CVE-2024-36899

gpiolib: cdev: Fix use after free in lineinfo_changed_notify

7.0 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: cdev: Fix use after free in lineinfo_changed_notify

The use-after-free issue occurs as follows: when the GPIO chip device file is being closed by invoking gpio_chrdev_release(), watched_lines is freed by bitmap_free(), but the unregistration of lineinfo_changed_nb notifier chain failed due to waiting write rwsem. Additionally, one of the GPIO chip's lines is also in the release process and holds the notifier chain's read rwsem. Consequently, a race condition leads to the use-after-free of watched_lines.

Here is the typical stack when issue happened:

[free] gpio_chrdev_release() --> bitmap_free(cdev->watched_lines) <-- freed --> blocking_notifier_chain_unregister() --> down_write(&nh->rwsem) <-- waiting rwsem --> __down_write_common() --> rwsem_down_write_slowpath() --> schedule_preempt_disabled() --> schedule()

[use] st54spi_gpio_dev_release() --> gpio_free() --> gpiod_free() --> gpiod_free_commit() --> gpiod_line_state_notify() --> blocking_notifier_call_chain() --> down_read(&nh->rwsem); <-- held rwsem --> notifier_call_chain() --> lineinfo_changed_notify() --> test_bit(xxxx, cdev->watched_lines) <-- use after free

The side effect of the use-after-free issue is that a GPIO line event is being generated for userspace where it shouldn't. However, since the chrdev is being closed, userspace won't have the chance to read that event anyway.

To fix the issue, call the bitmap_free() function after the unregistration of lineinfo_changed_nb notifier chain.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.18%Up 0.1 points since May 31, 2024

What each source reports

NVD Score used 7.0

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: cdev: Fix use after free in lineinfo_changed_notify

Here is the typical stack when issue happened:

To fix the issue, call the bitmap_free() function after the unregistration of lineinfo_changed_nb notifier chain.

Record: CVE-2024-36899
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-362, CWE-416
Updated: 2026-11-02

CVE List No score

gpiolib: cdev: Fix use after free in lineinfo_changed_notify

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: cdev: Fix use after free in lineinfo_changed_notify

Here is the typical stack when issue happened:

To fix the issue, call the bitmap_free() function after the unregistration of lineinfo_changed_nb notifier chain.

Record: CVE-2024-36899
Updated: 2026-11-02

EUVDEUVD-2024-36388 No score

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: cdev: Fix use after free in lineinfo_changed_notify

Here is the typical stack when issue happened:

To fix the issue, call the bitmap_free() function after the unregistration of lineinfo_changed_nb notifier chain.

Record: EUVD-2024-36388
Updated: 2026-11-02

OSVAZL-55548 7.0

CVE-2024-36899 affecting package kernel for versions less than 5.15.179.1-1

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: cdev: Fix use after free in lineinfo_changed_notify

Here is the typical stack when issue happened:

To fix the issue, call the bitmap_free() function after the unregistration of lineinfo_changed_nb notifier chain.

Record: AZL-55548
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBELL-CVE-2024-36899 7.0

Record: BELL-CVE-2024-36899
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-36899 7.0

In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfo_changed_notify The use-after-free issue occurs as follows: when the GPIO chip device file is being closed by invoking gpio_chrdev_release(), watched_lines is freed by bitmap_free(), but the unregistration of lineinfo_changed_nb notifier chain failed due to waiting write rwsem. Additionally, one of the GPIO chip's lines is also in the release process and holds the notifier chain's read rwsem. Consequently, a race condition leads to the use-after-free of watched_lines. Here is the typical stack when issue happened: [free] gpio_chrdev_release() --> bitmap_free(cdev->watched_lines) <-- freed --> blocking_notifier_chain_unregister() --> down_write(&nh->rwsem) <-- waiting rwsem --> __down_write_common() --> rwsem_down_write_slowpath() --> schedule_preempt_disabled() --> schedule() [use] st54spi_gpio_dev_release() --> gpio_free() --> gpiod_free() --> gpiod_free_commit() --> gpiod_line_state_notify() --> blocking_notifier_call_chain() --> down_read(&nh->rwsem); <-- held rwsem --> notifier_call_chain() --> lineinfo_changed_notify() --> test_bit(xxxx, cdev->watched_lines) <-- use after free The side effect of the use-after-free issue is that a GPIO line event is being generated for userspace where it shouldn't. However, since the chrdev is being closed, userspace won't have the chance to read that event anyway. To fix the issue, call the bitmap_free() function after the unregistration of lineinfo_changed_nb notifier chain.

