CVE-2022-2586

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

The Linux Kernel, the operating system core itself.

Security Fix(es):

A race condition in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc.(CVE-2022-1729)

A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the time of table deletion, possibly leading to local privilege escalation.(CVE-2022-2586)

Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5(CVE-2022-2503)

An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory.(CVE-2022-1462)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A race condition in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc.(CVE-2022-1729)

A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the time of table deletion, possibly leading to local privilege escalation.(CVE-2022-2586)

Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5(CVE-2022-2503)

An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory.(CVE-2022-1462)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by default, it could allow an attacker to crash the system or have other memory-corruption side effects.(CVE-2022-2938)

A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the time of table deletion, possibly leading to local privilege escalation.(CVE-2022-2586)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

• Race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)

• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

• Memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)

• smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)

• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

• Uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

• Race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

• use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)

• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)

• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

• buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

• use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)

• net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

• Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

• Memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)

• Double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

• Use after free in SUNRPC subsystem (CVE-2022-28893)

• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

• race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)

• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

• memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)

• smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)

• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

• uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

• race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

• use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)

• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)

• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

• buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

• use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)

• net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

• Spectre-BHB (CVE-2022-23960)

• Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

• memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)

• double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

• use after free in SUNRPC subsystem (CVE-2022-28893)

• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
• Race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)
• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
• Memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)
• smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)
• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
• Uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
• Race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
• use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)
• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
• buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)
• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
• use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)
• net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
• Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
• Memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)
• Double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
• Use after free in SUNRPC subsystem (CVE-2022-28893)
• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
• race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)
• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
• memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)
• smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)
• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
• uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
• race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
• use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)
• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
• buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)
• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
• use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)
• net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
• Spectre-BHB (CVE-2022-23960)
• Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
• memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)
• double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
• use after free in SUNRPC subsystem (CVE-2022-28893)
• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
• smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)
• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
• uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
• race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
• concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)
• kernel info leak issue in pfkey_register (CVE-2022-1353)
• use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)
• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
• fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998)
• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
• slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
• incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123)
• incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)
• incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166)
• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
• AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)
• AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)
• Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
• double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
• use after free in SUNRPC subsystem (CVE-2022-28893)
• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
• Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)
• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
• nf_tables disallow binding to already bound chain (CVE-2022-39190)
• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
• smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)
• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
• uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
• race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
• concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)
• kernel info leak issue in pfkey_register (CVE-2022-1353)
• use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)
• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
• fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998)
• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
• integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
• slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
• incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123)
• incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)
• incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166)
• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
• AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)
• AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)
• Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
• double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
• use after free in SUNRPC subsystem (CVE-2022-28893)
• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
• Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)
• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
• nf_tables disallow binding to already bound chain (CVE-2022-39190)
• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• net_sched: cls_route: remove from list when handle is 0 {CVE-2022-2588}
• netfilter: nf_tables: do not allow RULE_ID to refer to another chain {CVE-2022-2586}
• netfilter: nf_tables: do not allow SET_ID to refer to another table {CVE-2022-2586}
• netfilter: nf_tables: prevent OOB access in nft_byteorder_eval {CVE-2023-35001}
• smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}

• net_sched: cls_route: remove from list when handle is 0 {CVE-2022-2588}
• netfilter: nf_tables: do not allow RULE_ID to refer to another chain {CVE-2022-2586}
• netfilter: nf_tables: do not allow SET_ID to refer to another table {CVE-2022-2586}
• netfilter: nf_tables: prevent OOB access in nft_byteorder_eval {CVE-2023-35001}
• smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}

Aaron Adams discovered that the netfilter subsystem in the Linux kernel did not properly handle the removal of stateful expressions in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-1966)

Ziming Zhang discovered that the netfilter subsystem in the Linux kernel did not properly validate sets with multiple ranged fields. A local attacker could use this to cause a denial of service or execute arbitrary code.(CVE-2022-1972)

It was discovered that the implementation of POSIX timers in the Linux kernel did not properly clean up timers in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-2585)

It was discovered that the netfilter subsystem of the Linux kernel did not prevent one nft object from referencing an nft set in another nft table, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-2586)

Zhenpeng Lin discovered that the network packet scheduler implementation in the Linux kernel did not properly remove all references to a route filter before freeing it in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-2588)

It was discovered that the Linux kernel did not properly restrict access to the kernel debugger when booted in secure boot environments. A privileged attacker could use this to bypass UEFI Secure Boot restrictions.(CVE-2022-21499)

Kyle Zeng discovered that the Network Queuing and Scheduling subsystem of the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-29581)

Arthur Mongodin discovered that the netfilter subsystem in the Linux kernel did not properly perform data validation. A local attacker could use this to escalate privileges in certain situations.(CVE-2022-34918)

This kernel update is based on upstream 5.15.62 and fixes at least the following security issues:

A use-after-free flaw was found in the Linux kernel Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-1679).

A use-after-free flaw was found in the Linux kernel’s POSIX CPU timers functionality in the way a user creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-2585).

