CVE-2023-28328

A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service.

A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).(CVE-2023-23004)

A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 ("coredump: Use the vma snapshot in fill_files_note") not applied yet, then kernel could be affected.(CVE-2023-1249)

A null pointer dereference issue was found in the unix protocol in net/unix/diag.c in Linux before 6.0. In unix_diag_get_exact, the newly allocated skb does not have sk, leading to null pointer. A local user could use this flaw to crash the system or potentially cause a denial of service.

Reference: https://lore.kernel.org/netdev/CAO4mrfdvyjFpokhNsiwZiP-wpdSD0AStcJwfKcKQdAALQ9_2Qw@mail.gmail.com/ https://lore.kernel.org/netdev/[email protected]/ https://lore.kernel.org/netdev/[email protected]/T/(CVE-2023-28327)

Kernel: A denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c(CVE-2023-28328)

A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service.(CVE-2023-1380)

do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference).(CVE-2023-28466)

In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. An unhandled page fault may occur.(CVE-2022-48424)

In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur.(CVE-2022-48423)

In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs.(CVE-2022-48425)

A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.(CVE-2023-1513)

Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2.(CVE-2023-1281)

The Linux Kernel, the operating system core itself.

Security Fix(es):

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.(CVE-2022-29901)

A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition.(CVE-2022-4269)

A null pointer dereference issue was found in the unix protocol in net/unix/diag.c in Linux before 6.0. In unix_diag_get_exact, the newly allocated skb does not have sk, leading to null pointer. A local user could use this flaw to crash the system or potentially cause a denial of service.

Reference: https://lore.kernel.org/netdev/CAO4mrfdvyjFpokhNsiwZiP-wpdSD0AStcJwfKcKQdAALQ9_2Qw@mail.gmail.com/ https://lore.kernel.org/netdev/[email protected]/ https://lore.kernel.org/netdev/[email protected]/T/(CVE-2023-28327)

Kernel: A denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c(CVE-2023-28328)

A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service.(CVE-2023-1380)

A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.(CVE-2023-1513)

The Linux Kernel, the operating system core itself.

Security Fix(es):

Kernel: A denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c(CVE-2023-28328)

A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service.(CVE-2023-1380)

A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.(CVE-2023-1513)

An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.(CVE-2023-28772)

The Linux Kernel, the operating system core itself.

Security Fix(es):

Kernel: A denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c(CVE-2023-28328)

A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service.(CVE-2023-1380)

A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.(CVE-2023-1513)

A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)
• kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)
• kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)
• kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975)
• kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)
• kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640)
• kernel: double free in usb_8dev_start_xmit (CVE-2022-28388)
• kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951, CVE-2023-33952)
• hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)
• kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895)
• kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456)
• kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887)
• kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458)
• kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590)
• kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)
• kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073)
• kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)
• kernel: hid: Use After Free in asus_remove (CVE-2023-1079)
• kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118)
• kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)
• kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)
• kernel: denial of service in tipc_conn_close (CVE-2023-1382)
• kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989)
• kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)
• kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513)
• kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161)
• kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)
• kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772)
• kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132)
• kernel: Race between task migrating pages and another task calling exit_mmap (CVE-2023-4732)
• Kernel: denial of service in atm_tc_enqueue due to type confusion (CVE-2023-23455)
• kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)
• kernel: Denial of service issue in az6027 driver (CVE-2023-28328)
• kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)
• kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)
• kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203)
• kernel: saa7134: race condition leading to use-after-free in saa7134_finidev (CVE-2023-35823)
• kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c (CVE-2023-35824)
• kernel: r592: race condition leading to use-after-free in r592_remove (CVE-2023-35825)
• kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)
• kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)
• kernel: Use after free bug in r592_remove (CVE-2023-3141)
• kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

• CVE-2022-3523: Fixed use after free related to device private page handling (bsc#1204363).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-22995: Fixed lacks of certain platform_device_put and kfree in drivers/usb/dwc3/dwc3-qcom.c (bsc#1208741).
• CVE-2023-22998: Fixed misinterpretatino of the irtio_gpu_object_shmem_init() return value (bsc#1208776).
• CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function (bsc#1208816).
• CVE-2023-23001: Fixed misinterpretion of the regulator_get return value (bsc# 1208829).
• CVE-2023-23004: Fixed misinterpretatino of the get_sg_table return value in arm/malidp_planes.c (bsc#1208843).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).

The following non-security bugs were fixed:

• NFSv4.1 provide mount option to toggle trunking discovery (git-fixes).
• acpi / x86: Add support for LPS0 callback handler (git-fixes).
• acpi: Do not build ACPICA with '-Os' (git-fixes).
• acpi: NFIT: fix a potential deadlock during NFIT teardown (git-fixes).
• acpi: PM: s2idle: Add support for upcoming AMD uPEP HID AMDI008 (bsc#1206224).
• acpi: PM: s2idle: Use LPS0 idle if ACPI_FADT_LOW_POWER_S0 is unset (bsc#1206224).
• acpi: battery: Fix missing NUL-termination with large strings (git-fixes).
• acpi: resource: Add helper function acpi_dev_get_memory_resources() (git-fixes).
• acpi: video: Fix Lenovo Ideapad Z570 DMI match (git-fixes).
• acpi: x86: s2idle: Add a quirk for ASUS ROG Zephyrus G14 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUS TUF Gaming A17 FA707RE (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUSTeK COMPUTER INC. ROG Flow X13 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for Lenovo Slim 7 Pro 14ARH7 (bsc#1206224).
• acpi: x86: s2idle: Add another ID to s2idle_dmi_table (bsc#1206224).
• acpi: x86: s2idle: Add module parameter to prefer Microsoft GUID (bsc#1206224).
• acpi: x86: s2idle: Fix a NULL pointer dereference (bsc#1206224).
• acpi: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865 (bsc#1206224).
• acpi: x86: s2idle: If a new AMD _HID is missing assume Rembrandt (bsc#1206224).
• acpi: x86: s2idle: Move…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