Record: DEBIAN-CVE-2024-36899
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 44 moreShow less

OSVOESA-2024-1706 0.0

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix use-after-free of encap entry in neigh update handler

Function mlx5e_rep_neigh_update() wasn't updated to accommodate rtnl lock removal from TC filter update path and properly handle concurrent encap entry insertion/deletion which can lead to following use-after-free:

[23827.464923] ================================================================== [23827.469446] BUG: KASAN: use-after-free in mlx5e_encap_take+0x72/0x140 [mlx5_core] [23827.470971] Read of size 4 at addr ffff8881d132228c by task kworker/u20:6/21635 [23827.472251] [23827.472615] CPU: 9 PID: 21635 Comm: kworker/u20:6 Not tainted 5.13.0-rc3+ #5 [23827.473788] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [23827.475639] Workqueue: mlx5e mlx5e_rep_neigh_update [mlx5_core] [23827.476731] Call Trace: [23827.477260] dump_stack+0xbb/0x107 [23827.477906] print_address_description.constprop.0+0x18/0x140 [23827.478896] ? mlx5e_encap_take+0x72/0x140 [mlx5_core] [23827.479879] ? mlx5e_encap_take+0x72/0x140 [mlx5_core] [23827.480905] kasan_report.cold+0x7c/0xd8 [23827.481701] ? mlx5e_encap_take+0x72/0x140 [mlx5_core] [23827.482744] kasan_check_range+0x145/0x1a0 [23827.493112] mlx5e_encap_take+0x72/0x140 [mlx5_core] [23827.494054] ? mlx5e_tc_tun_encap_info_equal_generic+0x140/0x140 [mlx5_core] [23827.495296] mlx5e_rep_neigh_update+0x41e/0x5e0 [mlx5_core] [23827.496338] ? mlx5e_rep_neigh_entry_release+0xb80/0xb80 [mlx5_core] [23827.497486] ? read_word_at_a_time+0xe/0x20 [23827.498250] ? strscpy+0xa0/0x2a0 [23827.498889] process_one_work+0x8ac/0x14e0 [23827.499638] ? lockdep_hardirqs_on_prepare+0x400/0x400 [23827.500537] ? pwq_dec_nr_in_flight+0x2c0/0x2c0 [23827.501359] ? rwlock_bug.part.0+0x90/0x90 [23827.502116] worker_thread+0x53b/0x1220 [23827.502831] ? process_one_work+0x14e0/0x14e0 [23827.503627] kthread+0x328/0x3f0 [23827.504254] ? _raw_spin_unlock_irq+0x24/0x40 [23827.505065] ? __kthread_bind_mask+0x90/0x90 [23827.505912] ret_from_fork+0x1f/0x30 [23827.506621] [23827.506987] Allocated by task 28248: [23827.507694] kasan_save_stack+0x1b/0x40 [23827.508476] __kasan_kmalloc+0x7c/0x90 [23827.509197] mlx5e_attach_encap+0xde1/0x1d40 [mlx5_core] [23827.510194] mlx5e_tc_add_fdb_flow+0x397/0xc40 [mlx5_core] [23827.511218] __mlx5e_add_fdb_flow+0x519/0xb30 [mlx5_core] [23827.512234] mlx5e_configure_flower+0x191c/0x4870 [mlx5_core] [23827.513298] tc_setup_cb_add+0x1d5/0x420 [23827.514023] fl_hw_replace_filter+0x382/0x6a0 [cls_flower] [23827.514975] fl_change+0x2ceb/0x4a51 [cls_flower] [23827.515821] tc_new_tfilter+0x89a/0x2070 [23827.516548] rtnetlink_rcv_msg+0x644/0x8c0 [23827.517300] netlink_rcv_skb+0x11d/0x340 [23827.518021] netlink_unicast+0x42b/0x700 [23827.518742] netlink_sendmsg+0x743/0xc20 [23827.519467] sock_sendmsg+0xb2/0xe0 [23827.520131] ____sys_sendmsg+0x590/0x770 [23827.520851] ___sys_sendmsg+0xd8/0x160 [23827.521552] __sys_sendmsg+0xb7/0x140 [23827.522238] do_syscall_64+0x3a/0x70 [23827.522907] entry_SYSCALL_64_after_hwframe+0x44/0xae [23827.523797] [23827.524163] Freed by task 25948: [23827.524780] kasan_save_stack+0x1b/0x40 [23827.525488] kasan_set_track+0x1c/0x30 [23827.526187] kasan_set_free_info+0x20/0x30 [23827.526968] __kasan_slab_free+0xed/0x130 [23827.527709] slab_free_freelist_hook+0xcf/0x1d0 [23827.528528] kmem_cache_free_bulk+0x33a/0x6e0 [23827.529317] kfree_rcu_work+0x55f/0xb70 [23827.530024] process_one_work+0x8ac/0x14e0 [23827.530770] worker_thread+0x53b/0x1220 [23827.531480] kthread+0x328/0x3f0 [23827.532114] ret_from_fork+0x1f/0x30 [23827.532785] [23827.533147] Last potentially related work creation: [23827.534007] kasan_save_stack+0x1b/0x40 [23827.534710] kasan_record_aux_stack+0xab/0xc0 …

