CVE-2025-38477

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats.

The Linux Kernel, the operating system core itself.

Security Fix(es):

A vulnerability classified as critical has been found in Linux Kernel up to 6.1.146/6.6.99/6.12.39/6.15.7 (Operating System).CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 6.1.147, 6.6.100, 6.12.40 or 6.15.8 eliminates this vulnerability. Applying the patch 466e10194ab81caa2ee6a332d33ba16bcceeeba6/fbe48f06e64134dfeafa89ad23387f66ebca3527/a6d735100f602c830c16d69fb6d780eebd8c9ae1/c000a3a330d97f6c073ace5aa5faf94b9adb4b79/5e28d5a3f774f118896aec17a3a20a9c5c9dfc64 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-38477)

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

media: davinci: vpif: fix use-after-free on driver unbind

The driver allocates and registers two platform device structures during probe, but the devices were never deregistered on driver unbind.

This results in a use-after-free on driver unbind as the device structures were allocated using devres and would be freed by driver core when remove() returns.

Fix this by adding the missing deregistration calls to the remove() callback and failing probe on registration errors.

Note that the platform device structures must be freed using a proper release callback to avoid leaking associated resources like device names.(CVE-2021-47653)

In the Linux kernel, the following vulnerability has been resolved:

mmc: core: use sysfs_emit() instead of sprintf()

sprintf() (still used in the MMC core for the sysfs output) is vulnerable to the buffer overflow. Use the new-fangled sysfs_emit() instead.

Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.(CVE-2022-49267)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event

We should not access skb buffer data anymore after hci_recv_frame was called.

[ 39.634809] BUG: KASAN: use-after-free in btmtksdio_recv_event+0x1b0 [ 39.634855] Read of size 1 at addr ffffff80cf28a60d by task kworker [ 39.634962] Call trace: [ 39.634974] dump_backtrace+0x0/0x3b8 [ 39.634999] show_stack+0x20/0x2c [ 39.635016] dump_stack_lvl+0x60/0x78 [ 39.635040] print_address_description+0x70/0x2f0 [ 39.635062] kasan_report+0x154/0x194 [ 39.635079] __asan_report_load1_noabort+0x44/0x50 [ 39.635099] btmtksdio_recv_event+0x1b0/0x1c4 [ 39.635129] btmtksdio_txrx_work+0x6cc/0xac4 [ 39.635157] process_one_work+0x560/0xc5c [ 39.635177] worker_thread+0x7ec/0xcc0 [ 39.635195] kthread+0x2d0/0x3d0 [ 39.635215] ret_from_fork+0x10/0x20 [ 39.635247] Allocated by task 0: [ 39.635260] (stack is not available) [ 39.635281] Freed by task 2392: [ 39.635295] kasan_save_stack+0x38/0x68 [ 39.635319] kasan_set_track+0x28/0x3c [ 39.635338] kasan_set_free_info+0x28/0x4c [ 39.635357] ____kasan_slab_free+0x104/0x150 [ 39.635374] __kasan_slab_free+0x18/0x28 [ 39.635391] slab_free_freelist_hook+0x114/0x248 [ 39.635410] kfree+0xf8/0x2b4 [ 39.635427] skb_free_head+0x58/0x98 [ 39.635447] skb_release_data+0x2f4/0x410 [ 39.635464] skb_release_all+0x50/0x60 [ 39.635481] kfree_skb+0xc8/0x25c [ 39.635498] hci_event_packet+0x894/0xca4 [bluetooth] [ 39.635721] hci_rx_work+0x1c8/0x68c [bluetooth] [ 39.635925] process_one_work+0x560/0xc5c [ 39.635951] worker_thread+0x7ec/0xcc0 [ 39.635970] kthread+0x2d0/0x3d0 [ 39.635990] ret_from_fork+0x10/0x20 [ 39.636021] The buggy address belongs to the object at ffffff80cf28a600 which belongs to the cache kmalloc-512 of size 512 [ 39.636039] The buggy address is located 13 bytes inside of 512-byte region [ffffff80cf28a600, ffffff80cf28a800)(CVE-2022-49470)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix use-after-free

Fix potential use-after-free in l2cap_le_command_rej.(CVE-2023-53305)

In the Linux kernel, the following vulnerability has been resolved:

ip6mr: Fix skb_under_panic in ip6mr_cache_report()

skbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4 head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:192! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 2 PID: 22968 Comm: kworker/2:11 Not tainted 6.5.0-rc3-00044-g0a8db05b571a #236 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP:…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

media: davinci: vpif: fix use-after-free on driver unbind

The driver allocates and registers two platform device structures during probe, but the devices were never deregistered on driver unbind.

This results in a use-after-free on driver unbind as the device structures were allocated using devres and would be freed by driver core when remove() returns.

Fix this by adding the missing deregistration calls to the remove() callback and failing probe on registration errors.

Note that the platform device structures must be freed using a proper release callback to avoid leaking associated resources like device names.(CVE-2021-47653)

In the Linux kernel, the following vulnerability has been resolved:

mmc: core: use sysfs_emit() instead of sprintf()

sprintf() (still used in the MMC core for the sysfs output) is vulnerable to the buffer overflow. Use the new-fangled sysfs_emit() instead.

Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.(CVE-2022-49267)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event

We should not access skb buffer data anymore after hci_recv_frame was called.

