CVE-2022-43945

The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)

• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• DELL EMC: System is not booting into RT Kernel with perc12 [kernel-rt] (BZ#2139863)

• kernel-rt: update RT source tree to the latest Rocky Linux-9.1.z1 Batch (BZ#2141817)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)

• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel 9.2: Important iavf bug fixes (BZ#2127884)

• vfio zero page mappings fail after 2M instances (BZ#2128514)

• nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359)

• ice: Driver Update to 5.19 (BZ#2132070)

• WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588)

• drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619)

• updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914)

• DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213)

• No signal showed in the VGA monitor when installing Rocky Linux9 in the legacy bios mode (BZ#2140153)

• Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142168)

• ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976)

• fatal error: error in backend: Branch target out of insn range (BZ#2144902)

• AMdCLIENT: The kernel command line parameter "nomodeset" not working properly (BZ#2145217)

• Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910)

• Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2151605)

• DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress (BZ#2154407)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: mm/mremap.c use-after-free vulnerability (CVE-2022-41222)

• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

• kernel: an out-of-bounds vulnerability in i2c-ismt driver (CVE-2022-2873)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134586)

• Hardware error: RIP: copy_user_enhanced_fast_string+0xe (BZ#2137592)

• Cannot trigger kernel dump using NMI on SNO node running PAO and RT kernel (BZ#2139580)

• MEI support for Alder Lake-S (BZ#2141783)

• Host Pod -> Cluster IP Service traffic (Pod Backend - Different Node) Flow Iperf Cannot Connect (BZ#2141959)

• Rocky Linux8.7: Xorg cannot display resolution higher than 1024x768 on system using ast graphics driver (BZ#2149287)

• Intel 8.7 Bug: OS doesn't boot when vmd and interrupt remapping are enabled (BZ#2149474)

• i40e,iavf: SR-IOV VF devices send GARP with wrong MAC address (BZ#2149745)

• Rocky Linux8.4 - boot: Add secure boot trailer (BZ#2151530)

• error 524 from seccomp(2) when trying to load filter (BZ#2152138)

• Workqueue: WQ_MEM_RECLAIM iscsi_ctrl_1:98 __iscsi_unbind_session [scsi_transport_iscsi] (BZ#2152734)

• Connectivity issue with vDPA driver (BZ#2152912)

• High Load average due to cfs cpu throttling (BZ#2153108)

• The "kernel BUG at mm/usercopy.c:103!" from BZ 2041529 is back on rhel-8.5 (BZ#2153230)

• Rocky Linux8: tick storm on nohz (isolated) CPU cores (BZ#2153653)

• kernel BUG: scheduling while atomic: crio/7295/0x00000002 (BZ#2154460)

• Azure Rocky Linux 8 z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2155272)

• Azure: VM Deployment Failures Patch Request (BZ#2155280)

• Azure vPCI Rocky Linux-8: add the support of multi-MSI (BZ#2155289)

• MSFT MANA NET Patch Rocky Linux-8: Fix race on per-CQ variable napi_iperf panic fix (BZ#2155437)

• GSS: OCP 4.10.30 node crash after ODF upgrade : unable to handle kernel NULL pointer dereference at 0000000000000000 : ceph_get_snap_realm+0x68/0xa0 [ceph] (BZ#2155797)

• Error in /usr/src/kernels/4.18.0-423.el8.x86_64/scripts/kernel-doc script causing irdma build to fail (BZ#2157905)

• Rocky Linux8.8: Backport upstream patches to reduce memory cgroup memory consumption and OOM problem (BZ#2157922)

• The 'date' command shows wrong time in nested KVM s390x guest (BZ#2158813)

• ethtool -m results in an out-of-bounds slab write in the be2net driver (BZ#2160182)

• (Redhat OpenShift)Error downloading big ZIP files inside pod on power OCP and pod getting restarted (BZ#2160221)

• i40e/iavf: VF reset task fails "Never saw reset" with 5 second timeout per VF (BZ#2160460)

• iavf: It takes long time to create multiple VF interfaces and the VF interface names are not consistent (BZ#2163257)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: mm/mremap.c use-after-free vulnerability (CVE-2022-41222)

• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

• kernel: an out-of-bounds vulnerability in i2c-ismt driver (CVE-2022-2873)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Rocky Linux8-RT: Backport use of a dedicate thread for timer wakeups (BZ#2127204)

• SNO Crashed twice - kernel BUG at lib/list_debug.c:28 (BZ#2132062)

• Cannot trigger kernel dump using NMI on SNO node running PAO and RT kernel [RT-8] (BZ#2139851)

• scheduling while atomic in fpu_clone() -> fpu_inherit_perms() (BZ#2154469)

• The latest Rocky Linux 8.7.z2 kernel changes need to be merged into the RT source tree to keep source parity between the two kernels. (BZ#2159806)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)

• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel 9.2: Important iavf bug fixes (BZ#2127884)

• vfio zero page mappings fail after 2M instances (BZ#2128514)

• nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359)

• ice: Driver Update to 5.19 (BZ#2132070)

• WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588)

• drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619)

• updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914)

• DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213)

• No signal showed in the VGA monitor when installing Rocky Linux SIG Cloud9 in the legacy bios mode (BZ#2140153)

• Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142168)

• ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976)

• fatal error: error in backend: Branch target out of insn range (BZ#2144902)

• AMdCLIENT: The kernel command line parameter "nomodeset" not working properly (BZ#2145217)

• Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910)

• Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2151605)

• DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress (BZ#2154407)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: mm/mremap.c use-after-free vulnerability (CVE-2022-41222)

• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

• kernel: an out-of-bounds vulnerability in i2c-ismt driver (CVE-2022-2873)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134586)

• Hardware error: RIP: copy_user_enhanced_fast_string+0xe (BZ#2137592)

• Cannot trigger kernel dump using NMI on SNO node running PAO and RT kernel (BZ#2139580)

• MEI support for Alder Lake-S (BZ#2141783)

• Host Pod -> Cluster IP Service traffic (Pod Backend - Different Node) Flow Iperf Cannot Connect (BZ#2141959)

