb: xhci_plat_remove: avoid NULL dereference {CVE-2022-50133}
• ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot {CVE-2022-50015}
• netfilter: nft_tproxy: restrict to prerouting hook {CVE-2022-50001}
• scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq {CVE-2022-49986}
• ath11k: fix netdev open race {CVE-2022-50187}

• inet: fully convert sk->sk_rx_dst to RCU rules {CVE-2021-47103}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• can: peak_usb: fix use after free bugs {CVE-2021-47670}
• wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}
• RDMA/rxe: Fix error unwind in rxe_create_qp() {CVE-2022-50127}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
• udp: Fix memory accounting leak. {CVE-2025-22058}
• ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50083}
• ext4: correct the misjudgment in ext4_iget_extra_inode {CVE-2022-50083}
• ext4: correct max_inline_xattr_value_size computing {CVE-2022-50083}
• ext4: fix use-after-free in ext4_xattr_set_entry {CVE-2022-50083}
• ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h {CVE-2022-50083}
• Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
• net_sched: ets: Fix double list add in class with netem as child qdisc {CVE-2025-38085}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• padata: fix UAF in padata_reorder {CVE-2025-21727}
• net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
• codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-38177}
• sch_ets: make est_qlen_notify() idempotent {CVE-2025-38177}
• sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38177}
• sch_htb: make htb_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• mptcp: do not queue data on closed subflows {CVE-2022-50070}
• mptcp: export mptcp_subflow_active {CVE-2022-50070}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
• tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
• RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890}
• net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273}
• ice: xsk: prohibit usage of non-balanced queue id {CVE-2022-50003}
• net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052}
• virtio-gpu: fix a missing check to avoid NULL dereference {CVE-2022-50181}
• usb: xhci_plat_remove: avoid NULL dereference {CVE-2022-50133}
• ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot {CVE-2022-50015}
• netfilter: nft_tproxy: restrict to prerouting hook {CVE-2022-50001}
• scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq {CVE-2022-49986}
• ath11k: fix netdev open race {CVE-2022-50187}

• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF {CVE-2023-0266}
• net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• kabi: add tcp_v4_syn_recv_sock to the x86_64 kABI whitelist {CVE-2026-43198}
• Update to kernel 3.10.0-1160.164.1.el7
• netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
• netfilter: expect: fix crash when putting uninited expectation {CVE-2026-43116}
• netfilter: nf_ct_expect: Add nf_ct_remove_expect() {CVE-2026-43116}
• Revert "netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}"
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• sctp: prevent peer transport count overflow {CVE-2026-74469}
• xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
• i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• i2c: stub: Avoid an array overrun on I2C block transfers {CVE-2026-64191}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• USB: serial: io_ti: fix heap overflow in get_manuf_info() {CVE-2026-53196}
• netfilter: nft_rbtree: ignore inactive matching element with no descendants
• netfilter: nft_rbtree: introduce nft_rbtree_interval_end() helper
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• netfilter: conntrack: check netns when walking expect hash
• netfilter: nf_tables: don't skip expired elements during walk {CVE-2023-52924}
• net: atm: fix crash due to unvalidated vcc pointer in sigd_send() {CVE-2026-31411}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059}
• ipc: limit next_id allocation to the valid ID range {CVE-2026-52923}
• macsec: don't read an unset MAC header in macsec_encrypt() {CVE-2026-72019}
• dm-ioctl: fix a possible overflow in list_version_get_info {CVE-2026-72106}
• drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() {CVE-2026-68111}
• drm/amdgpu: fix division by zero with invalid uvd dimensions {CVE-2026-68106}
• driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
• net: tun: bound receive headroom {CVE-2026-81000}
• cpufreq: pcc: fix use-after-free and double free in _OSC evaluation {CVE-2026-64372}
• wifi: rt2x00: avoid full teardown before work setup in probe {CVE-2026-72005}
• ipvs: reset full ip_vs_seq structs in ip_vs_conn_new {CVE-2026-72020}
• scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE {CVE-2026-72083}
• bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() {CVE-2026-72039}
• net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked {CVE-2026-72036}
• vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets {CVE-2026-68299}
• drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved {CVE-2026-68234}
• tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175}
• media: pci: dm1105: Free allocated workqueue {CVE-2026-68218}
• IB/mad: Drop unmatched RMPP responses before reassembly {CVE-2026-68425}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
• bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• tcp: keep kABI of tcp_v4_syn_recv_sock() for the CVE-2026-43198 fix
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006}

• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF {CVE-2023-0266}
• net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• kabi: add tcp_v4_syn_recv_sock to the x86_64 kABI whitelist {CVE-2026-43198}
• Update to kernel 3.10.0-1160.164.1.el7
• netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
• netfilter: expect: fix crash when putting uninited expectation {CVE-2026-43116}
• netfilter: nf_ct_expect: Add nf_ct_remove_expect() {CVE-2026-43116}
• Revert "netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}"
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• sctp: prevent peer transport count overflow {CVE-2026-74469}
• xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
• i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• i2c: stub: Avoid an array overrun on I2C block transfers {CVE-2026-64191}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• USB: serial: io_ti: fix heap overflow in get_manuf_info() {CVE-2026-53196}
• netfilter: nft_rbtree: ignore inactive matching element with no descendants
• netfilter: nft_rbtree: introduce nft_rbtree_interval_end() helper
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• netfilter: conntrack: check netns when walking expect hash
• netfilter: nf_tables: don't skip expired elements during walk {CVE-2023-52924}
• net: atm: fix crash due to unvalidated vcc pointer in sigd_send() {CVE-2026-31411}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059}
• ipc: limit next_id allocation to the valid ID range {CVE-2026-52923}
• macsec: don't read an unset MAC header in macsec_encrypt() {CVE-2026-72019}
• dm-ioctl: fix a possible overflow in list_version_get_info {CVE-2026-72106}
• drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() {CVE-2026-68111}
• drm/amdgpu: fix division by zero with invalid uvd dimensions {CVE-2026-68106}
• driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
• net: tun: bound receive headroom {CVE-2026-81000}
• cpufreq: pcc: fix use-after-free and double free in _OSC evaluation {CVE-2026-64372}
• wifi: rt2x00: avoid full teardown before work setup in probe {CVE-2026-72005}
• ipvs: reset full ip_vs_seq structs in ip_vs_conn_new {CVE-2026-72020}
• scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE {CVE-2026-72083}
• bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() {CVE-2026-72039}
• net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked {CVE-2026-72036}
• vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets {CVE-2026-68299}
• drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved {CVE-2026-68234}
• tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175}
• media: pci: dm1105: Free allocated workqueue {CVE-2026-68218}
• IB/mad: Drop unmatched RMPP responses before reassembly {CVE-2026-68425}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
• bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• tcp: keep kABI of tcp_v4_syn_recv_sock() for the CVE-2026-43198 fix
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006}

• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF {CVE-2023-0266}
• net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• kabi: add tcp_v4_syn_recv_sock to the x86_64 kABI whitelist {CVE-2026-43198}
• Update to kernel 3.10.0-1160.164.1.el7
• netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
• netfilter: expect: fix crash when putting uninited expectation {CVE-2026-43116}
• netfilter: nf_ct_expect: Add nf_ct_remove_expect() {CVE-2026-43116}
• Revert "netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}"
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• sctp: prevent peer transport count overflow {CVE-2026-74469}
• xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
• i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• i2c: stub: Avoid an array overrun on I2C block transfers {CVE-2026-64191}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• USB: serial: io_ti: fix heap overflow in get_manuf_info() {CVE-2026-53196}
• netfilter: nft_rbtree: ignore inactive matching element with no descendants
• netfilter: nft_rbtree: introduce nft_rbtree_interval_end() helper
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• netfilter: conntrack: check netns when walking expect hash
• netfilter: nf_tables: don't skip expired elements during walk {CVE-2023-52924}
• net: atm: fix crash due to unvalidated vcc pointer in sigd_send() {CVE-2026-31411}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059}
• ipc: limit next_id allocation to the valid ID range {CVE-2026-52923}
• macsec: don't read an unset MAC header in macsec_encrypt() {CVE-2026-72019}
• dm-ioctl: fix a possible overflow in list_version_get_info {CVE-2026-72106}
• drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() {CVE-2026-68111}
• drm/amdgpu: fix division by zero with invalid uvd dimensions {CVE-2026-68106}
• driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
• net: tun: bound receive headroom {CVE-2026-81000}
• cpufreq: pcc: fix use-after-free and double free in _OSC evaluation {CVE-2026-64372}
• wifi: rt2x00: avoid full teardown before work setup in probe {CVE-2026-72005}
• ipvs: reset full ip_vs_seq structs in ip_vs_conn_new {CVE-2026-72020}
• scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE {CVE-2026-72083}
• bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() {CVE-2026-72039}
• net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked {CVE-2026-72036}
• vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets {CVE-2026-68299}
• drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved {CVE-2026-68234}
• tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175}
• media: pci: dm1105: Free allocated workqueue {CVE-2026-68218}
• IB/mad: Drop unmatched RMPP responses before reassembly {CVE-2026-68425}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
• bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• tcp: keep kABI of tcp_v4_syn_recv_sock() for the CVE-2026-43198 fix
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006}

• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}

• Bump kernel ABI to 31: ship the ELS kernel as 4.19.0-31-*, distinct from the prior 4.19.0-30.
• CVE-2024-53150
  • ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• CVE-2026-43284
  • xfrm: esp: avoid in-place decrypt on shared skb frags {CVE-2026-43284}
• CVE-2026-43503
  • net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• CVE-2026-46113
  • KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113}
• CVE-2026-46300
  • net: skbuff: preserve shared-frag marker during coalescing {CVE-2026-46300}
• CVE-2026-46331
  • net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
• CVE-2026-74480
  • net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• CVE-2026-74581
  • net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• CVE-2026-80714
  • ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
• Miscellaneous upstream changes
  • net: skbuff: propagate shared-frag marker in skb_zerocopy()