[ 39.634809] BUG: KASAN: use-after-free in btmtksdio_recv_event+0x1b0 [ 39.634855] Read of size 1 at addr ffffff80cf28a60d by task kworker [ 39.634962] Call trace: [ 39.634974] dump_backtrace+0x0/0x3b8 [ 39.634999] show_stack+0x20/0x2c [ 39.635016] dump_stack_lvl+0x60/0x78 [ 39.635040] print_address_description+0x70/0x2f0 [ 39.635062] kasan_report+0x154/0x194 [ 39.635079] __asan_report_load1_noabort+0x44/0x50 [ 39.635099] btmtksdio_recv_event+0x1b0/0x1c4 [ 39.635129] btmtksdio_txrx_work+0x6cc/0xac4 [ 39.635157] process_one_work+0x560/0xc5c [ 39.635177] worker_thread+0x7ec/0xcc0 [ 39.635195] kthread+0x2d0/0x3d0 [ 39.635215] ret_from_fork+0x10/0x20 [ 39.635247] Allocated by task 0: [ 39.635260] (stack is not available) [ 39.635281] Freed by task 2392: [ 39.635295] kasan_save_stack+0x38/0x68 [ 39.635319] kasan_set_track+0x28/0x3c [ 39.635338] kasan_set_free_info+0x28/0x4c [ 39.635357] ____kasan_slab_free+0x104/0x150 [ 39.635374] __kasan_slab_free+0x18/0x28 [ 39.635391] slab_free_freelist_hook+0x114/0x248 [ 39.635410] kfree+0xf8/0x2b4 [ 39.635427] skb_free_head+0x58/0x98 [ 39.635447] skb_release_data+0x2f4/0x410 [ 39.635464] skb_release_all+0x50/0x60 [ 39.635481] kfree_skb+0xc8/0x25c [ 39.635498] hci_event_packet+0x894/0xca4 [bluetooth] [ 39.635721] hci_rx_work+0x1c8/0x68c [bluetooth] [ 39.635925] process_one_work+0x560/0xc5c [ 39.635951] worker_thread+0x7ec/0xcc0 [ 39.635970] kthread+0x2d0/0x3d0 [ 39.635990] ret_from_fork+0x10/0x20 [ 39.636021] The buggy address belongs to the object at ffffff80cf28a600 which belongs to the cache kmalloc-512 of size 512 [ 39.636039] The buggy address is located 13 bytes inside of 512-byte region [ffffff80cf28a600, ffffff80cf28a800)(CVE-2022-49470)

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Fix handling of lrbp->cmd

ufshcd_queuecommand() may be called two times in a row for a SCSI command before it is completed. Hence make the following changes:

• In the functions that submit a command, do not check the old value of lrbp->cmd nor clear lrbp->cmd in error paths.

• In ufshcd_release_scsi_cmd(), do not clear lrbp->cmd.

See also scsi_send_eh_cmnd().

This commit prevents that the following appears if a command times out:

WARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8 Call trace: ufshcd_queuecommand+0x6f8/0x9a8 scsi_send_eh_cmnd+0x2c0/0x960 scsi_eh_test_devices+0x100/0x314 scsi_eh_ready_devs+0xd90/0x114c …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

jfs: add check read-only before txBeginAnon() call

Added a read-only check before calling txBeginAnon in extAlloc and extRecord. This prevents modification attempts on a read-only mounted filesystem, avoiding potential errors or crashes.

Call trace: txBeginAnon+0xac/0x154 extAlloc+0xe8/0xdec fs/jfs/jfs_extent.c:78 jfs_get_block+0x340/0xb98 fs/jfs/inode.c:248 __block_write_begin_int+0x580/0x166c fs/buffer.c:2128 __block_write_begin fs/buffer.c:2177 [inline] block_write_begin+0x98/0x11c fs/buffer.c:2236 jfs_write_begin+0x44/0x88 fs/jfs/inode.c:299(CVE-2024-58095)

In the Linux kernel, the following vulnerability has been resolved:

mm: zswap: properly synchronize freeing resources during CPU hotunplug

In zswap_compress() and zswap_decompress(), the per-CPU acomp_ctx of the current CPU at the beginning of the operation is retrieved and used throughout. However, since neither preemption nor migration are disabled, it is possible that the operation continues on a different CPU.

If the original CPU is hotunplugged while the acomp_ctx is still in use, we run into a UAF bug as some of the resources attached to the acomp_ctx are freed during hotunplug in zswap_cpu_comp_dead() (i.e. acomp_ctx.buffer, acomp_ctx.req, or acomp_ctx.acomp).

The problem was introduced in commit 1ec3b5fe6eec ("mm/zswap: move to use crypto_acomp API for hardware acceleration") when the switch to the crypto_acomp API was made. Prior to that, the per-CPU crypto_comp was retrieved using get_cpu_ptr() which disables preemption and makes sure the CPU cannot go away from under us. Preemption cannot be disabled with the crypto_acomp API as a sleepable context is needed.

Use the acomp_ctx.mutex to synchronize CPU hotplug callbacks allocating and freeing resources with compression/decompression paths. Make sure that acomp_ctx.req is NULL when the resources are freed. In the compression/decompression paths, check if acomp_ctx.req is NULL after acquiring the mutex (meaning the CPU was offlined) and retry on the new CPU.

The initialization of acomp_ctx.mutex is moved from the CPU hotplug callback to the pool initialization where it belongs (where the mutex is allocated). In addition to adding clarity, this makes sure that CPU hotplug cannot reinitialize a mutex that is already locked by compression/decompression.

Previously a fix was attempted by holding cpus_read_lock() [1]. This would have caused a potential deadlock as it is possible for code already holding the lock to fall into reclaim and enter zswap (causing a deadlock). A fix was also attempted using SRCU for synchronization, but Johannes pointed out that synchronize_srcu() cannot be used in CPU hotplug notifiers [2].

Alternative fixes that were considered/attempted and could have worked:

• Refcounting the per-CPU acomp_ctx. This involves complexity in handling the race between the refcount dropping to zero in zswap_[de]compress() and the refcount being re-initialized when the CPU is onlined.
• Disabling migration before getting the per-CPU acomp_ctx [3], but that's discouraged and is a much bigger hammer than needed, and could result in subtle performance issues.

[1]https://lkml.kernel.org/(CVE-2025-21693)

In the Linux kernel, the following vulnerability has been resolved:

memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove

This fixes the following crash:

================================================================== BUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] Read of size 8 at addr ffff888136335380 by task kworker/6:0/140241

CPU: 6 UID: 0 PID: 140241 Comm: kworker/6:0 Kdump: loaded Tainted: G E 6.14.0-rc6+ #1 Tainted: [E]=UNSIGNED_MODULE Hardware name: LENOVO 30FNA1V7CW/1057, BIOS S0EKT54A 07/01/2024 Workqueue: events…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: Fix uninit-value in nci_rx_work

syzbot reported the following uninit-value access issue [1]

nci_rx_work() parses received packet from ndev->rx_q. It should be validated header size, payload size and total packet size before processing the packet. If an invalid packet is detected, it should be silently discarded.(CVE-2024-38381)

In the Linux kernel, the following vulnerability has been resolved:net: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe()In the prueth_probe() function, if one of the calls to emac_phy_connect()fails due to of_phy_connect() returning NULL, then the subsequent call tophy_attached_info() will dereference a NULL pointer.Check the return code of emac_phy_connect and fail cleanly if there is anerror.(CVE-2024-38584)