• Rocky Linux SIG Cloud8.7: Xorg cannot display resolution higher than 1024x768 on system using ast graphics driver (BZ#2149287)

• Intel 8.7 Bug: OS doesn't boot when vmd and interrupt remapping are enabled (BZ#2149474)

• i40e,iavf: SR-IOV VF devices send GARP with wrong MAC address (BZ#2149745)

• Rocky Linux SIG Cloud8.4 - boot: Add secure boot trailer (BZ#2151530)

• error 524 from seccomp(2) when trying to load filter (BZ#2152138)

• Workqueue: WQ_MEM_RECLAIM iscsi_ctrl_1:98 __iscsi_unbind_session [scsi_transport_iscsi] (BZ#2152734)

• Connectivity issue with vDPA driver (BZ#2152912)

• High Load average due to cfs cpu throttling (BZ#2153108)

• The "kernel BUG at mm/usercopy.c:103!" from BZ 2041529 is back on rhel-8.5 (BZ#2153230)

• Rocky Linux SIG Cloud8: tick storm on nohz (isolated) CPU cores (BZ#2153653)

• kernel BUG: scheduling while atomic: crio/7295/0x00000002 (BZ#2154460)

• Azure Rocky Linux SIG Cloud 8 z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2155272)

• Azure: VM Deployment Failures Patch Request (BZ#2155280)

• Azure vPCI Rocky Linux SIG Cloud-8: add the support of multi-MSI (BZ#2155289)

• MSFT MANA NET Patch Rocky Linux SIG Cloud-8: Fix race on per-CQ variable napi_iperf panic fix (BZ#2155437)

• GSS: OCP 4.10.30 node crash after ODF upgrade : unable to handle kernel NULL pointer dereference at 0000000000000000 : ceph_get_snap_realm+0x68/0xa0 [ceph] (BZ#2155797)

• Error in /usr/src/kernels/4.18.0-423.el8.x86_64/scripts/kernel-doc script causing irdma build to fail (BZ#2157905)

• Rocky Linux SIG Cloud8.8: Backport upstream patches to reduce memory cgroup memory consumption and OOM problem (BZ#2157922)

• The 'date' command shows wrong time in nested KVM s390x guest (BZ#2158813)

• ethtool -m results in an out-of-bounds slab write in the be2net driver (BZ#2160182)

• (Redhat OpenShift)Error downloading big ZIP files inside pod on power OCP and pod getting restarted (BZ#2160221)

• i40e/iavf: VF reset task fails "Never saw reset" with 5 second timeout per VF (BZ#2160460)

• iavf: It takes long time to create multiple VF interfaces and the VF interface names are not consistent (BZ#2163257)

The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)
• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)
• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)
• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)
• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)
• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• DELL EMC: System is not booting into RT Kernel with perc12 [kernel-rt] (BZ#2139863)
• kernel-rt: update RT source tree to the latest AlmaLinux-9.1.z1 Batch (BZ#2141817)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)
• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)
• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)
• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)
• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)
• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel 9.2: Important iavf bug fixes (BZ#2127884)
• vfio zero page mappings fail after 2M instances (BZ#2128514)
• nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359)
• ice: Driver Update to 5.19 (BZ#2132070)
• WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588)
• drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619)
• updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914)
• DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213)
• No signal showed in the VGA monitor when installing AlmaLinux9 in the legacy bios mode (BZ#2140153)
• Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142168)
• ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976)
• fatal error: error in backend: Branch target out of insn range (BZ#2144902)
• AMdCLIENT: The kernel command line parameter "nomodeset" not working properly (BZ#2145217)
• Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910)
• Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2151605)
• DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress (BZ#2154407)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: mm/mremap.c use-after-free vulnerability (CVE-2022-41222)
• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)
• kernel: an out-of-bounds vulnerability in i2c-ismt driver (CVE-2022-2873)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134586)
• Hardware error: RIP: copy_user_enhanced_fast_string+0xe (BZ#2137592)
• Cannot trigger kernel dump using NMI on SNO node running PAO and RT kernel (BZ#2139580)
• MEI support for Alder Lake-S (BZ#2141783)
• Host Pod -> Cluster IP Service traffic (Pod Backend - Different Node) Flow Iperf Cannot Connect (BZ#2141959)
• AlmaLinux8.7: Xorg cannot display resolution higher than 1024x768 on system using ast graphics driver (BZ#2149287)
• Intel 8.7 Bug: OS doesn't boot when vmd and interrupt remapping are enabled (BZ#2149474)
• i40e,iavf: SR-IOV VF devices send GARP with wrong MAC address (BZ#2149745)
• AlmaLinux8.4 - boot: Add secure boot trailer (BZ#2151530)
• error 524 from seccomp(2) when trying to load filter (BZ#2152138)
• Workqueue: WQ_MEM_RECLAIM iscsi_ctrl_1:98 __iscsi_unbind_session [scsi_transport_iscsi] (BZ#2152734)
• Connectivity issue with vDPA driver (BZ#2152912)
• High Load average due to cfs cpu throttling (BZ#2153108)
• The "kernel BUG at mm/usercopy.c:103!" from BZ 2041529 is back on almalinux-8.5 (BZ#2153230)
• AlmaLinux8: tick storm on nohz (isolated) CPU cores (BZ#2153653)
• kernel BUG: scheduling while atomic: crio/7295/0x00000002 (BZ#2154460)
• Azure AlmaLinux 8 z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2155272)
• Azure: VM Deployment Failures Patch Request (BZ#2155280)
• Azure vPCI AlmaLinux-8: add the support of multi-MSI (BZ#2155289)
• MSFT MANA NET Patch AlmaLinux-8: Fix race on per-CQ variable napi_iperf panic fix (BZ#2155437)
• GSS: OCP 4.10.30 node crash after ODF upgrade : unable to handle kernel NULL pointer dereference at 0000000000000000 : ceph_get_snap_realm+0x68/0xa0 [ceph] (BZ#2155797)
• Error in /usr/src/kernels/4.18.0-423.el8.x86_64/scripts/kernel-doc script causing irdma build to fail (BZ#2157905)
• AlmaLinux8.8: Backport upstream patches to reduce memory cgroup memory consumption and OOM problem (BZ#2157922)
• The 'date' command shows wrong time in nested KVM s390x guest (BZ#2158813)
• ethtool -m results in an out-of-bounds slab write in the be2net driver (BZ#2160182)
• (AlmaLinux OpenShift)Error downloading big ZIP files inside pod on power OCP and pod getting restarted (BZ#2160221)
• i40e/iavf: VF reset task fails "Never saw reset" with 5 second timeout per VF (BZ#2160460)
• iavf: It takes long time to create multiple VF interfaces and the VF interface names are not consistent (BZ#2163257)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: mm/mremap.c use-after-free vulnerability (CVE-2022-41222)
• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)
• kernel: an out-of-bounds vulnerability in i2c-ismt driver (CVE-2022-2873)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• AlmaLinux8-RT: Backport use of a dedicate thread for timer wakeups (BZ#2127204)
• SNO Crashed twice - kernel BUG at lib/list_debug.c:28 (BZ#2132062)
• Cannot trigger kernel dump using NMI on SNO node running PAO and RT kernel [RT-8] (BZ#2139851)
• scheduling while atomic in fpu_clone() -> fpu_inherit_perms() (BZ#2154469)
• The latest AlmaLinux 8.7.z2 kernel changes need to be merged into the RT source tree to keep source parity between the two kernels. (BZ#2159806)