• CVE-2022-3523: Fixed use after free related to device private page handling (bsc#1204363).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-22995: Fixed lacks of certain platform_device_put and kfree in drivers/usb/dwc3/dwc3-qcom.c (bsc#1208741).
• CVE-2023-22998: Fixed misinterpretation of the irtio_gpu_object_shmem_init() return value (bsc#1208776).
• CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function phy/tegra (bsc#1208816).
• CVE-2023-23004: Fixed misinterpretation of the get_sg_table return value in arm/malidp_planes.c (bsc#1208843).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-25012: Fixed a use-After-Free in bigben_set_led() in hid (bsc#1207560).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).

The following non-security bugs were fixed:

• [xen] fix 'direction' argument of iov_iter_kvec() (git-fixes).
• acpi: Do not build ACPICA with '-Os' (git-fixes).
• acpi: NFIT: fix a potential deadlock during NFIT teardown (git-fixes).
• acpi: battery: Fix missing NUL-termination with large strings (git-fixes).
• acpi: resource: Add helper function acpi_dev_get_memory_resources() (git-fixes).
• acpi: video: Fix Lenovo Ideapad Z570 DMI match (git-fixes).
• acpica: Drop port I/O validation for some regions (git-fixes).
• acpica: nsrepair: handle cases without a return value correctly (git-fixes).
• alsa: hda/ca0132: minor fix for allocation size (git-fixes).
• alsa: hda/conexant: add a new hda codec SN6180 (git-fixes).
• alsa: hda/realtek - fixed wrong gpio assigned (git-fixes).
• alsa: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC (git-fixes).
• alsa: hda: Do not unset preset when cleaning up codec (git-fixes).
• alsa: hda: Match only Intel devices with CONTROLLER_IN_GPU() (git-fixes).
• alsa: ice1712: Delete unreachable code in aureon_add_controls() (git-fixes).
• alsa: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() (git-fixes).
• applicom: Fix PCI device refcount leak in applicom_init() (git-fixes).
• arm64: Treat ESR_ELx as a 64-bit register (git-fixes)
• arm64: atomics: remove LL/SC trampolines (git-fixes)
• arm64: cacheinfo: Fix incorrect assignment of signed error value to (git-fixes)
• arm64: cmpxchg_double*: hazard against entire exchange variable (git-fixes)
• arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name (git-fixes).
• arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name (git-fixes).
• arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible (git-fixes).
• arm64: dts: amlogic: meson-gx: add missing unit address to rng node name (git-fixes).
• arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name (git-fixes).
• arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name (git-fixes).
• arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name (git-fixes).
• arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property (git-fixes).
• arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

• CVE-2022-3523: Fixed a use after free related to device private page handling (bsc#1204363).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-22995: Fixed lacks of certain platform_device_put and kfree in drivers/usb/dwc3/dwc3-qcom.c (bsc#1208741).
• CVE-2023-22998: Fixed NULL vs IS_ERR checking in virtio_gpu_object_shmem_init (bsc#1208776).
• CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function phy/tegra (bsc#1208816).
• CVE-2023-23004: Fixed misinterpretation of get_sg_table return value (bsc#1208843).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).

The following non-security bugs were fixed:

• [infiniband] READ is 'data destination', not source... (git-fixes)
• [xen] fix 'direction' argument of iov_iter_kvec() (git-fixes).
• acpi/x86: Add support for LPS0 callback handler (git-fixes).
• acpi: Do not build ACPICA with '-Os' (git-fixes).
• acpi: NFIT: fix a potential deadlock during NFIT teardown (git-fixes).
• acpi: PM: s2idle: Add support for upcoming AMD uPEP HID AMDI008 (bsc#1206224).
• acpi: PM: s2idle: Use LPS0 idle if ACPI_FADT_LOW_POWER_S0 is unset (bsc#1206224).
• acpi: battery: Fix missing NUL-termination with large strings (git-fixes).
• acpi: resource: Add helper function acpi_dev_get_memory_resources() (git-fixes).
• acpi: video: Fix Lenovo Ideapad Z570 DMI match (git-fixes).
• acpi: x86: s2idle: Add a quirk for ASUS ROG Zephyrus G14 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUS TUF Gaming A17 FA707RE (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUSTeK COMPUTER INC. ROG Flow X13 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for Lenovo Slim 7 Pro 14ARH7 (bsc#1206224).
• acpi: x86: s2idle: Add another ID to s2idle_dmi_table (bsc#1206224).
• acpi: x86: s2idle: Add module parameter to prefer Microsoft GUID (bsc#1206224).
• acpi: x86: s2idle: Fix a NULL pointer dereference (bsc#1206224).
• acpi: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865 (bsc#1206224).
• acpi: x86: s2idle: If a new AMD _HID is missing assume Rembrandt (bsc#1206224).
• acpi: x86: s2idle: Move _HID handling for AMD systems into structures (bsc#1206224).
• acpi: x86: s2idle: Stop using AMD specific codepath for Rembrandt+ (bsc#1206224).
• acpica: Drop port I/O validation for some regions (git-fixes).
• acpica: nsrepair: handle cases without a return value correctly (git-fixes).
• add cherry-picked id for nouveau patch
• alsa: emux: Avoid potential array out-of-bound in snd_emux_xg_control() (git-fixes).
• alsa: hda/ca0132: minor fix for allocation size (git-fixes).
• alsa: hda/conexant: add a new hda codec SN6180 (git-fixes).
• alsa: hda/realtek - fixed wrong gpio assigned (git-fixes).
• alsa: hda/realtek: Add Positivo N14KP6-TG (git-fixes). -…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636).
• CVE-2023-23004: Fixed misinterpretation of get_sg_table return value (bsc#1208843).
• CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
• CVE-2023-28327: Fixed DoS in in_skb in unix_diag_get_exact() (bsc#1209290).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1209366).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• Do not sign the vanilla kernel (bsc#1209008).
• PCI: hv: Add a per-bus mutex state_lock (bsc#1207185).
• PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1207185).
• PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (bsc#1207185).
• PCI: hv: fix a race condition bug in hv_pci_query_relations() (bsc#1207185).
• Revert 'PCI: hv: Fix a timing issue which causes kdump to fail occasionally' (bsc#1209785).
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (bsc#1207168).
• kernel-module-subpackage: Fix expansion with -b parameter (bsc#1208179).