In the Linux kernel, the following vulnerability has been resolved:cpufreq: exit() callback is optionalThe exit() callback is optional and shouldn t be called without checkinga valid pointer first.Also, we must clear freq_table pointer even if the exit() callback isn tpresent.(CVE-2024-38615)

In the Linux kernel, the following vulnerability has been resolved:serial: max3100: Update uart_driver_registered on driver removalThe removal of the last MAX3100 device triggers the removal ofthe driver. However, code doesn t update the respective globalvariable and after insmod — rmmod — insmod cycle the kerneloopses: max3100 spi-PRP0001:01: max3100_probe: adding port 0 BUG: kernel NULL pointer dereference, address: 0000000000000408 ... RIP: 0010:serial_core_register_port+0xa0/0x840 ... max3100_probe+0x1b6/0x280 [max3100] spi_probe+0x8d/0xb0Update the actual state so next time UART driver will be registeredagain.Hugo also noticed, that the error path in the probe also affectedby having the variable set, and not cleared. Instead of clearing itmove the assignment after the successfull uart_register_driver() call.(CVE-2024-38633)

In the Linux kernel, the following vulnerability has been resolved:

enic: Validate length of nl attributes in enic_set_vf_port

enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE is of length PORT_PROFILE_MAX and that the nl attributes IFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID are of length PORT_UUID_MAX. These attributes are validated (in the function do_setlink in rtnetlink.c) using the nla_policy ifla_port_policy. The policy defines IFLA_PORT_PROFILE as NLA_STRING, IFLA_PORT_INSTANCE_UUID as NLA_BINARY and IFLA_PORT_HOST_UUID as NLA_STRING. That means that the length validation using the policy is for the max size of the attributes and not on exact size so the length of these attributes might be less than the sizes that enic_set_vf_port expects. This might cause an out of bands read access in the memcpys of the data of these attributes in enic_set_vf_port.(CVE-2024-38659)

In the Linux kernel, the following vulnerability has been resolved:riscv: prevent pt_regs corruption for secondary idle threadsTop of the kernel thread stack should be reserved for pt_regs. Howeverthis is not the case for the idle threads of the secondary boot harts.Their stacks overlap with their pt_regs, so both may get corrupted.Similar issue has been fixed for the primary hart, see c7cdd96eca28( riscv: prevent stack corruption by reserving task_pt_regs(p) early ).However that fix was not propagated to the secondary harts. The problemhas been noticed in some CPU hotplug tests with V enabled. The functionsmp_callin stored several registers on stack, corrupting top of pt_regsstructure including status field. As a result, kernel attempted to saveor restore inexistent V context.(CVE-2024-38667)

In the Linux kernel, the following vulnerability has been resolved:jfs: xattr: fix buffer overflow for invalid xattrWhen an xattr size is not what is expected, it is printed out to thekernel log in hex format as a…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint

Patch series "nilfs2: fix null-ptr-deref bugs on block tracepoints".

This series fixes null pointer dereference bugs that occur when using nilfs2 and two block-related tracepoints.

This patch (of 2):

It has been reported that when using "block:block_touch_buffer" tracepoint, touch_buffer() called from __nilfs_get_folio_block() causes a NULL pointer dereference, or a general protection fault when KASAN is enabled.

This happens because since the tracepoint was added in touch_buffer(), it references the dev_t member bh->b_bdev->bd_dev regardless of whether the buffer head has a pointer to a block_device structure. In the current implementation, the block_device structure is set after the function returns to the caller.

Here, touch_buffer() is used to mark the folio/page that owns the buffer head as accessed, but the common search helper for folio/page used by the caller function was optimized to mark the folio/page as accessed when it was reimplemented a long time ago, eliminating the need to call touch_buffer() here in the first place.

So this solves the issue by eliminating the touch_buffer() call itself.(CVE-2024-53131)

In the Linux kernel, the following vulnerability has been resolved:drm: adv7511: Fix use-after-free in adv7533_attach_dsi()The host_node pointer was assigned and freed in adv7533_parse_dt(), andlater, adv7533_attach_dsi() uses the same. Fix this use-after-free issueby dropping of_node_put() in adv7533_parse_dt() and calling of_node_put()in error path of probe() and also in the remove().(CVE-2024-57887)

In the Linux kernel, the following vulnerability has been resolved:ila: serialize calls to nf_register_net_hooks()syzbot found a race in ila_add_mapping() [1]commit 031ae72825ce ( ila: call nf_unregister_net_hooks() sooner )attempted to fix a similar issue.Looking at the syzbot repro, we have concurrent ILA_CMD_ADD commands.Add a mutex to make sure at most one thread is calling nf_register_net_hooks().[1] BUG: KASAN: slab-use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] BUG: KASAN: slab-use-after-free in __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604Read of size 4 at addr ffff888028f40008 by task dhcpcd/5501CPU: 1 UID: 0 PID: 5501 Comm: dhcpcd Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024Call Trace: <IRQ> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xc3/0x620 mm/kasan/report.c:489 kasan_report+0xd9/0x110 mm/kasan/report.c:602 rht_key_hashfn include/linux/rhashtable.h:159 [inline] __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604 rhashtable_lookup include/linux/rhashtable.h:646 [inline] rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline] ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:127 [inline] ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline] ila_nf_input+0x1ee/0x620 net/ipv6/ila/ila_xlat.c:185 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xbb/0x200 net/netfilter/core.c:626 nf_hook.constprop.0+0x42e/0x750 include/linux/netfilter.h:269 NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0xa4/0x680 net/ipv6/ip6_input.c:309 __netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5672 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5785 process_backlog+0x443/0x15f0 net/core/dev.c:6117 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6883 napi_poll net/core/dev.c:6952 [inline] net_rx_action+0xa94/0x1010 net/core/dev.c:7074 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] …

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211)

• kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332)

• kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464)

• kernel: net/sched: sch_qfq: Fix race condition on qfq_aggregate (CVE-2025-38477)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2025-38477 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2025-38477 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-38477 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2025-38477 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211)
• kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332)
• kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464)
• kernel: net/sched: sch_qfq: Fix race condition on qfq_aggregate (CVE-2025-38477)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_qfq: Fix race condition on qfq_aggregate

A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free.

This patch addresses the issue by:

1. Moved qfq_destroy_class into the critical section.

2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats.

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_qfq: Fix race condition on qfq_aggregate

A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free.