• netfilter: nft_set_pipapo: fix improper element removal {CVE-2023-4004}
• net: tun: fix bugs for oversize packet when napi frags enabled {CVE-2023-3812}
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
• net/sched: sch_qfq: account for stab overhead in qfq_enqueue {CVE-2023-3611}
• net/sched: sch_qfq: refactor parsing of netlink parameters
• ipvlan:Fix out-of-bounds caused by unclear skb->cb {CVE-2023-3090}
• media: saa7134: fix use after free bug in saa7134_finidev due to race condition {CVE-2023-35823}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• memstick: r592: Fix UAF bug in r592_remove due to race condition {CVE-2023-3141}
• ovl: fix use after free in struct ovl_aio_req {CVE-2023-1252}
• xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-23042}
• xen/netfront: don't trust the backend response data blindly
• xen/netfront: disentangle tx_skb_freelist
• xen: sync include/xen/interface/io/ring.h with Xen's newest version
• net/sched: flower: fix possible OOB write in fl_set_geneve_opt() {CVE-2023-35788}
• rds: rds_rm_zerocopy_callback() use list_first_entry() {CVE-2023-1078}
• misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424}
• NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• NFSD: Protect against send buffer overflow in NFSv3 READ {CVE-2022-43945}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
• SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation {CVE-2022-43945}
• mm/mremap: hold the rmap lock in write mode when moving page table entries. {CVE-2022-39189}
• KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() {CVE-2023-28466}
• tee: handle lookup of shm with reference count 0 {CVE-2021-44733}

• netfilter: nft_set_pipapo: fix improper element removal {CVE-2023-4004}
• net: tun: fix bugs for oversize packet when napi frags enabled {CVE-2023-3812}
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
• net/sched: sch_qfq: account for stab overhead in qfq_enqueue {CVE-2023-3611}
• net/sched: sch_qfq: refactor parsing of netlink parameters
• ipvlan:Fix out-of-bounds caused by unclear skb->cb {CVE-2023-3090}
• media: saa7134: fix use after free bug in saa7134_finidev due to race condition {CVE-2023-35823}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• memstick: r592: Fix UAF bug in r592_remove due to race condition {CVE-2023-3141}
• ovl: fix use after free in struct ovl_aio_req {CVE-2023-1252}
• xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-23042}
• xen/netfront: don't trust the backend response data blindly {CVE-2022-23042}
• xen/netfront: disentangle tx_skb_freelist {CVE-2022-23042}
• xen: sync include/xen/interface/io/ring.h with Xen's newest version {CVE-2022-23042}
• net/sched: flower: fix possible OOB write in fl_set_geneve_opt() {CVE-2023-35788}
• rds: rds_rm_zerocopy_callback() use list_first_entry() {CVE-2023-1078}
• misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424}
• mac80211: do not accept/forward invalid EAPOL frames {CVE-2020-26139}
• bpf: Fix 32 bit src register truncation on div/mod {CVE-2021-3600}
• NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• NFSD: Protect against send buffer overflow in NFSv3 READ {CVE-2022-43945}
• SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
• KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() {CVE-2023-28466}
• tee: handle lookup of shm with reference count 0 {CVE-2021-44733}

• CVE-url: https://ubuntu.com/security/CVE-2022-43945
  • NFSD: Protect against send buffer overflow in NFSv3 READ
• CVE-url: https://ubuntu.com/security/CVE-2025-21796
  • nfsd: clear acl_access/acl_default after releasing them
• CVE-url: https://ubuntu.com/security/CVE-2022-48827
  • NFSD: Fix the behavior of READ near OFFSET_MAX
• CVE-url: https://ubuntu.com/security/CVE-2025-38477
  • net/sched: sch_qfq: Fix race condition on qfq_aggregate
  • net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
• CVE-url: https://ubuntu.com/security/CVE-2025-38618
  • vsock: Do not allow binding to VMADDR_PORT_ANY
• CVE-url: https://ubuntu.com/security/CVE-2025-38617
  • net/packet: fix a race in packet_set_ring() and packet_notifier()
• CVE-url: https://ubuntu.com/security/CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
• CVE-url: https://ubuntu.com/security/CVE-2024-41069
  • ASoC: topology: Fix references to freed memory
  • ASoC: topology: Do not assign fields that are already set
  • ASoC: topology: Clean up route loading
• CVE-url: https://ubuntu.com/security/CVE-2024-56616
  • drm/dp_mst: Fix MST sideband message body length check
• CVE-url: https://ubuntu.com/security/CVE-2024-35932
  • drm/vc4: don't check if plane->state->fb == state->fb
• CVE-url: https://ubuntu.com/security/CVE-2025-38350
  • net/sched: Always pass notifications when child class becomes empty