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• ARM: 8702/1: head-common.S: Clear lr before jumping to start_kernel() (git-fixes)
• Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (git-fixes).
• Bluetooth: btusb: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).
• Input: atmel_mxt_ts - fix double free in mxt_read_info_block (git-fixes).
• KVM: arm64: Hide system instruction access to Trace registers (git-fixes)
• NFSv4: Fix hangs when recovering open state after a server reboot (git-fixes).
• PCI/MSI: Enforce MSI entry updates to be visible (git-fixes).
• PCI/MSI: Enforce that MSI-X table entry is masked for update (git-fixes).
• PCI/MSI: Mask all unused MSI-X entries (git-fixes).
• PCI/MSI: Skip masking MSI-X on Xen PV (git-fixes).
• PCI/PM: Always return devices to D0 when thawing (git-fixes).
• PCI/PM: Avoid using device_may_wakeup() for runtime PM (git-fixes).
• PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints (git-fixes).
• PCI: Add ACS quirk for iProc PAXB (git-fixes).
• PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0 (git-fixes).
• PCI: Avoid FLR for AMD Starship USB 3.0 (git-fixes).
• PCI: Make ACS quirk implementations more uniform (git-fixes).
• PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently (git-fixes).
• PCI: PM: Avoid skipping bus-level PM on platforms without ACPI (git-fixes).
• PCI: Unify ACS quirk desired vs provided checking (git-fixes).
• PCI: Use pci_update_current_state() in pci_enable_device_flags() (git-fixes).
• PCI: aardvark: Do not blindly enable ASPM L0s and do not write to read-only register (git-fixes).
• PCI: aardvark: Do not rely on jiffies while holding spinlock (git-fixes).
• PCI: aardvark: Do not touch PCIe registers if no card connected (git-fixes).
• PCI: aardvark: Fix a leaked reference by adding missing of_node_put() (git-fixes).
• PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes).
• PCI: aardvark: Fix kernel panic during PIO transfer (git-fixes).
• PCI: aardvark: Improve link training (git-fixes).
• PCI: aardvark: Indicate error in 'val' when config read fails (git-fixes).
• PCI: aardvark: Introduce an…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (git-fixes).
• Bluetooth: btusb: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).
• Do not sign the vanilla kernel (bsc#1209008).
• Input: atmel_mxt_ts - fix double free in mxt_read_info_block (git-fixes).
• KVM: arm64: Hide system instruction access to Trace registers (git-fixes)
• NFSv4: Fix hangs when recovering open state after a server reboot (git-fixes). [iivanov] Fix Patch-mainline to v6.3-rc5
• PCI/MSI: Enforce MSI entry updates to be visible (git-fixes).
• PCI/MSI: Enforce that MSI-X table entry is masked for update (git-fixes).
• PCI/MSI: Mask all unused MSI-X entries (git-fixes).
• PCI/MSI: Skip masking MSI-X on Xen PV (git-fixes).
• PCI/PM: Always return devices to D0 when thawing (git-fixes).
• PCI/PM: Avoid using device_may_wakeup() for runtime PM (git-fixes).
• PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints (git-fixes).
• PCI: Add ACS quirk for iProc PAXB (git-fixes).
• PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0 (git-fixes).
• PCI: Avoid FLR for AMD Starship USB 3.0 (git-fixes).
• PCI: Make ACS quirk implementations more uniform (git-fixes).
• PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently (git-fixes).
• PCI: PM: Avoid skipping bus-level PM on platforms without ACPI (git-fixes).
• PCI: Unify ACS quirk desired vs provided checking (git-fixes).
• PCI: Use pci_update_current_state() in pci_enable_device_flags() (git-fixes).
• PCI: aardvark: Do not blindly enable ASPM L0s and do not write to read-only register (git-fixes).
• PCI: aardvark: Do not rely on jiffies while holding spinlock (git-fixes).
• PCI: aardvark: Do not touch PCIe registers if no card connected (git-fixes).
• PCI: aardvark: Fix a leaked reference by adding missing of_node_put() (git-fixes).
• PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes).
• PCI: aardvark: Fix kernel panic during PIO transfer (git-fixes).
• PCI: aardvark: Improve link training (git-fixes).
• PCI: aardvark: Indicate error in 'val' when config read fails (git-fixes).
• PCI: aardvark: Introduce an…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636).
• CVE-2023-23004: Fixed misinterpretation of get_sg_table return value (bsc#1208843).
• CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
• CVE-2023-28327: Fixed DoS in in_skb in unix_diag_get_exact() (bsc#1209290).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1209366).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• Do not sign the vanilla kernel (bsc#1209008).
• PCI: hv: Add a per-bus mutex state_lock (bsc#1209785).
• PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1209785).
• PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (bsc#1209785).
• PCI: hv: fix a race condition bug in hv_pci_query_relations() (bsc#1209785).
• Revert 'PCI: hv: Fix a timing issue which causes kdump to fail occasionally' (bsc#1209785).
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (bsc#1207168).
• kernel-module-subpackage: Fix expansion with -b parameter (bsc#1208179).
• net: ena: optimize data access in fast-path code (bsc#1208137).