This patch addresses the issue by:

1. Moved qfq_destroy_class into the critical section.

2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats.

• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982}
• nfsd: fix race between laundromat and free_stateid {CVE-2024-50106}
• nfsd: split sc_status out of sc_type {CVE-2024-50106}
• nfsd: avoid race after unhash_delegation_locked() {CVE-2024-50106}
• nfsd: don't call functions with side-effecting inside WARN_ON() {CVE-2024-50106}
• can: peak_usb: fix use after free bugs {CVE-2021-47670}
• wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}
• i2c/designware: Fix an initialization issue {CVE-2025-38380}
• RDMA/rxe: Fix error unwind in rxe_create_qp() {CVE-2022-50127}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
• udp: Fix memory accounting leak. {CVE-2025-22058}
• Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
• net_sched: ets: Fix double list add in class with netem as child qdisc {CVE-2025-38085}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• mm/khugepaged: fix GUP-fast interaction by sending IPI {CVE-2025-38085}
• padata: fix UAF in padata_reorder {CVE-2025-21727}
• net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
• codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-38177}
• sch_ets: make est_qlen_notify() idempotent {CVE-2025-38177}
• sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38177}
• sch_htb: make htb_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
• tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
• RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• netfilter: xtables: avoid NFPROTO_UNSPEC where needed {CVE-2024-50038}
• netfilter: xtables: Add snapshot of hardidletimer target {CVE-2024-50038}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890}
• net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273}
• net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052}
• memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove {CVE-2025-22020}

• inet: fully convert sk->sk_rx_dst to RCU rules {CVE-2021-47103}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• can: peak_usb: fix use after free bugs {CVE-2021-47670}
• wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}
• RDMA/rxe: Fix error unwind in rxe_create_qp() {CVE-2022-50127}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
• udp: Fix memory accounting leak. {CVE-2025-22058}
• ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50083}
• ext4: correct the misjudgment in ext4_iget_extra_inode {CVE-2022-50083}
• ext4: correct max_inline_xattr_value_size computing {CVE-2022-50083}
• ext4: fix use-after-free in ext4_xattr_set_entry {CVE-2022-50083}
• ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h {CVE-2022-50083}
• Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
• net_sched: ets: Fix double list add in class with netem as child qdisc {CVE-2025-38085}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• padata: fix UAF in padata_reorder {CVE-2025-21727}
• net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
• codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-38177}
• sch_ets: make est_qlen_notify() idempotent {CVE-2025-38177}
• sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38177}
• sch_htb: make htb_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• mptcp: do not queue data on closed subflows {CVE-2022-50070}
• mptcp: export mptcp_subflow_active {CVE-2022-50070}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
• tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
• RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273}
• ice: xsk: prohibit usage of non-balanced queue id {CVE-2022-50003}
• net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052}
• virtio-gpu: fix a missing check to avoid NULL dereference {CVE-2022-50181}
• usb: xhci_plat_remove: avoid NULL dereference {CVE-2022-50133}
• ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot {CVE-2022-50015}
• netfilter: nft_tproxy: restrict to prerouting hook {CVE-2022-50001}
• scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq {CVE-2022-49986}
• ath11k: fix netdev open race {CVE-2022-50187}

• inet: fully convert sk->sk_rx_dst to RCU rules {CVE-2021-47103}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• can: peak_usb: fix use after free bugs {CVE-2021-47670}
• wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}
• RDMA/rxe: Fix error unwind in rxe_create_qp() {CVE-2022-50127}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
• udp: Fix memory accounting leak. {CVE-2025-22058}
• ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50083}
• ext4: correct the misjudgment in ext4_iget_extra_inode {CVE-2022-50083}
• ext4: correct max_inline_xattr_value_size computing {CVE-2022-50083}
• ext4: fix use-after-free in ext4_xattr_set_entry {CVE-2022-50083}
• ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h {CVE-2022-50083}
• Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
• net_sched: ets: Fix double list add in class with netem as child qdisc {CVE-2025-38085}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• padata: fix UAF in padata_reorder {CVE-2025-21727}
• net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
• codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-38177}
• sch_ets: make est_qlen_notify() idempotent {CVE-2025-38177}
• sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38177}
• sch_htb: make htb_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• mptcp: do not queue data on closed subflows {CVE-2022-50070}
• mptcp: export mptcp_subflow_active {CVE-2022-50070}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
• tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
• RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890}
• net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273}
• ice: xsk: prohibit usage of non-balanced queue id {CVE-2022-50003}
• net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052}
• virtio-gpu: fix a missing check to avoid NULL dereference {CVE-2022-50181}
• usb: xhci_plat_remove: avoid NULL dereference {CVE-2022-50133}
• ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot {CVE-2022-50015}
• netfilter: nft_tproxy: restrict to prerouting hook {CVE-2022-50001}
• scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq {CVE-2022-49986}
• ath11k: fix netdev open race {CVE-2022-50187}

• CVE-url: https://ubuntu.com/security/CVE-2022-43945
  • NFSD: Protect against send buffer overflow in NFSv3 READ
• CVE-url: https://ubuntu.com/security/CVE-2025-21796
  • nfsd: clear acl_access/acl_default after releasing them
• CVE-url: https://ubuntu.com/security/CVE-2022-48827
  • NFSD: Fix the behavior of READ near OFFSET_MAX
• CVE-url: https://ubuntu.com/security/CVE-2025-38477
  • net/sched: sch_qfq: Fix race condition on qfq_aggregate
  • net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
• CVE-url: https://ubuntu.com/security/CVE-2025-38618
  • vsock: Do not allow binding to VMADDR_PORT_ANY
• CVE-url: https://ubuntu.com/security/CVE-2025-38617
  • net/packet: fix a race in packet_set_ring() and packet_notifier()
• CVE-url: https://ubuntu.com/security/CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
• CVE-url: https://ubuntu.com/security/CVE-2024-41069
  • ASoC: topology: Fix references to freed memory
  • ASoC: topology: Do not assign fields that are already set
  • ASoC: topology: Clean up route loading
• CVE-url: https://ubuntu.com/security/CVE-2024-56616
  • drm/dp_mst: Fix MST sideband message body length check
• CVE-url: https://ubuntu.com/security/CVE-2024-35932
  • drm/vc4: don't check if plane->state->fb == state->fb
• CVE-url: https://ubuntu.com/security/CVE-2025-38350
  • net/sched: Always pass notifications when child class becomes empty