• CVE-url: https://ubuntu.com/security/CVE-2022-43945
  • NFSD: Protect against send buffer overflow in NFSv3 READ
• Focal update: v5.4.285 upstream stable release (LP: #2089233) // CVE-2024-49924 // CVE-url: https://ubuntu.com/security/CVE-2024-49924
  • fbdev: pxafb: Fix possible use after free in pxafb_task()
• CVE-url: https://ubuntu.com/security/CVE-2025-38477
  • net/sched: sch_qfq: Fix race condition on qfq_aggregate
  • net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
• CVE-url: https://ubuntu.com/security/CVE-2025-38618
  • vsock: Do not allow binding to VMADDR_PORT_ANY
• CVE-url: https://ubuntu.com/security/CVE-2025-38617
  • net/packet: fix a race in packet_set_ring() and packet_notifier()
• CVE-url: https://ubuntu.com/security/CVE-2025-21796
  • nfsd: clear acl_access/acl_default after releasing them
• CVE-url: https://ubuntu.com/security/CVE-2022-48827
  • NFSD: Fix the behavior of READ near OFFSET_MAX
• CVE-url: https://ubuntu.com/security/CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
• CVE-url: https://ubuntu.com/security/CVE-2024-41069
  • ASoC: topology: Fix references to freed memory
  • ASoC: topology: Do not assign fields that are already set
  • ASoC: topology: Clean up route loading
• CVE-url: https://ubuntu.com/security/CVE-2024-56616
  • drm/dp_mst: Fix MST sideband message body length check
• Focal update: v5.4.261 upstream stable release (LP: #2049049) // CVE-url: https://ubuntu.com/security/CVE-2023-52868
  • thermal: core: prevent potential string overflow
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52836
  • locking/ww_mutex/test: Fix potential workqueue corruption
• CVE-2024-35965 // CVE-url: https://ubuntu.com/security/CVE-2024-35965
  • Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()
  • Bluetooth: L2CAP: Fix not validating setsockopt user input
• Focal update: v5.4.188 upstream stable release (LP: #1971496) // CVE-url: https://ubuntu.com/security/CVE-2022-49292
  • ALSA: oss: Fix PCM OSS buffer allocation overflow
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52835
  • perf/core: Bail out early if the request AUX area is out of bound
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52764
  • media: gspca: cpia1: shift-out-of-bounds in set_flicker
• Focal update: v5.4.261 upstream stable release (LP: #2049049) // CVE-url: https://ubuntu.com/security/CVE-2023-52864
  • platform/x86: wmi: Fix probe failure when failing to register WMI devices
  • platform/x86: wmi: remove unnecessary initializations
  • platform/x86: wmi: Fix opening of char device
• CVE-2024-35966 // CVE-url: https://ubuntu.com/security/CVE-2024-35966
  • Bluetooth: RFCOMM: Fix not validating setsockopt user input
• CVE-2024-35967 // CVE-url: https://ubuntu.com/security/CVE-2024-35966
  • Bluetooth: SCO: Fix not validating setsockopt user input
• Focal update: v5.4.291 upstream stable release (LP: #2106002) // CVE-2025-21704 // CVE-url: https://ubuntu.com/security/CVE-2025-21704
  • usb: cdc-acm: Check control transfer buffer size before access
• CVE-url: https://ubuntu.com/security/CVE-2025-38350
  • net/sched: Always pass notifications when child class becomes empty
• CVE-url: https://ubuntu.com/security/CVE-2025-37798
  • sch_htb: make htb_qlen_notify() idempotent

[ Ubuntu: 4.15.0-252.263 ]

• CVE-url: https://ubuntu.com/security/CVE-2022-43945
  • NFSD: Protect against send buffer overflow in NFSv3 READ
• Focal update: v5.4.285 upstream stable release (LP: #2089233) // CVE-2024-49924 // CVE-url: https://ubuntu.com/security/CVE-2024-49924
  • fbdev: pxafb: Fix possible use after free in pxafb_task()
• CVE-url: https://ubuntu.com/security/CVE-2025-38477
  • net/sched: sch_qfq: Fix race condition on qfq_aggregate
  • net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
• CVE-url: https://ubuntu.com/security/CVE-2025-38618
  • vsock: Do not allow binding to VMADDR_PORT_ANY
• CVE-url: https://ubuntu.com/security/CVE-2025-38617
  • net/packet: fix a race in packet_set_ring() and packet_notifier()
• CVE-url: https://ubuntu.com/security/CVE-2025-21796
  • nfsd: clear acl_access/acl_default after releasing them
• CVE-url: https://ubuntu.com/security/CVE-2022-48827
  • NFSD: Fix the behavior of READ near OFFSET_MAX
• CVE-url: https://ubuntu.com/security/CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
• CVE-url: https://ubuntu.com/security/CVE-2024-41069
  • ASoC: topology: Fix references to freed memory
  • ASoC: topology: Do not assign fields that are already set
  • ASoC: topology: Clean up route loading
• CVE-url: https://ubuntu.com/security/CVE-2024-56616
  • drm/dp_mst: Fix MST sideband message body length check
• Focal update: v5.4.261 upstream stable release (LP: #2049049) // CVE-url: https://ubuntu.com/security/CVE-2023-52868
  • thermal: core: prevent potential string overflow
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52836
  • locking/ww_mutex/test: Fix potential workqueue corruption
• CVE-2024-35965 // CVE-url: https://ubuntu.com/security/CVE-2024-35965
  • Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()
  • Bluetooth: L2CAP: Fix not validating setsockopt user input
• Focal update: v5.4.188 upstream stable release (LP: #1971496) // CVE-url: https://ubuntu.com/security/CVE-2022-49292
  • ALSA: oss: Fix PCM OSS buffer allocation overflow
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52835
  • perf/core: Bail out early if the request AUX area is out of bound
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52764
  • media: gspca: cpia1: shift-out-of-bounds in set_flicker
• Focal update: v5.4.261 upstream stable release (LP: #2049049) // CVE-url: https://ubuntu.com/security/CVE-2023-52864
  • platform/x86: wmi: Fix probe failure when failing to register WMI devices
  • platform/x86: wmi: remove unnecessary initializations
  • platform/x86: wmi: Fix opening of char device
• CVE-2024-35966 // CVE-url: https://ubuntu.com/security/CVE-2024-35966
  • Bluetooth: RFCOMM: Fix not validating setsockopt user input
• CVE-2024-35967 // CVE-url: https://ubuntu.com/security/CVE-2024-35966
  • Bluetooth: SCO: Fix not validating setsockopt user input
• Focal update: v5.4.291 upstream stable release (LP: #2106002) // CVE-2025-21704 // CVE-url: https://ubuntu.com/security/CVE-2025-21704
  • usb: cdc-acm: Check control transfer buffer size before access
• CVE-url: https://ubuntu.com/security/CVE-2025-38350
  • net/sched: Always pass notifications when child class becomes empty
• CVE-url: https://ubuntu.com/security/CVE-2025-37798
  • sch_htb: make htb_qlen_notify() idempotent

• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-40186}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
• ext4: fix undefined behavior in bit shift for ext4_check_flag_values {CVE-2022-50403}
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}

• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-40186}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
• ext4: fix undefined behavior in bit shift for ext4_check_flag_values {CVE-2022-50403}
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}

• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-40186}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
• ext4: fix undefined behavior in bit shift for ext4_check_flag_values {CVE-2022-50403}
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}

• Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
• firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
• wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• spec: merge oraclelinux6els changes
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918}
• ipvs: use explicitly signed chars
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-48900}
• netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• mtd: inftlcore: Add error check for inftl_read_oob() {CVE-2025-37892}
• igb: Do not free q_vector unless new one was allocated {CVE-2022-50252}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• md-raid10: fix KASAN warning {CVE-2022-50211}
• usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}

• Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
• firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
• wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• spec: merge oraclelinux6els changes
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918}
• ipvs: use explicitly signed chars
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-48900}
• netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• mtd: inftlcore: Add error check for inftl_read_oob() {CVE-2025-37892}
• igb: Do not free q_vector unless new one was allocated {CVE-2022-50252}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• md-raid10: fix KASAN warning {CVE-2022-50211}
• usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}

• ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() {CVE-2026-23089}
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory {CVE-2024-50115}
• KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349}
• Revert "IB/core: Implement clear counters"
• Revert "IB/mlx5: Implement clear counters"
• Revert "ib/core: add SET_DEVICE_OP call for clear_hw_stats()"
• Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
• Revert "xfrm: destroy xfrm_state synchronously on net exit path"
• bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
• can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23061}
• crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060}
• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• drm/amd/pm: fix the Out-of-bounds read warning {CVE-2024-46731}
• drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number {CVE-2024-46724}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• ext4/jbd2: skip sb flush when EIO happened
• ext4: save the error code which triggered an
• fou: remove warn in gue_gro_receive on unsupported protocol {CVE-2024-44940}
• fs: proc: inode: delay put_pid() by RCU
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask
• io_uring: fix filename leak in __io_openat_prep() {CVE-2025-68814}
• jbd2: store more accurate errno in superblock
• libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285}
• libceph: make free_choose_arg_map() resilient to partial allocation {CVE-2026-22991}
• macvlan: Add nodst option to macvlan type source
• macvlan: Use 'hash' iterators to simplify code
• macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001}
• macvlan: observe an RCU grace period in macvlan_common_newlink() error path {CVE-2026-23273}
• media: xc2028: avoid use-after-free in load_firmware_cb() {CVE-2024-43900}
• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• net/sched: sch_qfq: do not free existing class in qfq_change_class() {CVE-2026-22999}
• net: sock: fix hardened usercopy panic in sock_recv_errqueue {CVE-2026-22977}
• net: usb: rtl8150: fix memory leak on usb_submit_urb() failure {CVE-2025-71154}
• rds: Add state field to RDS trace logs.
• rds: Drop rds conn in connect worker if not in down state.
• scsi: mpi3mr: Sanitise num_phys {CVE-2024-42159}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() {CVE-2026-23193}
• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
• wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
• xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added {CVE-2025-40256}
• xfrm: delete x->tunnel as we delete x {CVE-2025-40215}
• xfrm: flush all states in xfrm_state_fini

• crypto: algif_aead - Fix minimum RX size check for decryption
• crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
• crypto: authencesn - Fix src offset when decrypting in-place
• crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
• crypto: authenc - use memcpy_sglist() instead of null skcipher
• crypto: algif_aead - snapshot IV for async AEAD requests
• crypto: algif_aead - Revert to operating out-of-place
• crypto: algif_aead - use memcpy_sglist() instead of null skcipher
• crypto: scatterwalk - Backport memcpy_sglist()
• crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
• nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998}
• xfrm: add NULL check in xfrm_update_ae_params {CVE-2023-3772}
• sctp: check send stream number after wait_for_sndbuf {CVE-2023-53296}
• ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value {CVE-2022-50327}
• ext4: fix uninititialized value in 'ext4_evict_inode' {CVE-2022-50546}
• tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149}
• bpf, cpumap: Make sure kthread is running before map update returns {CVE-2023-53577}
• net: add dst_dev_rcu() helper for safe dst->dev access {CVE-2025-40135}
• net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204}
• net: add skb_header_pointer_careful() helper
• net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve {CVE-2023-4623}
• ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559}
• e1000e: fix heap overflow in e1000_set_eeprom {CVE-2025-39898}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
• md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request {CVE-2023-53380}
• HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207}
• ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() {CVE-2022-50698}
• selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() {CVE-2022-50699}
• scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() {CVE-2023-54014}
• ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085}
• ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() {CVE-2026-23089}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() {CVE-2026-23193}
• drm/i915/gvt: fix gvt debugfs destroy {CVE-2023-54098}
• nfsd: provide locking for v4_end_grace {CVE-2026-22980}
• dm flakey: don't corrupt the zero page {CVE-2023-54317}
• drm/amdkfd: Fix double release compute pasid {CVE-2022-50303}
• RDMA/srpt: Fix a use-after-free {CVE-2022-50129}
• RDMA/srpt: Introduce a reference count in struct srpt_device
• RDMA/srpt: Duplicate port name members
• KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• ipvlan: add ipvlan_route_v6_outbound() helper {CVE-2023-52796}
• mmc: core: use scnprintf() instead of sprintf() in sysfs show functions {CVE-2022-49267}
• rcu: Fix rcu_read_unlock() deadloop due to IRQ work {CVE-2025-39744}
• net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556}
• virtio-net: ensure the received length does not exceed allocated size {CVE-2025-38375}
• cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
• RDMA/mlx5: Return the firmware result upon destroying QP/RQ {CVE-2023-53286}
• RDMA/rxe: Fix mr->map double free {CVE-2022-50543}
• wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() {CVE-2022-50881}
• tcp: fix a signed-integer-overflow bug in tcp_add_backlog() {CVE-2022-50865}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• perf/aux: Fix AUX buffer serialization {CVE-2024-46713}
• usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
• usb: xhci: Complete 'error mid TD' transfers when handling Missed Service
• usb: xhci: remove…