Record: OESA-2024-1706
CVSS 3.1: 0.0 NoneCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N
Updated: 2026-11-02

OSVOESA-2024-1707 0.0

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix use-after-free of encap entry in neigh update handler

Record: OESA-2024-1707
CVSS 3.1: 0.0 NoneCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N
Updated: 2026-11-02

OSVOESA-2024-1960 9.1

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

efi: libstub: only free priv.runtime_map when allocated

priv.runtime_map is only allocated when efi_novamap is not set. Otherwise, it is an uninitialized value. In the error path, it is freed unconditionally. Avoid passing an uninitialized value to free_pool. Free priv.runtime_map only when it was allocated.

This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc.(CVE-2024-33619)

In the Linux kernel, the following vulnerability has been resolved:

fpga: region: add owner module and take its refcount

The current implementation of the fpga region assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take the module's refcount. This approach is problematic since it can lead to a null pointer dereference while attempting to get the region during programming if the parent device does not have a driver.

To address this problem, add a module owner pointer to the fpga_region struct and use it to take the module's refcount. Modify the functions for registering a region to take an additional owner module parameter and rename them to avoid conflicts. Use the old function names for helper macros that automatically set the module that registers the region as the owner. This ensures compatibility with existing low-level control modules and reduces the chances of registering a region without setting the owner.

Also, update the documentation to keep it consistent with the new interface for registering an fpga region.(CVE-2024-35247)

In the Linux kernel, the following vulnerability has been resolved:

eeprom: at24: fix memory corruption race condition

If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory.

Move the failure point before registering the nvmem device.(CVE-2024-35848)

In the Linux kernel, the following vulnerability has been resolved:

block: fix module reference leakage from bdev_open_by_dev error path

At the time bdev_may_open() is called, module reference is grabbed already, hence module reference should be released if bdev_may_open() failed.

This problem is found by code review.(CVE-2024-35859)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Fix not validating setsockopt user input

syzbot reported rfcomm_sock_setsockopt_old() is copying data without checking user input length.

BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt_old net/bluetooth/rfcomm/sock.c:632 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt+0x893/0xa70 net/bluetooth/rfcomm/sock.c:673 Read of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064(CVE-2024-35966)

In the Linux kernel, the following vulnerability has been resolved:

mm/slab: make __free(kfree) accept error pointers

Currently, if an automatically freed allocation is an error pointer that will lead to a crash. An example of this is in wm831x_gpio_dbg_show().

171 char *label __free(kfree) = gpiochip_dup_line_label(chip, i); 172 if (IS_ERR(label)) { 173 dev_err(wm831x->dev, "Failed to duplicate label\n"); 174 continue; 175 }

The auto clean up function should check for error pointers as well, otherwise we're going to keep hitting issues like this.(CVE-2024-36890)

In the Linux kernel, the following vulnerability has been resolved:

USB: core: Fix access violation during port device removal

Testing with KASAN and syzkaller…

Record: OESA-2024-1960
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:6997 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2024:6997
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:7004 6.7

Red Hat Security Advisory: kernel security update

Record: RHSA-2024:7004
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:7005 6.7

Red Hat Security Advisory: kernel-rt security update

Record: RHSA-2024:7005
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-36899 7.0

Record: UBUNTU-CVE-2024-36899
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVALSA-2024:6997 No score

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439)
kernel: net/sched: act_mirred: don't override retval if we already lost the skb (CVE-2024-26739)
kernel: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses (CVE-2024-26947)
kernel: scsi: qla2xxx: Fix command flush on cable pull (CVE-2024-26931)
kernel: scsi: qla2xxx: Fix double free of the ha->vp_map pointer (CVE-2024-26930)
kernel: scsi: qla2xxx: Fix double free of fcport (CVE-2024-26929)
kernel: fork: defer linking file vma until vma is fully initialized (CVE-2024-27022)
kernel: KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes (CVE-2024-26991)
kernel: bpf, sockmap: Prevent lock inversion deadlock in map delete elem (CVE-2024-35895)
kernel: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (CVE-2024-36016)
kernel: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (CVE-2024-36899)
kernel: cpufreq: exit() callback is optional (CVE-2024-38615)
kernel: ring-buffer: Fix a race between readers and resize checks (CVE-2024-38601)
kernel: cppc_cpufreq: Fix possible null pointer dereference (CVE-2024-38573)
kernel: gfs2: Fix potential glock use-after-free on unmount (CVE-2024-38570)
kernel: wifi: nl80211: Avoid address calculations via out of bounds array indexing (CVE-2024-38562)
kernel: Input: cyapa - add missing input core locking to suspend/resume functions (CVE-2023-52884)
kernel: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CVE-2024-40984)
kernel: wifi: mac80211: Avoid address calculations via out of bounds array indexing (CVE-2024-41071)
kernel: wifi: mt76: replace skb_put with skb_put_zero (CVE-2024-42225)
kernel: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CVE-2024-42246)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2024:6997
Updated: 2026-11-02