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bsc#1194535).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• Do not sign the vanilla kernel (bsc#1209008).
• PCI: hv: Add a per-bus mutex state_lock (bsc#1208811).
• PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1208811).
• PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (bsc#1208811).
• PCI: hv: fix a race condition bug in hv_pci_query_relations() (bsc#1208811).
• Revert 'PCI: hv: Fix a timing issue which causes kdump to fail occasionally' (bsc#1208811).
• cifs: fix double free in dfs mounts (bsc#1209845).
• cifs: fix nodfs mount option (bsc#1209845).
• cifs: handle reconnect of tcon when there is no cached dfs referral (bsc#1209845).
• cifs: missing null pointer check in cifs_mount (bsc#1209845).
• cifs: serialize all mount attempts (bsc#1209845).
• cred: allow get_cred() and put_cred() to be given NULL (bsc#1209887).
• ibmvnic: Process crqs after enabling interrupts (bsc#1192273 ltc#194629).
• ibmvnic: do not stop queue in xmit (bsc#1192273 ltc#194629).
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (bsc#1207168).
• kernel-module-subpackage: Fix expansion with -b parameter (bsc#1208179).

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-28464: Fixed use-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1209366).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636).
• CVE-2023-28327: Fixed DoS in in_skb in unix_diag_get_exact() (bsc#1209290).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).

The following non-security bugs were fixed:

• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (bsc#1207168).
• net: ena: optimize data access in fast-path code (bsc#1208137).
• PCI: hv: Add a per-bus mutex state_lock (bsc#1209785).
• PCI: hv: fix a race condition bug in hv_pci_query_relations() (bsc#1209785).
• PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1209785).
• PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (bsc#1209785).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2020-36691: Fixed an issue which could allow attackers to cause a denial of service via a nested Netlink policy with a back reference (bsc#1209613).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue led by a type confusion (bsc#1207125).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).

The following non-security bugs were fixed:

• applicom: Fix PCI device refcount leak in applicom_init() (git-fixes).
• ARM: 8702/1: head-common.S: Clear lr before jumping to start_kernel() (git-fixes)
• arm64: cmpxchg_double*: hazard against entire exchange variable (git-fixes)
• arm64: cpu_ops: fix a leaked reference by adding missing of_node_put (git-fixes)
• arm64: Discard .note.GNU-stack section (bsc#1203693 bsc#1209798).
• arm64: Do not forget syscall when starting a new thread. (git-fixes)
• arm64: Fix compiler warning from pte_unmap() with (git-fixes)
• arm64: fix oops in concurrently setting insn_emulation sysctls (git-fixes)
• arm64: kaslr: Reserve size of ARM64_MEMSTART_ALIGN in linear region (git-fixes)
• arm64: kprobe: make page to RO mode when allocate it (git-fixes)
• arm64: kpti: ensure patched kernel text is fetched from PoU (git-fixes)
• arm64: Mark __stack_chk_guard as __ro_after_init (git-fixes)
• arm64: psci: Avoid printing in cpu_psci_cpu_die() (git-fixes)
• arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() (git-fixes)
• arm64: unwind: Prohibit probing on return_address() (git-fixes)
• arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP (git-fixes)
• arm64/alternatives: do not patch up internal branches (git-fixes)
• arm64/alternatives: move length validation inside the subsection (git-fixes)
• arm64/alternatives: use subsections for replacement sequences (git-fixes)
• arm64/cpufeature: Fix field sign for DIT hwcap detection (git-fixes)
• arm64/mm: fix variable 'pud' set but not used (git-fixes)
• arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE (git-fixes)
• arm64/vdso: Discard .note.gnu.property sections in vDSO (git-fixes)
• Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (git-fixes).
• Bluetooth: btusb: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).
• crypto: arm64 - Fix unused variable compilation warnings of (git-fixes)
• dt-bindings: reset: meson8b: fix duplicate reset IDs (git-fixes).
• ftrace: Fix invalid address access in lookup_rec() when index is 0 (git-fixes).
• ima: Fix function name error in comment (git-fixes).
• Input: atmel_mxt_ts - fix double free in mxt_read_info_block…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2483: Fixed a use after free bug in emac_remove due caused by a race condition (bsc#1211037).
• CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2020-36691: Fixed a denial of service (unbounded recursion) vulnerability via a nested Netlink policy with a back reference (bsc#1209613 bsc#1209777).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bsc#1194535).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2023-1855: Fixed an use-after-free flaw in xgene_hwmon_remove (bsc#1210202).
• CVE-2023-1989: Fixed an use-after-free flaw in btsdio_remove (bsc#1210336).
• CVE-2023-1990: Fixed an use-after-free flaw in ndlc_remove (bsc#1210337).
• CVE-2023-1998: Fixed an use-after-free flaw during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).
• CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).