• CVE-2026-31431
  • crypto: scatterwalk - Backport memcpy_sglist() {CVE-2026-31431}
  • crypto: algif_aead - use memcpy_sglist() instead of null skcipher {CVE-2026-31431}
  • crypto: algif_aead - Revert to operating out-of-place {CVE-2026-31431}
  • crypto: algif_aead - snapshot IV for async AEAD requests {CVE-2026-31431}
  • crypto: authenc - use memcpy_sglist() instead of null skcipher {CVE-2026-31431}
  • crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption {CVE-2026-31431}
  • crypto: authencesn - Fix src offset when decrypting in-place {CVE-2026-31431}
  • crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-31431}
  • crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl {CVE-2026-31431}
  • crypto: algif_aead - Fix minimum RX size check for decryption {CVE-2026-31431}
• CVE-2022-49720
  • block: Fix handling of offline queues in blk_mq_alloc_request_hctx() {CVE-2022-49720}
• CVE-2024-49960
  • ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• CVE-2025-71086
  • net: rose: fix invalid array index in rose_kill_by_device() {CVE-2025-71086}
• CVE-2026-23073
  • wifi: rsi: Fix memory corruption due to not set vif driver data size {CVE-2026-23073}
• CVE-2022-49900
  • i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}
• CVE-2022-43945
  • NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• Miscellaneous upstream changes
  • team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
  • scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
  • tuxcare: update version

• Rebased onto Oracle UEK base 5.4.17-2136.357.2.el7uek
• sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
• ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison {CVE-2026-53309}
• ocfs2/dlm: validate qr_numregions in dlm_match_regions() {CVE-2026-53043}
• ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
• crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060}
• futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
• i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597}
• netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381}
• wifi: mac80211: fix NULL deref in mesh_matches_local() {CVE-2026-23396}
• icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
• HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382}
• net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
• wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367}
• drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() {CVE-2026-23356}
• batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
• drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• sysctl: Fix data races in proc_douintvec(). {CVE-2022-49641}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
• mm:…

• Bump kernel ABI to 29: ship the ELS kernel as 4.19.0-29-*, distinct from the prior 4.19.0-28.
• CVE-2021-46984
  • kyber: fix out of bounds access when preempted {CVE-2021-46984}
• CVE-2021-47049
  • Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}
• CVE-2021-47101
  • asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
• CVE-2021-47191
  • scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• CVE-2021-47352
  • virtio-net: Add validation for used length {CVE-2021-47352}
• CVE-2021-47379
  • blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd {CVE-2021-47379}
• CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests {CVE-2021-47391}
• CVE-2021-47479
  • staging: rtl8712: fix use-after-free in rtl8712_dl_fw {CVE-2021-47479}
• CVE-2022-21546
  • scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• CVE-2022-39189
  • KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• CVE-2022-43945
  • SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
  • NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2022-49026
  • e100: Fix possible use after free in e100_xmit_prepare {CVE-2022-49026}
• CVE-2022-49720
  • block: Fix handling of offline queues in blk_mq_alloc_request_hctx() {CVE-2022-49720}
• CVE-2022-49975
  • bpf: Don't redirect packets with invalid pkt_len {CVE-2022-49975}
  • bpf: Move skb->len == 0 checks into __bpf_redirect {CVE-2022-49975}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2022-50103
  • sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• CVE-2022-50129
  • RDMA/srpt: Introduce a reference count in struct srpt_device {CVE-2022-50129}
  • RDMA/srpt: Fix a use-after-free {CVE-2022-50129}
• CVE-2022-50300
  • btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300}
• CVE-2022-50406
  • iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50552
  • blk-mq: use quiesced elevator switch when reinitializing queues {CVE-2022-50552}
• CVE-2023-51779
  • Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
• CVE-2023-52434
  • smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• CVE-2023-52515
  • RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
• CVE-2023-52531
  • wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
• CVE-2023-52741
  • cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
• CVE-2023-53000
  • netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• CVE-2023-53039
  • workqueue: Add resource managed version of delayed work init {CVE-2023-53039}
  • devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc {CVE-2023-53039}
  • devm-helpers: Add resource managed version of work init {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc {CVE-2023-53039}
• CVE-2023-53111
  • loop: Fix use-after-free issues {CVE-2023-53111}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels…

Kyle Zeng discovered that the sysctl implementation in the Linux kernel contained a stack-based buffer overflow. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-4378)

Tamás Koczka discovered that the Bluetooth L2CAP handshake implementation in the Linux kernel contained multiple use-after-free vulnerabilities. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2022-42896)

It was discovered that the NFSD implementation in the Linux kernel did not properly handle some RPC messages, leading to a buffer overflow. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2022-43945)

This kernel update is based on upstream 5.15.79 and fixes at least the following security issues:

A flaw was found in the Linux kernel. A race issue occurs between an io_uring request and the Unix socket garbage collector, allowing an attacker local privilege escalation (CVE-2022-2602).

A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely (CVE-2022-3524).

A vulnerability classified as problematic was found in Linux Kernel. Affected by this vulnerability is the function mvpp2_dbgfs_port_init of the file drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c of the component mvpp2. The manipulation leads to memory leak (CVE-2022-3535).