OSVCLSA-2024-1728936982 No score

kernel: Fix of 86 CVEs

drm/amd/pm: Fix negative array index read {CVE-2024-46821}
drm/amd/display: Check gpio_id before used as array index {CVE-2024-46818}
drm/amd/display: Check link_index before accessing dc->links[] {CVE-2024-46813}
drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box {CVE-2024-46811}
Squashfs: sanity check symbolic link size {CVE-2024-46744}
platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses {CVE-2024-46859}
net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() {CVE-2024-40995}
net/sched: act_api: rely on rcu in tcf_idr_check_alloc {CVE-2024-40995}
netfilter: bridge: confirm multicast packets before passing them up the stack {CVE-2024-27415}
netfilter: let reset rules clean out conntrack entries {CVE-2024-27415}
mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray {CVE-2024-42243}
gpiolib: cdev: Fix use after free in lineinfo_changed_notify {CVE-2024-36899}
bpf, sockmap: Prevent lock inversion deadlock in map delete elem {CVE-2024-35895}
bpf, sockmap: Fix preempt_rt splat when using raw_spin_lock_t {CVE-2024-35895}
mm/huge_memory: don't unpoison huge_zero_folio {CVE-2024-40914}
cxgb4: fix use after free bugs caused by circular dependency problem {CVE-2023-4133}
timers: Restore ABI Compatibility with timer_delete Functions {CVE-2023-4133}
timers: Provide timer_shutdown_sync {CVE-2023-4133}
timers: Add shutdown mechanism to the internal functions {CVE-2023-4133}
timers: Split [try_to_]del_timer_sync to prepare for shutdown mode {CVE-2023-4133}
timers: Silently ignore timers with a NULL function {CVE-2023-4133}
timers: Rename del_timer() to timer_delete() {CVE-2023-4133}
timers: Rename del_timer_sync() to timer_delete_sync() {CVE-2023-4133}
timers: Use del_timer_sync() even on UP {CVE-2023-4133}
timers: Update kernel-doc for various functions {CVE-2023-4133}
timers: Replace BUG_ON()s {CVE-2023-4133}
timers: Get rid of del_singleshot_timer_sync() {CVE-2023-4133}
clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function {CVE-2023-4133}
clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function {CVE-2023-4133}
mm: avoid overflows in dirty throttling logic {CVE-2024-42131}
ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
igc: avoid returning frame twice in XDP_REDIRECT {CVE-2024-26853}
igc: Avoid transmit queue timeout for XDP {CVE-2024-26853}
nfsd: fix RELEASE_LOCKOWNER {CVE-2024-26629}
tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc {CVE-2023-52880}
nvmet: fix a possible leak when destroy a ctrl during qp establishment {CVE-2024-42152}
net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() {CVE-2024-42110}
x86: stop playing stack games in profile_pc() {CVE-2024-42096}
xdp: Remove WARN() from __xdp_reg_mem_model() {CVE-2024-42082}
NFSv4: Fix memory leak in nfs4_set_security_label {CVE-2024-41076}
ppp: reject claimed-as-LCP but actually malformed packets {CVE-2024-41044}
udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). {CVE-2024-41041}
sched/deadline: Fix task_struct reference leak {CVE-2024-41023}
tipc: force a dst refcount before doing decryption {CVE-2024-40983}
scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978}
wifi: iwlwifi: mvm: don't read past the mfuart notifcation {CVE-2024-40941}
wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
xhci: Handle TD clearing for multiple streams case {CVE-2024-40927}
wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() {CVE-2024-40912}
wifi: cfg80211: Lock wiphy in cfg80211_get_station {CVE-2024-40911}
ipv6: fix possible race in __fib6_drop_pcpu_from() {CVE-2024-40905}
md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING {CVE-2024-39476}
usb-storage: alauda: Check whether the media is…

Record: CLSA-2024-1728936982
Updated: 2026-11-02

OSV No score

gpiolib: cdev: Fix use after free in lineinfo_changed_notify

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: cdev: Fix use after free in lineinfo_changed_notify

Here is the typical stack when issue happened:

To fix the issue, call the bitmap_free() function after the unregistration of lineinfo_changed_nb notifier chain.

Record: CVE-2024-36899
Updated: 2026-11-02

OSVMGASA-2024-0263 No score

Updated kernel kmod-xtables-addons kmod-virtualbox dwarves packages fix security vulnerabilities

Upstream kernel version 6.6.37 fix bugs and vulnerabilities. The dwarves, kmod-virtualbox and kmod-xtables-addons packages have been updated to work with this new kernel. For information about the vulnerabilities see the links.