• CVE-url: https://ubuntu.com/security/CVE-2022-43945
  • NFSD: Protect against send buffer overflow in NFSv3 READ
• Focal update: v5.4.285 upstream stable release (LP: #2089233) // CVE-2024-49924 // CVE-url: https://ubuntu.com/security/CVE-2024-49924
  • fbdev: pxafb: Fix possible use after free in pxafb_task()
• CVE-url: https://ubuntu.com/security/CVE-2025-38477
  • net/sched: sch_qfq: Fix race condition on qfq_aggregate
  • net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
• CVE-url: https://ubuntu.com/security/CVE-2025-38618
  • vsock: Do not allow binding to VMADDR_PORT_ANY
• CVE-url: https://ubuntu.com/security/CVE-2025-38617
  • net/packet: fix a race in packet_set_ring() and packet_notifier()
• CVE-url: https://ubuntu.com/security/CVE-2025-21796
  • nfsd: clear acl_access/acl_default after releasing them
• CVE-url: https://ubuntu.com/security/CVE-2022-48827
  • NFSD: Fix the behavior of READ near OFFSET_MAX
• CVE-url: https://ubuntu.com/security/CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
• CVE-url: https://ubuntu.com/security/CVE-2024-41069
  • ASoC: topology: Fix references to freed memory
  • ASoC: topology: Do not assign fields that are already set
  • ASoC: topology: Clean up route loading
• CVE-url: https://ubuntu.com/security/CVE-2024-56616
  • drm/dp_mst: Fix MST sideband message body length check
• Focal update: v5.4.261 upstream stable release (LP: #2049049) // CVE-url: https://ubuntu.com/security/CVE-2023-52868
  • thermal: core: prevent potential string overflow
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52836
  • locking/ww_mutex/test: Fix potential workqueue corruption
• CVE-2024-35965 // CVE-url: https://ubuntu.com/security/CVE-2024-35965
  • Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()
  • Bluetooth: L2CAP: Fix not validating setsockopt user input
• Focal update: v5.4.188 upstream stable release (LP: #1971496) // CVE-url: https://ubuntu.com/security/CVE-2022-49292
  • ALSA: oss: Fix PCM OSS buffer allocation overflow
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52835
  • perf/core: Bail out early if the request AUX area is out of bound
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52764
  • media: gspca: cpia1: shift-out-of-bounds in set_flicker
• Focal update: v5.4.261 upstream stable release (LP: #2049049) // CVE-url: https://ubuntu.com/security/CVE-2023-52864
  • platform/x86: wmi: Fix probe failure when failing to register WMI devices
  • platform/x86: wmi: remove unnecessary initializations
  • platform/x86: wmi: Fix opening of char device
• CVE-2024-35966 // CVE-url: https://ubuntu.com/security/CVE-2024-35966
  • Bluetooth: RFCOMM: Fix not validating setsockopt user input
• CVE-2024-35967 // CVE-url: https://ubuntu.com/security/CVE-2024-35966
  • Bluetooth: SCO: Fix not validating setsockopt user input
• Focal update: v5.4.291 upstream stable release (LP: #2106002) // CVE-2025-21704 // CVE-url: https://ubuntu.com/security/CVE-2025-21704
  • usb: cdc-acm: Check control transfer buffer size before access
• CVE-url: https://ubuntu.com/security/CVE-2025-38350
  • net/sched: Always pass notifications when child class becomes empty
• CVE-url: https://ubuntu.com/security/CVE-2025-37798
  • sch_htb: make htb_qlen_notify() idempotent

[ Ubuntu: 4.15.0-252.263 ]

• CVE-url: https://ubuntu.com/security/CVE-2022-43945
  • NFSD: Protect against send buffer overflow in NFSv3 READ
• Focal update: v5.4.285 upstream stable release (LP: #2089233) // CVE-2024-49924 // CVE-url: https://ubuntu.com/security/CVE-2024-49924
  • fbdev: pxafb: Fix possible use after free in pxafb_task()
• CVE-url: https://ubuntu.com/security/CVE-2025-38477
  • net/sched: sch_qfq: Fix race condition on qfq_aggregate
  • net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
• CVE-url: https://ubuntu.com/security/CVE-2025-38618
  • vsock: Do not allow binding to VMADDR_PORT_ANY
• CVE-url: https://ubuntu.com/security/CVE-2025-38617
  • net/packet: fix a race in packet_set_ring() and packet_notifier()
• CVE-url: https://ubuntu.com/security/CVE-2025-21796
  • nfsd: clear acl_access/acl_default after releasing them
• CVE-url: https://ubuntu.com/security/CVE-2022-48827
  • NFSD: Fix the behavior of READ near OFFSET_MAX
• CVE-url: https://ubuntu.com/security/CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
• CVE-url: https://ubuntu.com/security/CVE-2024-41069
  • ASoC: topology: Fix references to freed memory
  • ASoC: topology: Do not assign fields that are already set
  • ASoC: topology: Clean up route loading
• CVE-url: https://ubuntu.com/security/CVE-2024-56616
  • drm/dp_mst: Fix MST sideband message body length check
• Focal update: v5.4.261 upstream stable release (LP: #2049049) // CVE-url: https://ubuntu.com/security/CVE-2023-52868
  • thermal: core: prevent potential string overflow
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52836
  • locking/ww_mutex/test: Fix potential workqueue corruption
• CVE-2024-35965 // CVE-url: https://ubuntu.com/security/CVE-2024-35965
  • Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()
  • Bluetooth: L2CAP: Fix not validating setsockopt user input
• Focal update: v5.4.188 upstream stable release (LP: #1971496) // CVE-url: https://ubuntu.com/security/CVE-2022-49292
  • ALSA: oss: Fix PCM OSS buffer allocation overflow
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52835
  • perf/core: Bail out early if the request AUX area is out of bound
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52764
  • media: gspca: cpia1: shift-out-of-bounds in set_flicker
• Focal update: v5.4.261 upstream stable release (LP: #2049049) // CVE-url: https://ubuntu.com/security/CVE-2023-52864
  • platform/x86: wmi: Fix probe failure when failing to register WMI devices
  • platform/x86: wmi: remove unnecessary initializations
  • platform/x86: wmi: Fix opening of char device
• CVE-2024-35966 // CVE-url: https://ubuntu.com/security/CVE-2024-35966
  • Bluetooth: RFCOMM: Fix not validating setsockopt user input
• CVE-2024-35967 // CVE-url: https://ubuntu.com/security/CVE-2024-35966
  • Bluetooth: SCO: Fix not validating setsockopt user input
• Focal update: v5.4.291 upstream stable release (LP: #2106002) // CVE-2025-21704 // CVE-url: https://ubuntu.com/security/CVE-2025-21704
  • usb: cdc-acm: Check control transfer buffer size before access
• CVE-url: https://ubuntu.com/security/CVE-2025-38350
  • net/sched: Always pass notifications when child class becomes empty
• CVE-url: https://ubuntu.com/security/CVE-2025-37798
  • sch_htb: make htb_qlen_notify() idempotent