The following non-security bugs were fixed:

• Do not sign the vanilla kernel (bsc#1209008).
• Fix kABI breakage (bsc#1208333)
• PCI: hv: Add a per-bus mutex state_lock (bsc#1207185).
• PCI: hv: Fix a race condition bug in hv_pci_query_relations() (bsc#1207185).
• PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1207185).
• PCI: hv: Remove the useless hv_pcichild_state from struct…

The SUSE Linux Enterprise 11 SP4 LTSS EXTREME CORE kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-32269: Fixed a use-after-free in af_netrom.c, related to the fact that accept() was also allowed for a successfully connected AF_NETROM socket (bsc#1211186).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2018-9517: Fixed possible memory corruption due to a use after free in pppol2tp_connect (bsc#1108488).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).

The following non-security bugs were fixed:

• Do not sign the vanilla kernel (bsc#1209008).
• do not fallthrough in cbq_classify and stop on TC_ACT_SHOT

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2022-3566: Fixed race condition in the TCP Handler (bsc#1204405).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
• CVE-2023-1990: Fixed a use after free in ndlc_remove (bsc#1210337).
• CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-2194: Fixed an out-of-bounds write vulnerability in the SLIMpro I2C device driver (bsc#1210715).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).
• CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).
• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210940). -…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50248: wifi: iwlwifi: mvm: fix double free on tx path (bsc#1249840).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947).
• CVE-2022-50381: md: fix a crash in mempool_free (bsc#1250257).
• CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
• CVE-2022-50401: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (bsc#1250140).
• CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).

The following non-security bugs were fixed:

• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes).
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
• kernel-syms.spec: Drop old rpm release number hack (bsc#1247172).
• rpm/kernel-subpackage-spec: Skip brp-strip-debug to avoid file truncation (bsc#1246879)
• rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337)
• rpm: Configure KABI checkingness macro (bsc#1249186)
• rpm: Drop support for kabi/arch/ignore-flavor (bsc#1249186)
• rpm: Link arch-symbols script from scripts directory.
• rpm: Link guards script from scripts directory.
• use uniform permission checks for all mount propagation changes (git-fixes).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50242: drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() (bsc#1249696).
• CVE-2022-50244: cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() (bsc#1249647).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947).
• CVE-2022-50265: kcm: annotate data-races around kcm->rx_wait (bsc#1249744).
• CVE-2022-50278: PNP: fix name memory leak in pnp_alloc_dev() (bsc#1249715).
• CVE-2022-50285: mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages (bsc#1249803).
• CVE-2022-50288: qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure (bsc#1249802).
• CVE-2022-50291: kcm: annotate data-races around kcm->rx_psock (bsc#1249798).
• CVE-2022-50294: wifi: libertas: fix memory leak in lbs_init_adapter() (bsc#1249799).
• CVE-2022-50297: wifi: ath9k: verify the expected usb_endpoints are present (bsc#1250250).
• CVE-2022-50304: mm: export bdi_unregister (bsc#1249725).
• CVE-2022-50311: cxl: Fix refcount leak in cxl_calc_capp_routing (bsc#1249720).
• CVE-2022-50312: drivers: serial: jsm: fix some leaks in probe (bsc#1249716).
• CVE-2022-50321: wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (bsc#1249706).
• CVE-2022-50330: crypto: cavium - prevent integer overflow loading firmware (bsc#1249700).
• CVE-2022-50349: misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (bsc#1249920).
• CVE-2022-50352: net: hns: fix possible memory leak in hnae_ae_register() (bsc#1249922).
• CVE-2022-50359: media: cx88: Fix a null-ptr-deref bug in buffer_prepare() (bsc#1250269).
• CVE-2022-50365: skbuff: Account for tail adjustment during pull operations (bsc#1250084).
• CVE-2022-50375: tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown (bsc#1250132).
• CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
• CVE-2022-50396: net: sched: fix memory leak in tcindex_set_parms (bsc#1250104).
• CVE-2022-50402: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() (bsc#1250363).
• CVE-2022-50405: net/tunnel: wait until all sk_user_data reader finish before releasing the sock (bsc#1250155).
• CVE-2022-50406: iomap: iomap: fix memory corruption when recording errors during writeback (bsc#1250165).
• CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2022-50419: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times (bsc#1250394).
• CVE-2023-53148: igb: Do not bring the device up after non-fatal error (bsc#1249842).
• CVE-2023-53153: wifi: cfg80211: Partial revert 'wifi: cfg80211: Fix use after free for wext' (bsc#1249877).
• CVE-2023-53176: serial: 8250: Fix oops for port->pm on uart_change_pm() (bsc#1249991).
• CVE-2023-53178: mm: zswap: fix missing folio cleanup in writeback race path (bsc#1249827 git-fix).
• CVE-2023-53199: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails (bsc#1249683).
• CVE-2023-53201: RDMA/bnxt_re: wraparound mbox producer index (bsc#1249687).
• CVE-2023-53226: wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (bsc#1249658).
• CVE-2023-53248: drm/amdgpu: install stub fence into potential unused fence pointers (bsc#1249779).
• CVE-2023-53254: drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug (bsc#1249871).
• CVE-2023-53272: net: ena: fix shift-out-of-bounds in exponential backoff (bsc#1249917).
• CVE-2023-53277: wifi: iwl3945: Add missing check for create_singlethread_workqueue…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• !CONFIG & reference -> this is bug, immediate fail
• CONFIG & no reference -> OK temporarily, must be resolved eventually
• Do not self obsolete older kernel variants
• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Update config files. (bsc#1249186) Enable where we define KABI refs + rely on Kconfig deps.
• build_bug.h: Add KABI assert (bsc#1249186).
• hv_netvsc: Fix panic during namespace deletion with VF (bsc#1248111).
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
• kernel-syms.spec: Drop…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50248: wifi: iwlwifi: mvm: fix double free on tx path (bsc#1249840).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947).
• CVE-2022-50381: md: fix a crash in mempool_free (bsc#1250257).
• CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
• CVE-2022-50401: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (bsc#1250140).
• CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2022-50412: drm: bridge: adv7511: unregister cec i2c device after cec adapter (bsc#1250189).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53220: media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (bsc#1250337).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2024-53093: nvme-multipath: defer partition scanning (bsc#1233640).
• CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
• CVE-2025-38011: drm/amdgpu: csa unmap use uninterruptible lock (bsc#1244729).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).