Record: MGASA-2024-0263
Updated: 2026-11-02

OSVMGASA-2024-0266 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.6.37 fix bugs and vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2024-0266
Updated: 2026-11-02

OSVSUSE-SU-2024:2372-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958.
CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
CVE-2023-52869: pstore/platform: Add check for kstrdup (bsc#1225050).
CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
CVE-2023-52882: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change (bsc#1225692).
CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
CVE-2024-26644: btrfs: do not abort filesystem when attempting to snapshot deleted subvolume (bsc#1221282bsc#1222072).
CVE-2024-26720: mm: Avoid overflows in dirty throttling logic (bsc#1222364).
CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
CVE-2024-26973: fat: fix uninitialized field in nostale filehandles (git-fixesbsc#1223641).
CVE-2024-27432: net: ethernet: mtk_eth_soc: fix PPE hanging issue (bsc#1224716).
CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (bsc#1224712).
CVE-2024-35807: ext4: fix corruption during on-line resize (bsc#1224735).
CVE-2024-35835: net/mlx5e: fix a double-free in arfs_create_groups (bsc#1224605).
CVE-2024-35848: eeprom: at24: fix memory corruption race condition (bsc#1224612).
CVE-2024-35857: icmp: prevent possible NULL dereferences from icmp_build_probe() (bsc#1224619).
CVE-2024-35861:…

Record: SUSE-SU-2024:2372-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2385-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1224703).
CVE-2024-36894: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (bsc#1225749).
CVE-2024-36899: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (bsc#1225737).
CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
CVE-2024-36940: pinctrl: core: delete incorrect free in pinctrl_enable() (bsc#1225840).
CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
CVE-2024-36971: net: fix __dst_negative_advice() race (bsc#1226145).
CVE-2024-38541: of: module: add buffer overflow check in of_modalias() (bsc#1226587).
CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595).
CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).
CVE-2024-38564: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (bsc#1226789).
CVE-2024-38578: ecryptfs: Fix buffer size for tag 66 packet (bsc#1226634).

The following non-security bugs were fixed:

Revert 'build initrd without systemd' (bsc#1195775)
cgroup: Add annotation for holding namespace_sem in current_cgns_cgroup_from_root() (bsc#1222254).
cgroup: Eliminate the need for cgroup_mutex in proc_cgroup_show() (bsc#1222254).
cgroup: Make operations on the cgroup root_list RCU safe (bsc#1222254).
cgroup: Remove unnecessary list_empty() (bsc#1222254).
cgroup: preserve KABI of cgroup_root (bsc#1222254).
mkspec-dtb: add toplevel symlinks also on arm
ocfs2: adjust enabling place for la window (bsc#1219224).
ocfs2: fix sparse warnings (bsc#1219224).
ocfs2: improve write IO performance when fragmentation is high (bsc#1219224).
ocfs2: speed up chain-list searching (bsc#1219224).
random: treat bootloader trust toggle the same way as cpu trust toggle (bsc#1226953).
rpm/kernel-obs-build.spec.in: Add iso9660 (bsc#1226212) Some builds do not just create an iso9660 image, but also mount it during build.
rpm/kernel-obs-build.spec.in: Add networking modules for docker (bsc#1226211) docker needs more networking modules, even legacy iptable_nat and _filter.
rpm/kernel-obs-build.spec.in: Include algif_hash, aegis128 and xts modules afgif_hash is needed by some packages (e.g. iwd) for tests, xts is used for LUKS2 volumes by default and aegis128 is useful as AEAD cipher for LUKS2. Wrap the long line to make it readable.
rpm/mkspec-dtb: dtbs have moved to vendor sub-directories in 6.5 By commit 724ba6751532 ('ARM: dts: Move .dts files to vendor sub-directories'). So switch to them.
scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling (bsc#1216124).
smb: client: ensure to try all targets when finding…