• ext4: fix possible UAF when remounting r/o a mmp-protected file system {CVE-2021-47342}
• ext4: fix memory leak in ext4_fill_super
• net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
• ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() {CVE-2022-48701}
• fix: virtio-net: Add validation for used length {CVE-2021-47352}

• ext4: fix possible UAF when remounting r/o a mmp-protected file system {CVE-2021-47342}
• ext4: fix memory leak in ext4_fill_super
• net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
• ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() {CVE-2022-48701}
• fix: virtio-net: Add validation for used length {CVE-2021-47352}

• ext4: fix possible UAF when remounting r/o a mmp-protected file system {CVE-2021-47342}
• ext4: fix memory leak in ext4_fill_super
• net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
• ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() {CVE-2022-48701}
• fix: virtio-net: Add validation for used length {CVE-2021-47352}

• fix: virtio-net: Add validation for used length {CVE-2021-47352}
• xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
• net: fix information leakage in /proc/net/ptype {CVE-2022-48757}
• net: atm: fix use after free in lec_send() {CVE-2025-22004}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292}

• fix: virtio-net: Add validation for used length {CVE-2021-47352}
• xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
• net: fix information leakage in /proc/net/ptype {CVE-2022-48757}
• net: atm: fix use after free in lec_send() {CVE-2025-22004}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292}

• Focal update: v5.4.291 upstream stable release (LP: #2106002) // CVE-2025-21772
  • partitions: mac: fix handling of bogus partition table
• CVE-url: https://ubuntu.com/security/CVE-2025-22079
  • ocfs2: validate l_tree_depth to avoid out-of-bounds access
• CVE-url: https://ubuntu.com/security/CVE-2024-58014
  • wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
• CVE-url: https://ubuntu.com/security/CVE-2024-41042
  • netfilter: nf_tables: prefer nft_chain_validate
• CVE-url: https://ubuntu.com/security/CVE-2024-46713
  • perf/aux: Fix AUX buffer serialization
• CVE-url: https://ubuntu.com/security/CVE-2025-38352
  • posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
• CVE-url: https://ubuntu.com/security/CVE-2025-38477
  • net/sched: sch_qfq: Fix race condition on qfq_aggregate
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52804
  • fs/jfs: Add check for negative db_l2nbperpage
  • fs/jfs: Add validity check for db_maxag and db_agpref
• Focal update: v5.4.251 upstream stable release (LP: #2034918) // CVE-url: https://ubuntu.com/security/CVE-2023-52804
  • jfs: jfs_dmap: Validate db_l2nbperpage while mounting
• Bionic update: upstream stable patchset 2023-02-06 (LP: #2006403) // CVE- url: https://ubuntu.com/security/CVE-2023-52804
  • fs: jfs: fix shift-out-of-bounds in dbAllocAG
• CVE-url: https://ubuntu.com/security/CVE-2022-25265
  • x86/elf: Add table to document READ_IMPLIES_EXEC
  • x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK
  • x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit
• Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740) // CVE- url: https://ubuntu.com/security/CVE-2021-47153
  • i2c: i801: Don't generate an interrupt on bus reset
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48757
  • net: fix information leakage in /proc/net/ptype
• Focal update: v5.4.279 upstream stable release (LP: #2073621) // CVE-url: https://ubuntu.com/security/CVE-2024-37078
  • nilfs2: fix potential kernel bug due to lack of writeback flag waiting
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48760
  • USB: core: Fix hang in usb_kill_urb by adding memory barriers
• Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE- url: https://ubuntu.com/security/CVE-2021-47383
  • tty: Fix out-of-bound vmalloc access in imageblit
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE- url: https://ubuntu.com/security/CVE-2022-49145
  • ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
• Bionic update: upstream stable patchset 2021-11-23 (LP: #1951997) // CVE- url: https://ubuntu.com/security/CVE-2021-47458
  • ocfs2: mount fails with buffer overflow in strlen
• CVE-url: https://ubuntu.com/security/CVE-2022-49170
  • f2fs: fix to do sanity check on curseg->alloc_type
• CVE-url: https://ubuntu.com/security/CVE-2021-47479
  • staging: rtl8712: fix use-after-free in rtl8712_dl_fw
• Bionic update: upstream stable patchset 2021-12-03 (LP: #1953202) // CVE- url: https://ubuntu.com/security/CVE-2021-47477
  • comedi: dt9812: fix DMA buffers on stack
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE- url: https://ubuntu.com/security/CVE-2021-47642
  • video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
• Bionic update: upstream stable patchset 2022-01-06 (LP: #1956614) // CVE- url: https://ubuntu.com/security/CVE-2021-47565
  • scsi: mpt3sas: Fix kernel panic during drive powercycle test
• Bionic update: upstream stable patchset 2022-01-06…