A vulnerability classified as problematic was found in Linux Kernel. This vulnerability affects the function bnx2x_tpa_stop of the file drivers/net/ ethernet/broadcom/bnx2x/bnx2x_cmn.c of the component BPF. The manipulation leads to memory leak (CVE-2022-3542).

A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function unix_sock_destructor/ unix_release_sock of the file net/unix/af_unix.c of the component BPF. The manipulation leads to memory leak (CVE-2022-3543).

A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free (CVE-2022-3564).

A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free (CVE-2022-3565).

A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The attack can be launched remotely (CVE-2022-3594).

A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to memory leak (CVE-2022-3619).

A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation leads to race condition (CVE-2022-3623).

An intra-object buffer overflow was found in brcmfmac, which can be triggered by a malicious USB causing a Denial-of-Service (CVE-2022-3628).

drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect (CVE-2022-41849).

occat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report->value is in progress (CVE-2022-41850).

There is an infoleak vulnerability in the Linux kernel's net/bluetooth/ l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely (CVE-2022-42895).

There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim (CVE-2022-42896).

The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are…

This kernel-linus update is based on upstream 5.15.79 and fixes at least the following security issues:

A flaw was found in the Linux kernel. A race issue occurs between an io_uring request and the Unix socket garbage collector, allowing an attacker local privilege escalation (CVE-2022-2602).

A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely (CVE-2022-3524).

A vulnerability classified as problematic was found in Linux Kernel. Affected by this vulnerability is the function mvpp2_dbgfs_port_init of the file drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c of the component mvpp2. The manipulation leads to memory leak (CVE-2022-3535).

A vulnerability classified as problematic was found in Linux Kernel. This vulnerability affects the function bnx2x_tpa_stop of the file drivers/net/ ethernet/broadcom/bnx2x/bnx2x_cmn.c of the component BPF. The manipulation leads to memory leak (CVE-2022-3542).

A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function unix_sock_destructor/ unix_release_sock of the file net/unix/af_unix.c of the component BPF. The manipulation leads to memory leak (CVE-2022-3543).

A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free (CVE-2022-3564).

A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free (CVE-2022-3565).

A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The attack can be launched remotely (CVE-2022-3594).

A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to memory leak (CVE-2022-3619).

A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation leads to race condition (CVE-2022-3623).

An intra-object buffer overflow was found in brcmfmac, which can be triggered by a malicious USB causing a Denial-of-Service (CVE-2022-3628).

drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect (CVE-2022-41849).

occat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report->value is in progress (CVE-2022-41850).

There is an infoleak vulnerability in the Linux kernel's net/bluetooth/ l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely (CVE-2022-42895).

There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim (CVE-2022-42896).

The Linux kernel NFSD implementation prior to versions 5.19.17 and…

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c of the component IPsec (bsc#1204631).
• CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c (bsc#1203960).
• CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in net/bluetooth/l2cap_core.c (bsc#1205796).
• CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac (bsc#1204868).
• CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() of the component IPv6 Handler (bsc#1204414).
• CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
• CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
• CVE-2022-2602: Fixed a local privilege escalation vulnerability involving Unix socket Garbage Collection and io_uring (bsc#1204228).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. (bsc#1205711)
• CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req() which can be used to leak kernel pointers remotely (bsc#1205705).
• CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect() and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively) remotely via Bluetooth (bsc#1205709).
• CVE-2022-3707: Fixed a double free in the Intel GVT-g graphics driver (bsc#1204780).

The following non-security bugs were fixed:

• ALSA: hda/ca0132: add quirk for EVGA Z390 DARK (git-fixes).
• ALSA: hda: fix potential memleak in 'add_widget_node' (git-fixes).
• ALSA: usb-audio: Add DSD support for Accuphase DAC-60 (git-fixes).
• ALSA: usb-audio: Add quirk entry for M-Audio Micro (git-fixes).
• ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (git-fixes).
• ASoC: codecs: jz4725b: Fix spelling mistake 'Sourc' -> 'Source', 'Routee' -> 'Route' (git-fixes).
• ASoC: codecs: jz4725b: add missed Line In power control bit (git-fixes).
• ASoC: codecs: jz4725b: fix capture selector naming (git-fixes).
• ASoC: codecs: jz4725b: fix reported volume for Master ctl (git-fixes).
• ASoC: codecs: jz4725b: use right control for Capture Volume (git-fixes).
• ASoC: core: Fix use-after-free in snd_soc_exit() (git-fixes).
• ASoC: max98373: Add checks for devm_kcalloc (git-fixes).
• ASoC: soc-utils: Remove __exit for snd_soc_util_exit() (git-fixes).
• ASoC: wm5102: Revert 'ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe' (git-fixes).
• ASoC: wm5110: Revert 'ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe' (git-fixes).
• ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK (git-fixes).
• ASoC: wm8997: Revert 'ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe' (git-fixes).
• Bluetooth: L2CAP: Fix attempting to access uninitialized memory (git-fixes).
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm (git-fixes).
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (git-fixes).
• Do not enable CONFIG_ATARI_PARTITION (jsc#PED-1573)
• Drivers: hv: vmbus: Add /sys/bus/vmbus/hibernation (git-fixes).
• Drivers: hv: vmbus: Add VMbus IMC device to unsupported list (git-fixes).
• Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening…

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-42328: Guests could trigger denial of service via the netback driver (bnc#1206114).
• CVE-2022-42329: Guests could trigger denial of service via the netback driver (bnc#1206113).
• CVE-2022-3643: Guests could trigger NIC interface reset/abort/crash via netback driver (bnc#1206113).
• CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c of the component IPsec (bsc#1204631). - CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c (bsc#1203960).
• CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in net/bluetooth/l2cap_core.c (bsc#1205796).
• CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() of the component IPv6 Handler (bsc#1204414).
• CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
• CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
• CVE-2022-45869: Fixed a race condition in the x86 KVM subsystem which could cause a denial of service (bsc#1205882).
• CVE-2022-45888: Fixed a use-after-free during physical removal of a USB devices when using drivers/char/xillybus/xillyusb.c (bsc#1205764).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. (bsc#1205711)
• CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect() and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively) remotely via Bluetooth (bsc#1205709).
• CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req() which can be used to leak kernel pointers remotely (bsc#1205705).
• CVE-2022-3566: Fixed a race condition in the functions tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition (bsc#1204405).
• CVE-2022-2602: Fixed a local privilege escalation vulnerability involving Unix socket Garbage Collection and io_uring (bsc#1204228).
• CVE-2022-3176: Fixed a use-after-free in io_uring related to signalfd_poll() and binder_poll() (bsc#1203391).
• CVE-2022-3707: Fixed a double free in the Intel GVT-g graphics driver (bsc#1204780).
• CVE-2022-41850: Fixed a use-after-free in roccat_report_event in drivers/hid/hid-roccat.c (bnc#1203960).