The following non-security bugs were fixed:

• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• git_sort: Make tests independent of environment.
• hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes).
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346).
• kernel-syms.spec: Drop old rpm release number hack (bsc#1247172).
• rpm/kernel-subpackage-spec: Skip brp-strip-debug to avoid file truncation (bsc#1246879).
• rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337).
• rpm: Configure KABI checkingness macro (bsc#1249186).
• rpm: Drop support for kabi/arch/ignore-flavor (bsc#1249186).
• scripts/python/kss-dashboard: attempt getting smash data
• scripts/python/kss-dashboard: fetch into repos if stale
• scripts/python/kss-dashboard: implement CVSSv3.1 score consistency check
• scripts/python/kss-dashboard: prepare for the alternative CVE branch
• scripts/python/kss-dashboard: simplify control flow
• scripts/python/kss-dashboard: speed up patch checking a bit
• scripts/python/kss-dashboard: use…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (bsc#1247288).
• CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (bsc#1247288).
• CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Revert backported patches for bsc#1238160.
• btrfs: avoid NULL pointer dereference if…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Revert selinux patches that caused regressions (bsc#1249353).
• btrfs: avoid NULL pointer dereference if no valid extent tree (bsc#1249158).
• build_bug.h: Add KABI assert (bsc#1249186).
• hv_netvsc: Fix panic during namespace deletion with VF (bsc#1248111).
• kabi/severities: ignore kABI for atheros helper modules The symbols are used only internally by atheros drivers.
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
• kernel-syms.spec: Drop…

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50116: Update config files. Disable N_GSM (bsc#1244824 jsc#PED-8240).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50381: MD: add rdev reference for super write (bsc#1250257).
• CVE-2022-50409: net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53282: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write (bsc#1250311).
• CVE-2023-53322: scsi: qla2xxx: Wait for io return on terminate rport (bsc#1250323).
• CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
• CVE-2023-53395: ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (bsc#1250358).
• CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
• CVE-2023-53722: md: raid1: fix potential OOB in raid1_remove_disk() (bsc#1252499).
• CVE-2025-38352: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (bsc#1246911).
• CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247374).
• CVE-2025-38617: net/packet: fix a race in packet_set_ring() and packet_notifier() (bsc#1248621).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).

Updated on 2023-04-11: Please note that when USN 5975-1 was originally published, it incorrectly included the linux-gcp kernel for Ubuntu 16.04 ESM. References to that kernel have been removed from this USN and the correct information for it has been published in USN 6007-1.

Original advisory details:

It was discovered that the Upper Level Protocol (ULP) subsystem in the Linux kernel did not properly handle sockets entering the LISTEN state in certain protocols, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-0461)

It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3669)

It was discovered that an out-of-bounds write vulnerability existed in the Video for Linux 2 (V4L2) implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-20369)

Pawan Kumar Gupta, Alyssa Milburn, Amit Peled, Shani Rehana, Nir Shildan and Ariel Sabba discovered that some Intel processors with Enhanced Indirect Branch Restricted Speculation (eIBRS) did not properly handle RET instructions after a VM exits. A local attacker could potentially use this to expose sensitive information. (CVE-2022-26373)

David Leadbeater discovered that the netfilter IRC protocol tracking implementation in the Linux Kernel incorrectly handled certain message payloads in some situations. A remote attacker could possibly use this to cause a denial of service or bypass firewall filtering. (CVE-2022-2663)

Johannes Wikner and Kaveh Razavi discovered that for some AMD x86-64 processors, the branch predictor could by mis-trained for return instructions in certain circumstances. A local attacker could possibly use this to expose sensitive information. (CVE-2022-29900)

Johannes Wikner and Kaveh Razavi discovered that for some Intel x86-64 processors, the Linux kernel's protections against speculative branch target injection attacks were insufficient in some circumstances. A local attacker could possibly use this to expose sensitive information. (CVE-2022-29901)

It was discovered that a use-after-free vulnerability existed in the SGI GRU driver in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3424)

It was discovered that a race condition existed in the Kernel Connection Multiplexor (KCM) socket implementation in the Linux kernel when releasing sockets in certain situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-3521)

It was discovered that the Netronome Ethernet driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3545)

It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform bounds checking in some situations. A physically proximate attacker could use this to craft a malicious USB device that when inserted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3628)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36280)

It was discovered that a use-after-free vulnerability existed in the Bluetooth stack in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3640)

It was discovered that the NILFS2 file system implementation in the Linux kernel did not properly deallocate…

It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3669)

It was discovered that a use-after-free vulnerability existed in the SGI GRU driver in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3424)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36280)

Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

It was discovered that the network queuing discipline implementation in the Linux kernel contained a null pointer dereference in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-47929)

José Oliveira and Rodrigo Branco discovered that the prctl syscall implementation in the Linux kernel did not properly protect against indirect branch prediction attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2023-0045)

It was discovered that a use-after-free vulnerability existed in the Advanced Linux Sound Architecture (ALSA) subsystem. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0266)

Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference vulnerability in certain situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0394)

Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2023-23455)

It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)

Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer dereference when handling certain messages from user space. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-28328)

It was discovered that the KVM VMX implementation in the Linux kernel did not properly handle indirect branch prediction isolation between L1 and L2 VMs. An attacker in a guest VM could use this to expose sensitive information from the host OS or other guest VMs. (CVE-2022-2196)

It was discovered that a use-after-free vulnerability existed in the SGI GRU driver in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3424)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36280)

Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

Gerald Lee discovered that the USB Gadget file system implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-4382)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate attributes in certain situations, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-48423)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2022-48424)

José Oliveira and Rodrigo Branco discovered that the prctl syscall implementation in the Linux kernel did not properly protect against indirect branch prediction attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2023-0045)

It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer lengths, leading to a heap-based buffer overflow. A remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-0210)

It was discovered that a use-after-free vulnerability existed in the Advanced Linux Sound Architecture (ALSA) subsystem. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0266)

Kyle Zeng discovered that the class-based queuing discipline implementation in the Linux kernel contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2023-23454)

Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2023-23455)

It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly handle a loop termination condition, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-26606)

Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer dereference when handling certain messages from user space. A local attacker could use this to cause a denial of service…

It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3669)

It was discovered that a use-after-free vulnerability existed in the SGI GRU driver in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3424)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36280)

Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

It was discovered that the network queuing discipline implementation in the Linux kernel contained a null pointer dereference in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-47929)

José Oliveira and Rodrigo Branco discovered that the prctl syscall implementation in the Linux kernel did not properly protect against indirect branch prediction attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2023-0045)

It was discovered that a use-after-free vulnerability existed in the Advanced Linux Sound Architecture (ALSA) subsystem. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0266)

Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference vulnerability in certain situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0394)

Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2023-23455)

It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)

Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer dereference when handling certain messages from user space. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-28328)

It was discovered that the KVM VMX implementation in the Linux kernel did not properly handle indirect branch prediction isolation between L1 and L2 VMs. An attacker in a guest VM could use this to expose sensitive information from the host OS or other guest VMs. (CVE-2022-2196)

It was discovered that a use-after-free vulnerability existed in the SGI GRU driver in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3424)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36280)

Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

Gerald Lee discovered that the USB Gadget file system implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-4382)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate attributes in certain situations, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-48423)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2022-48424)

José Oliveira and Rodrigo Branco discovered that the prctl syscall implementation in the Linux kernel did not properly protect against indirect branch prediction attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2023-0045)

It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer lengths, leading to a heap-based buffer overflow. A remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-0210)

It was discovered that a use-after-free vulnerability existed in the Advanced Linux Sound Architecture (ALSA) subsystem. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0266)

Kyle Zeng discovered that the class-based queuing discipline implementation in the Linux kernel contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2023-23454)

Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2023-23455)

It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly handle a loop termination condition, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-26606)

Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer dereference when handling certain messages from user space. A local attacker could use this to cause a denial of service…

It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3669)

It was discovered that a use-after-free vulnerability existed in the SGI GRU driver in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3424)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36280)

Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

It was discovered that the network queuing discipline implementation in the Linux kernel contained a null pointer dereference in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-47929)

José Oliveira and Rodrigo Branco discovered that the prctl syscall implementation in the Linux kernel did not properly protect against indirect branch prediction attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2023-0045)

It was discovered that a use-after-free vulnerability existed in the Advanced Linux Sound Architecture (ALSA) subsystem. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0266)

Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference vulnerability in certain situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0394)

Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2023-23455)

It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)

Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer dereference when handling certain messages from user space. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-28328)

It was discovered that the Upper Level Protocol (ULP) subsystem in the Linux kernel did not properly handle sockets entering the LISTEN state in certain protocols, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-0461)

It was discovered that the NVMe driver in the Linux kernel did not properly handle reset events in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-3169)

It was discovered that a use-after-free vulnerability existed in the SGI GRU driver in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3424)

Gwangun Jung discovered a race condition in the IPv4 implementation in the Linux kernel when deleting multipath routes, resulting in an out-of-bounds read. An attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2022-3435)

It was discovered that a race condition existed in the Kernel Connection Multiplexor (KCM) socket implementation in the Linux kernel when releasing sockets in certain situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-3521)

It was discovered that the Netronome Ethernet driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3545)

It was discovered that the hugetlb implementation in the Linux kernel contained a race condition in some situations. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information (kernel memory). (CVE-2022-3623)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36280)

Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

It was discovered that the Intel i915 graphics driver in the Linux kernel did not perform a GPU TLB flush in some situations. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-4139)

It was discovered that a race condition existed in the Xen network backend driver in the Linux kernel when handling dropped packets in certain circumstances. An attacker could use this to cause a denial of service (kernel deadlock). (CVE-2022-42328, CVE-2022-42329)

It was discovered that the Atmel WILC1000 driver in the Linux kernel did not properly validate offsets, leading to an out-of-bounds read vulnerability. An attacker could use this to cause a denial of service (system crash). (CVE-2022-47520)

It was discovered that the network queuing discipline implementation in the Linux kernel contained a null pointer dereference in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-47929)

José Oliveira and Rodrigo Branco discovered that the prctl syscall implementation in the Linux kernel did not properly protect against indirect branch prediction attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2023-0045)

It was discovered that a use-after-free vulnerability existed in the Advanced Linux Sound Architecture (ALSA) subsystem. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0266)

Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference…

It was discovered that the KVM VMX implementation in the Linux kernel did not properly handle indirect branch prediction isolation between L1 and L2 VMs. An attacker in a guest VM could use this to expose sensitive information from the host OS or other guest VMs. (CVE-2022-2196)