Record: SUSE-SU-2024:2385-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2394-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958.
CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
CVE-2023-52869: pstore/platform: Add check for kstrdup (bsc#1225050).
CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
CVE-2023-52882: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change (bsc#1225692).
CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
CVE-2024-26644: btrfs: do not abort filesystem when attempting to snapshot deleted subvolume (bsc#1221282, bsc#1222072).
CVE-2024-26720: mm: Avoid overflows in dirty throttling logic (bsc#1222364).
CVE-2024-26845: scsi: target: core: Add TMF to tmr_list handling (bsc#1223018).
CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
CVE-2024-26973: fat: fix uninitialized field in nostale filehandles (bsc#1223641).
CVE-2024-27432: net: ethernet: mtk_eth_soc: fix PPE hanging issue (bsc#1224716).
CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (bsc#1224712).
CVE-2024-35807: ext4: fix corruption during on-line resize (bsc#1224735).
CVE-2024-35835: net/mlx5e: fix a double-free in arfs_create_groups (bsc#1224605).
CVE-2024-35848: eeprom: at24: fix memory corruption race condition (bsc#1224612).
CVE-2024-35857: icmp: prevent possible…

Record: SUSE-SU-2024:2394-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2495-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
CVE-2024-35869: smb: client: guarantee refcounted children from parent session (bsc#1224679).
CVE-2024-38564: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (bsc#1226789).
CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).
CVE-2024-38578: ecryptfs: Fix buffer size for tag 66 packet (bsc#1226634,).
CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595)
CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
CVE-2024-38541: of: module: add buffer overflow check in of_modalias() (bsc#1226587).
CVE-2024-36971: net: fix __dst_negative_advice() race (bsc#1226145).
CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
CVE-2024-38610: drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() (bsc#1226758).
CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect()(bsc#1224766).
CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
CVE-2024-36899: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (bsc#1225737).
CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
CVE-2024-36940: pinctrl: core: delete incorrect free in pinctrl_enable() (bsc#1225840).
CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
CVE-2024-36894: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (bsc#1225749).
CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1224703).
CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).

The following non-security bugs were fixed:

Revert 'build initrd without systemd' (bsc#1195775)'
cgroup: Add annotation for holding namespace_sem in current_cgns_cgroup_from_root() (bsc#1222254).
cgroup: Eliminate the need for cgroup_mutex in proc_cgroup_show() (bsc#1222254).
cgroup: Make operations on the cgroup root_list RCU safe (bsc#1222254).
cgroup: Remove unnecessary list_empty() (bsc#1222254).
cgroup: preserve KABI of cgroup_root (bsc#1222254).
ocfs2: adjust enabling place for la window (bsc#1219224).
ocfs2: fix sparse warnings (bsc#1219224).
ocfs2: improve write IO performance when fragmentation is high (bsc#1219224).
ocfs2: speed up chain-list searching (bsc#1219224).
random: treat bootloader trust toggle the same way as cpu trust toggle (bsc#1226953).
rpm/kernel-obs-build.spec.in: Add iso9660 (bsc#1226212).
rpm/kernel-obs-build.spec.in: Add networking modules for docker (bsc#1226211).
scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling (bsc#1216124).
smb: client: ensure to try all targets when finding nested links (bsc#1224020).
x86/tsc: Trust initial offset in architectural TSC-adjust MSRs (bsc#1222015 bsc#1226962).
xfs: do not include bnobt blocks when reserving free block pool (bsc#1226270).