• drm/amd/display: Skip on writeback when it's not applicable {CVE-2024-36914}
• ASoC: topology: Fix references to freed memory {CVE-2024-41069}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: SCO: Fix not validating setsockopt user input
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
• Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
• net/rds: Fix rs_recv_pending counting issue
• LTS tag: v5.4.301
• net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
• media: s5p-mfc: remove an unused/uninitialized variable
• NFSD: Fix last write offset handling in layoutcommit
• NFSD: Minor cleanup in layoutcommit processing
• padata: Reset next CPU when reorder sequence wraps around
• KEYS: trusted_tpm1: Compare HMAC values in constant time
• NFSD: Define a proc_layoutcommit for the FlexFiles layout type {CVE-2025-40087}
• vfs: Don't leak disconnected dentries on umount {CVE-2025-40105}
• jbd2: ensure that all ongoing I/O complete before freeing blocks
• ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
• drm/amdgpu: use atomic functions with memory barriers for vm fault info
• ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() {CVE-2025-40198}
• spi: cadence-quadspi: Flush posted register writes before DAC access
• spi: cadence-quadspi: Flush posted register writes before INDAC access
• memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
• memory: samsung: exynos-srom: Correct alignment
• arm64: errata: Apply workarounds for Neoverse-V3AE
• arm64: cputype: Add Neoverse-V3AE definitions
• comedi: fix divide-by-zero in comedi_buf_munge() {CVE-2025-40106}
• binder: remove "invalid inc weak" check
• xhci: dbc: enable back DbC in resume if it was enabled before suspend
• usb/core/quirks: Add Huawei ME906S to wakeup quirk
• USB: serial: option: add Telit FN920C04 ECM compositions
• USB: serial: option: add Quectel RG255C
• USB: serial: option: add UNISOC UIS7720
• net: ravb: Ensure memory write completes before ringing TX doorbell
• net: usb: rtl8150: Fix frame padding
• ocfs2: clear extent cache after moving/defragmenting extents
• MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
• Revert "cpuidle: menu: Avoid discarding useful information"
• net: bonding: fix possible peer notify event loss or dup issue
• sctp: avoid NULL dereference when chunk data buffer is missing
• arm64, mm: avoid always making PTE dirty in pte_mkwrite()
• net: enetc: correct the value of ENETC_RXB_TRUESIZE
• rtnetlink: Allow deleting FDB entries in user namespace
• net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
• net: add ndo_fdb_del_bulk
• net: rtnetlink: add bulk delete support flag
• net: netlink: add NLM_F_BULK delete request modifier
• net: rtnetlink: use BIT for flag values
• net: rtnetlink: add helper to extract msg type's kind
• net: rtnetlink: add msg kind names
• net: rtnetlink: remove redundant assignment to variable err
• m68k: bitops: Fix find_*_bit() signatures
• hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
• hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
• dlm: check for defined force value in dlm_lockspace_release
• hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
• hfs: validate record offset in hfsplus_bmap_alloc
• hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
• hfs: make proper initalization of struct hfs_find_data
• hfs: clear offset and space out of valid records in b-tree node
• exec: Fix incorrect type for ret
• hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() {CVE-2025-40088}
• ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
• sched/fair: Fix pelt lost idle time…

• CVE-2025-39743
  • jfs: truncate good inode pages when hard link is 0 {CVE-2025-39743}
• CVE-2025-39685
  • comedi: pcl726: Prevent invalid irq number {CVE-2025-39685}
• CVE-2025-38713
  • hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() {CVE-2025-38713}
• CVE-2025-38699
  • scsi: bfa: Double-free fix {CVE-2025-38699}
• CVE-2025-38697
  • jfs: upper bound check of tree index in dbAllocAG {CVE-2025-38697}
• CVE-2025-38680
  • media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
• CVE-2025-38677
  • f2fs: fix to avoid out-of-boundary access in dnode page {CVE-2025-38677}
• CVE-2025-38572
  • ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
• CVE-2025-38538
  • dmaengine: nbpfaxi: Fix memory corruption in probe() {CVE-2025-38538}
• CVE-2025-38530
  • comedi: pcl812: Fix bit shift out of bounds {CVE-2025-38530}
• CVE-2025-38529
  • comedi: aio_iiro_16: Fix bit shift out of bounds {CVE-2025-38529}
• CVE-2025-38494
  • HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• CVE-2025-38482
  • comedi: das6402: Fix bit shift out of bounds {CVE-2025-38482}
• CVE-2025-38428
  • Input: ims-pcu - check record size in ims_pcu_flash_firmware() {CVE-2025-38428}
• CVE-2025-38416
  • NFC: nci: uart: Set tty->disc_data only in success path {CVE-2025-38416}
• CVE-2025-38415
  • Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• CVE-2025-38403
  • vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
• CVE-2025-38286
  • pinctrl: at91: Fix possible out-of-boundary access {CVE-2025-38286}
• CVE-2025-38245
  • atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
• CVE-2025-38212
  • ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}
• CVE-2025-38204
  • jfs: fix array-index-out-of-bounds read in add_missing_indices {CVE-2025-38204}
• CVE-2025-38157
  • wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• CVE-2025-38079
  • crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• CVE-2025-38051
  • smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• CVE-2023-53676
  • scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• CVE-2023-53675
  • scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
• CVE-2023-53668
  • ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• CVE-2023-53622
  • gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• CVE-2023-53616
  • jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount {CVE-2023-53616}
• CVE-2023-53608
  • nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() {CVE-2023-53608}
• CVE-2023-53587
  • ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• CVE-2023-53569
  • ext2: Check block size validity during mount {CVE-2023-53569}
• CVE-2023-53559
  • ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559}
• CVE-2023-53541
  • mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write {CVE-2023-53541}
• CVE-2023-53521
  • scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521}
• CVE-2023-53506
  • udf: Do not bother merging very long extents {CVE-2023-53506}
• CVE-2023-53485
  • fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev {CVE-2023-53485}
• CVE-2023-53484
  • lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
• CVE-2023-53454
  • HID: multitouch: Correct devm device reference for hidinput input_dev name…

Vanilla upstream kernel version 6.6.101 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

Upstream kernel version 6.6.101 fixes bugs and vulnerabilities. The kmod-virtualbox, kmod-xtables-addons & wireless-regdb packages have been updated to work with this new kernel. For information about the vulnerabilities see the links.

The SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2024-57891: sched_ext: Fix invalid irq restore in scx_ops_bypass() (bsc#1235953).
• CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug (bsc#1237108).
• CVE-2024-57952: Revert "libfs: fix infinite directory reads for offset dir" (bsc#1237131).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22034: mm/rmap: avoid -EBUSY from make_device_exclusive() (bsc#1241435).
• CVE-2025-22077: Revert "smb: client: fix TCP timers deadlock after rmmod" (bsc#1241403).
• CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
• CVE-2025-37821: sched/eevdf: Fix se->slice being set to U64_MAX and resulting (bsc#1242864).
• CVE-2025-37849: KVM: arm64: Tear down vGIC on failed vCPU creation (bsc#1243000).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38019: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (bsc#1245000).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38038: cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (bsc#1244812).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
• CVE-2025-38101: ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (bsc#1245659).
• CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
• CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
• CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
• CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
• CVE-2025-38168: perf: arm-ni: Unregister PMUs on probe failure (bsc#1245763).
• CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
• CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
• CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
• CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
• CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
• CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
• CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
• CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
• CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).
• CVE-2025-38242: mm: userfaultfd: fix race of userfaultfd_move and swap…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46984: Fixed an out of bounds access in kyber_bio_merge() in kyber (bsc#1220631).
• CVE-2021-46987: btrfs: fix deadlock when cloning inline extents and using qgroups (bsc#1220704).
• CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference (bsc#1205711).
• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-49319: iommu/arm-smmu-v3: check return value after calling platform_get_resource() (bsc#1238374).
• CVE-2022-49323: iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() (bsc#1238400).
• CVE-2022-49768: 9p/fd: fix issue of list_del corruption in p9_fd_cancel() (bsc#1242446).
• CVE-2022-49825: ata: libata-transport: fix error handling in ata_tport_add() (bsc#1242548).
• CVE-2022-49934: wifi: mac80211: Fix UAF in ieee80211_scan_rx() (bsc#1245051).
• CVE-2022-49948: vt: Clear selection before changing the font (bsc#1245058).
• CVE-2022-49969: drm/amd/display: clear optc underflow before turn off odm clock (bsc#1245060).
• CVE-2022-49993: loop: Check for overflow while configuring loop (bsc#1245121).
• CVE-2022-50025: cxl: Fix a memory leak in an error handling path (bsc#1245132).
• CVE-2022-50027: scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE (bsc#1245073).
• CVE-2022-50030: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input (bsc#1245265).
• CVE-2022-50033: usb: host: ohci-ppc-of: Fix refcount leak bug (bsc#1245139).
• CVE-2022-50103: sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed (bsc#1244840).
• CVE-2022-50149: driver core: fix potential deadlock in __driver_attach (bsc#1244883).
• CVE-2022-50226: crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak (bsc#1244860).
• CVE-2023-2176: Fixed an out-of-boundary read in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA (bsc#1210629).
• CVE-2023-52878: can: dev: can_put_echo_skb(): do not crash kernel if can_priv::echo_skb is accessed out of bounds (bsc#1225000).
• CVE-2023-53020: l2tp: close all race conditions in l2tp_tunnel_register() (bsc#1240224).
• CVE-2023-53117: fs: prevent out-of-bounds array speculation when closing a file descriptor (bsc#1242780).
• CVE-2023-53118: scsi: core: Fix a procfs host directory removal regression (bsc#1242365).
• CVE-2024-26974: crypto: qat - resolve race condition during AER recovery (bsc#1223638).
• CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).
• CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
• CVE-2025-21731: nbd: do not allow reconnect after disconnect (bsc#1237881).
• CVE-2025-21928: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (bsc#1240722).
• CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
• CVE-2025-38040: serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (bsc#1245078).
• CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
• CVE-2025-38058: __legitimize_mnt(): check for…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2023-52923: netfilter: nf_tables: split async and sync catchall in two functions (bsc#1236104).
• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2023-53117: fs: prevent out-of-bounds array speculation when closing a file descriptor (bsc#1242780).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
• CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
• CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept (bsc#1245217).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246000).
• CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).
• CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246073).
• CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).
• CVE-2025-38213: vgacon: Add check for vc_origin address range in vgacon_scroll() (bsc#1246037).
• CVE-2025-38257: s390/pkey: Prevent overflow in size calculation for memdup_user() (bsc#1246186).
• CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).
• CVE-2025-38468: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (bsc#1247437).
• CVE-2025-38477: net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (bsc#1247314).
• CVE-2025-38494: HID: core: do not bypass hid_hw_raw_request (bsc#1247349).
• CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the reserved report ID (bsc#1247348).
• CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).

The following non-security bugs were fixed:

• Revert 'hugetlb: unshare some PMDs when splitting VMAs (bsc#1245431).'
• Revert 'mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race'
• Revert 'mm/hugetlb: unshare page tables during VMA split, not before'

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2023-52923: netfilter: nf_tables: split async and sync catchall in two functions (bsc#1236104).
• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2023-53117: fs: prevent out-of-bounds array speculation when closing a file descriptor (bsc#1242780).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
• CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
• CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept (bsc#1245217).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246000).
• CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).
• CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246073).
• CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).
• CVE-2025-38213: vgacon: Add check for vc_origin address range in vgacon_scroll() (bsc#1246037).
• CVE-2025-38257: s390/pkey: Prevent overflow in size calculation for memdup_user() (bsc#1246186).
• CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).
• CVE-2025-38468: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (bsc#1247437).
• CVE-2025-38477: net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (bsc#1247314).
• CVE-2025-38494: HID: core: do not bypass hid_hw_raw_request (bsc#1247349).
• CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the reserved report ID (bsc#1247348).
• CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).

The following non-security bugs were fixed:

• Revert 'hugetlb: unshare some PMDs when splitting VMAs (bsc#1245431).'
• Revert 'mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race'
• Revert 'mm/hugetlb: unshare page tables during VMA split, not before'

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2023-52923: netfilter: nf_tables: split async and sync catchall in two functions (bsc#1236104).
• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2025-21701: net: avoid race between device unregistration and ethnl ops (bsc#1237164).
• CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
• CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
• CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept (bsc#1245217).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246000).
• CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).
• CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246073).
• CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).
• CVE-2025-38213: vgacon: Add check for vc_origin address range in vgacon_scroll() (bsc#1246037).
• CVE-2025-38257: s390/pkey: Prevent overflow in size calculation for memdup_user() (bsc#1246186).
• CVE-2025-38289: scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (bsc#1246287).
• CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).
• CVE-2025-38468: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (bsc#1247437).
• CVE-2025-38477: net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (bsc#1247314).
• CVE-2025-38494: HID: core: do not bypass hid_hw_raw_request (bsc#1247349).
• CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the reserved report ID (bsc#1247348).
• CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).

The following non-security bugs were fixed:

• Revert 'hugetlb: unshare some PMDs when splitting VMAs' (bsc#1245431).
• Revert 'mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race'
• Revert 'mm/hugetlb: unshare page tables during VMA split, not before'
• bnxt_en: Fix GSO type for HW GRO packets on 5750X chips (bsc#1244523).
• net: usb: usbnet: restore usb%d name exception for local mac addresses (bsc#1234480 bsc#1246555).