The following non-security bugs were fixed:

• ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() (git-fixes).
• ACPI: HMAT: Fix initiator registration for single-initiator systems (git-fixes).
• ACPI: HMAT: remove unnecessary variable initialization (git-fixes).
• ACPI: scan: Add LATT2021 to acpi_ignore_dep_ids[] (git-fixes).
• ACPI: x86: Add another system to quirk list for forcing StorageD3Enable (git-fixes).
• ALSA: dice: fix regression for Lexicon I-ONIX FW810S (git-fixes).
• ALSA: hda/ca0132: add quirk for EVGA Z390 DARK (git-fixes).
• ALSA: hda/hdmi - enable runtime pm for more AMD display audio (git-fixes).
• ALSA: hda/realtek: Add Positivo C6300 model quirk (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS Zenbook using CS35L41 (git-fixes).
• ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 (bsc#1205100).
• ALSA: hda/realtek: fix speakers for Samsung Galaxy Book Pro (bsc#1205100).
• ALSA: hda: fix potential memleak in 'add_widget_node' (git-fixes). -…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-42328: Guests could trigger denial of service via the netback driver (bnc#1206114).
• CVE-2022-42329: Guests could trigger denial of service via the netback driver (bnc#1206113).
• CVE-2022-3643: Guests could trigger NIC interface reset/abort/crash via netback driver (bnc#1206113).
• CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c (bsc#1204631).
• CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c (bsc#1203960).
• CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in net/bluetooth/l2cap_core.c (bsc#1205796).
• CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac (bsc#1204868).
• CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).
• CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
• CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
• CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req() which can be used to leak kernel pointers remotely (bsc#1205705).
• CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect() and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively) remotely via Bluetooth (bsc#1205709).

The following non-security bugs were fixed:

• Drivers: hv: vmbus: Add VMbus IMC device to unsupported list (git-fixes).
• Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening (bsc#1204017, bsc#1205617).
• Drivers: hv: vmbus: Drop error message when 'No request id available' (bsc#1204017).
• Drivers: hv: vmbus: Fix handling of messages with transaction ID of zero (bsc#1204017).
• Drivers: hv: vmbus: Fix potential crash on module unload (git-fixes).
• Drivers: hv: vmbus: Introduce vmbus_request_addr_match() (bsc#1204017, bsc#1205617).
• Drivers: hv: vmbus: Introduce vmbus_sendpacket_getid() (bsc#1204017, bsc#1205617).
• Drivers: hv: vmbus: Introduce {lock,unlock}_requestor() (bsc#1204017, bsc#1205617).
• Drivers: hv: vmbus: Move __vmbus_open() (bsc#1204017).
• Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer (git-fixes).
• Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work() (git-fixes).
• Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register() (git-fixes).
• FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR (git-fixes).
• FDDI: defxx: Make MMIO the configuration default except for EISA (git-fixes).
• KVM: s390: Add a routine for setting userspace CPU state (git-fixes).
• KVM: s390: Clarify SIGP orders versus STOP/RESTART (git-fixes).
• KVM: s390: Fix handle_sske page fault handling (git-fixes).
• KVM: s390: Simplify SIGP Set Arch handling (git-fixes).
• KVM: s390: fix memory slot handling for KVM_SET_USER_MEMORY_REGION (git-fixes).
• KVM: s390: reduce number of IO pins to 1 (git-fixes).
• KVM: s390: split kvm_s390_logical_to_effective (git-fixes).
• KVM: s390: split kvm_s390_real_to_abs (git-fixes).
• KVM: s390x: fix SCK locking (git-fixes).
• NIU: fix incorrect error return, missed in previous revert (git-fixes).
• PCI: hv: Add check for hyperv_initialized in init_hv_pci_drv() (bsc#1204446).
• PCI: hv: Add validation for untrusted Hyper-V values (bsc#1204017).
• PCI: hv: Drop msi_controller structure (bsc#1204446).
• PCI: hv: Fix NUMA node assignment when kernel boots with custom NUMA topology…

This update for the Linux Kernel 4.12.14-150100_197_114 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
• CVE-2022-41218: Fixed a use-after-free caused by refcount races, affecting dvb_demux_open() and dvb_dmxdev_release() in drivers/media/dvb-core/dmxdev.c (bsc#1202960).

This update for the Linux Kernel 4.12.14-122_139 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).

This update for the Linux Kernel 5.3.18-150200_24_126 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3577: Fixed an out-of-bounds memory write in bigben_probe of drivers/hid/hid-bigbenff.c (bsc#1204470).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
• CVE-2022-41218: Fixed a use-after-free caused by refcount races, affecting dvb_demux_open() and dvb_dmxdev_release() in drivers/media/dvb-core/dmxdev.c (bsc#1202960).

This update for the Linux Kernel 5.3.18-150200_24_134 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3577: Fixed an out-of-bounds memory write in bigben_probe of drivers/hid/hid-bigbenff.c (bsc#1204470).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).

This update for the Linux Kernel 5.3.18-150300_59_93 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3640: Fixed a use-after-free in l2cap_conn_del of the file net/bluetooth/l2cap_core.c (bsc#1204619).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
• CVE-2022-41218: Fixed a use-after-free caused by refcount races, affecting dvb_demux_open() and dvb_dmxdev_release() in drivers/media/dvb-core/dmxdev.c (bsc#1202960).