Record: SUSE-SU-2024:2495-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2571-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-39371: io_uring: check for non-NULL file pointer in io_file_can_poll() (bsc#1226990).
CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
CVE-2024-38610: drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() (bsc#1226758).
CVE-2024-37354: btrfs: fix crash on racing fsync and size-extending write into prealloc (bsc#1227101).
CVE-2024-36919: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (bsc#1225767).
CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
CVE-2024-38570: gfs2: Fix potential glock use-after-free on unmount (bsc#1226775).
CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595).
CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
CVE-2023-52865: Add check for mtk_alloc_clk_data (bsc#1225086).
CVE-2023-52821: Fixed a possible null pointer dereference (bsc#1225022).
CVE-2023-52867: Fixed possible buffer overflow (bsc#1225009).
CVE-2024-38578: ecryptfs: Fix buffer size for tag 66 packet (bsc#1226634,).
CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
CVE-2023-52759: Ignore negated quota changes (bsc#1225560).
CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
CVE-2023-52864: Fixed opening of char device (bsc#1225132).
CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).
CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).
CVE-2024-39301: net/9p: fix uninit-value in p9_client_rpc() (bsc#1226994).
CVE-2024-35843: iommu/vt-d: Use device rbtree in iopf reporting path (bsc#1224751).
CVE-2024-37078: nilfs2: fix potential kernel bug due to lack of writeback flag waiting (bsc#1227066).
CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
CVE-2024-36479: fpga: bridge: add owner module and take its refcount (bsc#1226949).
CVE-2024-37021: fpga: manager: add owner module and take its refcount (bsc#1226950).
CVE-2024-36281: net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules (bsc#1226799).
CVE-2024-38580: epoll: be better about file lifetimes (bsc#1226610).
CVE-2024-36478: null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' (bsc#1226841).
CVE-2024-38636: f2fs: multidev: fix to recognize valid zero block address (bsc#1226879).
CVE-2024-38661: s390/ap: Fix crash in AP internal function modify_bitmap() (bsc#1226996).
CVE-2024-38564: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (bsc#1226789).
CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).
CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
CVE-2024-36917: block: fix overflow in blk_ioctl_discard() (bsc#1225770).
CVE-2024-38627: stm class: Fix a double free in stm_register_device() (bsc#1226857).
CVE-2024-38603: drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset() (bsc#1226842).
CVE-2024-38553: net: fec: remove .ndo_poll_controller to avoid deadlock (bsc#1226744).
CVE-2024-38555: net/mlx5: Discard command completions in internal error (bsc#1226607).
CVE-2024-38556:…

Record: SUSE-SU-2024:2571-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2896-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
CVE-2024-40948: mm/page_table_check: fix crash on ZONE_DEVICE (bsc#1227801). -…

Record: SUSE-SU-2024:2896-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2939-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958).
CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
CVE-2021-47186: tipc: check for null after calling kmemdup (bsc#1222702).
CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
CVE-2021-47546: ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571).
CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len. (bsc#1226555).
CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071).
CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869).
CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
CVE-2023-52787: blk-mq: make…

Record: SUSE-SU-2024:2939-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2973-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
CVE-2023-38417: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225600).
CVE-2023-47210: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225601).
CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
CVE-2023-52458: Fixed check that partition length needs to be aligned with block size (bsc#1220428).
CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
CVE-2023-52631: Fixed an NULL dereference bug (bsc#1222264 CVE-2023-52631).
CVE-2023-52640: Fixed out-of-bounds in ntfs_listxattr (bsc#1222301).
CVE-2023-52641: Fixed NULL ptr dereference checking at the end of attr_allocate_frame() (bsc#1222303)
CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
CVE-2023-52659: Fixed to pfn_to_kaddr() not treated as a 64-bit type (bsc#1224442)
CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
CVE-2023-52699: sysv: don't call sb_bread() with pointers_lock held (bsc#1224659).
CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
CVE-2023-52771: Fixed delete_endpoint() vs parent unregistration race (bsc#1225007).
CVE-2023-52772: Fixed use-after-free in unix_stream_read_actor() (bsc#1224989).
CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
CVE-2023-52786: ext4: fix racy may inline data check in dio write (bsc#1224939).
CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
CVE-2023-52855: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (bsc#1225583).
CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
CVE-2023-6238: Fixed kcalloc() arguments order (bsc#1217384).
CVE-2024-21823: Fixed safety flag to struct ends (bsc#1223625).
CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
CVE-2024-26623: pds_core: Prevent race issues involving the adminq (bsc#1221057).
CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086) -…

Record: SUSE-SU-2024:2973-1
Updated: 2026-11-02

OSVSUSE-SU-2024:3623-1 No score

Security update for the Linux Kernel RT (Live Patch 11 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-150500_13_38 fixes several issues.