It was discovered that a use-after-free vulnerability existed in the SGI GRU driver in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3424)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36280)

Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

Gerald Lee discovered that the USB Gadget file system implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-4382)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate attributes in certain situations, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-48423)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2022-48424)

José Oliveira and Rodrigo Branco discovered that the prctl syscall implementation in the Linux kernel did not properly protect against indirect branch prediction attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2023-0045)

It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer lengths, leading to a heap-based buffer overflow. A remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-0210)

It was discovered that a use-after-free vulnerability existed in the Advanced Linux Sound Architecture (ALSA) subsystem. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0266)

Kyle Zeng discovered that the class-based queuing discipline implementation in the Linux kernel contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2023-23454)

Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2023-23455)

It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly handle a loop termination condition, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-26606)

Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer dereference when handling certain messages from user space. A local attacker could use this to cause a denial of service…

It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3669)

It was discovered that a use-after-free vulnerability existed in the SGI GRU driver in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3424)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36280)

Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

It was discovered that the network queuing discipline implementation in the Linux kernel contained a null pointer dereference in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-47929)

José Oliveira and Rodrigo Branco discovered that the prctl syscall implementation in the Linux kernel did not properly protect against indirect branch prediction attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2023-0045)

It was discovered that a use-after-free vulnerability existed in the Advanced Linux Sound Architecture (ALSA) subsystem. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0266)

Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference vulnerability in certain situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0394)

Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2023-23455)

It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)

Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer dereference when handling certain messages from user space. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-28328)

It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1281)

Lin Ma discovered a race condition in the io_uring subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0468)

It was discovered that a use-after-free vulnerability existed in the SGI GRU driver in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3424)

Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

It was discovered that the network queuing discipline implementation in the Linux kernel contained a null pointer dereference in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-47929)

Thadeu Cascardo discovered that the io_uring subsystem contained a double- free vulnerability in certain memory allocation error conditions. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-1032)

It was discovered that the module decompression implementation in the Linux kernel did not properly handle return values in certain error conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-22997)

Lianhui Tang discovered that the MPLS implementation in the Linux kernel did not properly handle certain sysctl allocation failure conditions, leading to a double-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-26545)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly handle a loop termination condition, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-26606)

Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer dereference when handling certain messages from user space. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-28328)

It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1281)

It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3669)

It was discovered that a use-after-free vulnerability existed in the SGI GRU driver in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3424)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36280)

It was discovered that the infrared transceiver USB driver did not properly handle USB control messages. A local attacker with physical access could plug in a specially crafted USB device to cause a denial of service (memory exhaustion). (CVE-2022-3903)

Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

It was discovered that the network queuing discipline implementation in the Linux kernel contained a null pointer dereference in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-47929)

José Oliveira and Rodrigo Branco discovered that the prctl syscall implementation in the Linux kernel did not properly protect against indirect branch prediction attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2023-0045)

It was discovered that a use-after-free vulnerability existed in the Advanced Linux Sound Architecture (ALSA) subsystem. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0266)

Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference vulnerability in certain situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0394)

It was discovered that the Human Interface Device (HID) support driver in the Linux kernel contained a type confusion vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-1073)

It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2023-23455)

It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)

Lianhui Tang discovered that the MPLS implementation in the Linux kernel did not properly handle certain sysctl allocation failure conditions, leading to a double-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-26545)

Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer dereference when handling certain messages from user space. A local attacker could use this to cause a denial of service (system crash).…

Patryk Sondej and Piotr Krysiuk discovered that a race condition existed in the netfilter subsystem of the Linux kernel when processing batch requests, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32233)

Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-31436)

Reima Ishii discovered that the nested KVM implementation for Intel x86 processors in the Linux kernel did not properly validate control registers in certain situations. An attacker in a guest VM could use this to cause a denial of service (guest crash). (CVE-2023-30456)

It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform data buffer size validation in some situations. A physically proximate attacker could use this to craft a malicious USB device that when inserted, could cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-1380)

It was discovered that the Human Interface Device (HID) support driver in the Linux kernel contained a type confusion vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-1073)

Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer dereference when handling certain messages from user space. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-28328)

It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute instructions using a return address from a sibling thread. A local attacker could possibly use this to expose sensitive information. (CVE-2022-27672)

William Zhao discovered that the Traffic Control (TC) subsystem in the Linux kernel did not properly handle network packet retransmission in certain situations. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2022-4269)

Jordy Zomer and Alexandra Sandulescu discovered that syscalls invoking the do_prlimit() function in the Linux kernel did not properly handle speculative execution barriers. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2023-0458)

It was discovered that the TLS subsystem in the Linux kernel contained a type confusion vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-1075)

It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-1076, CVE-2023-4194)

It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service (excessive CPU consumption). (CVE-2023-1206)

It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform data buffer size validation in some situations. A physically proximate attacker could use this to craft a malicious USB device that when inserted, could cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-1380)

It was discovered that a race condition existed in the btrfs file system implementation in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-1611)

Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of service (bluetooth communication). (CVE-2023-2002)

Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. (CVE-2023-20593)

It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-2162)

Juan Jose Lopez Jaimez, Meador Inge, Simon Scannell, and Nenad Stojanovski discovered that the BPF verifier in the Linux kernel did not properly mark registers for precision tracking in certain situations, leading to an out- of-bounds access vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-2163)

It was discovered that the perf subsystem in the Linux kernel contained a use-after-free vulnerability. A privileged local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-2235)

Zheng Zhang discovered that the device-mapper implementation in the Linux kernel did not properly handle locking during table_clear() operations. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2023-2269)

Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer dereference when handling certain messages from user space. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-28328)

It was discovered that a race…