A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the time of table deletion, possibly leading to local privilege escalation (CVE-2022-2586).

A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the Linux kernel. This flaw allows a local, privileged attacker to crash the system, possibly leading to a local privilege escalation issue (CVE-2022-2588).

A flaw was found in hw. In certain processors with Intel's Enhanced Indirect Branch Restricted Speculation (eIBRS) capabilities, soon after VM exit or IBPB command event, the linear address following the most recent near CALL instruction prior to a VM exit may be used as the Return Stack Buffer (RSB) prediction (CVE-2022-26373).

x86/bugs: Enable STIBP for IBPB mitigated RETBleed.

Other fixes in this update:

• add support for more tcp congestion control algos (mga #30725)
• add fixes for a serious bug that causes TCP connection hangs for users of TCP fast open and nf_conntrack
• ALSA: info: Fix llseek return value when using callback
• ALSA: hda/realtek: Add quirk for Clevo NS50PU, NS70PU
• ata: libata-eh: Add missing command name
• btrfs: fix lost error handling when looking up extended ref on log repla
• btrfs: reset RO counter on block group if we fail to relocate
• btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
• drm/amd/display: Check correct bounds for stream encoder instances for DCN303
• drm/nouveau: recognise GA103
• drm/ttm: Fix dummy res NULL ptr deref bug
• locking/atomic: Make test_and_*_bit() ordered on failure
• mmc: meson-gx: Fix an error handling path in meson_mmc_probe()
• mmc: pxamci: Fix an error handling path in pxamci_probe()
• mmc: pxamci: Fix another error handling path in pxamci_probe()
• rds: add missing barrier to release_refill
• KVM: Unconditionally get a ref to /dev/kvm module when creating a VM
• x86/mm: Use proper mask when setting PUD mapping
• x86/entry: Fix entry_INT80_compat for Xen PV guests
• x86/PAT: Have pat_enabled() properly reflect state when running on Xen
• xfs: flush inodegc workqueue tasks before cancel
• xfs: reserve quota for dir expansion when linking/unlinking files
• xfs: reserve quota for target dir expansion when renaming files
• xfs: remove infinite loop when reserving free block pool
• xfs: always succeed at setting the reserve pool size
• xfs: fix overfilling of reserve pool
• xfs: fix soft lockup via spinning in filestream ag selection loop
• xfs: revert "xfs: actually bump warning counts when we send warnings"
• xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP*

xtables-addons have been updated to 3.21.

For other upstream fixes in this update, see the referenced changelogs.

This kernel update is based on upstream 5.15.62 and fixes at least the following security issues:

A use-after-free flaw was found in the Linux kernel Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-1679).

A use-after-free flaw was found in the Linux kernel’s POSIX CPU timers functionality in the way a user creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-2585).

A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the time of table deletion, possibly leading to local privilege escalation (CVE-2022-2586).

A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the Linux kernel. This flaw allows a local, privileged attacker to crash the system, possibly leading to a local privilege escalation issue (CVE-2022-2588).

A flaw was found in hw. In certain processors with Intel's Enhanced Indirect Branch Restricted Speculation (eIBRS) capabilities, soon after VM exit or IBPB command event, the linear address following the most recent near CALL instruction prior to a VM exit may be used as the Return Stack Buffer (RSB) prediction (CVE-2022-26373).

nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len (CVE-2022-36946).

x86/bugs: Enable STIBP for IBPB mitigated RETBleed.

Other fixes in this update:

• add support for more tcp congestion control algos (mga #30725)

For other upstream fixes in this update, see the referenced changelogs.

The SUSE Linux Enterprise 15 SP4 kernel was updated.

The following security bugs were fixed:

• CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bnc#1203769).
• CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c (bnc#1202960).
• CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to crash the system or escalate their privileges (bnc#1203552).
• CVE-2022-41848: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl (bnc#1203987).
• CVE-2022-41849: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open (bnc#1203992).
• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bnc#1202095).
• CVE-2022-1263: Fixed a NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allowed an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service (bnc#1198189).
• CVE-2022-3202: Fixed a NULL pointer dereference flaw in Journaled File System. This could allow a local attacker to crash the system or leak kernel internal information (bnc#1203389).
• CVE-2022-39189: Fixed a bug in the x86 KVM subsystem which allows unprivileged guest users to compromise the guest kernel because TLB flush operations are mishandled (bnc#1203066).

The following non-security bugs were fixed:

• ACPI / scan: Create platform device for CS35L41 (bsc#1203699).
• ACPI: processor idle: Practically limit 'Dummy wait' workaround to old Intel systems (bsc#1203767).
• ACPI: resource: skip IRQ override on AMD Zen platforms (git-fixes).
• ACPI: scan: Add CLSA0101 Laptop Support (bsc#1203699).
• ACPI: utils: Add api to read _SUB from ACPI (bsc#1203699).
• ALSA: aloop: Fix random zeros in capture data when using jiffies timer (git-fixes).
• ALSA: core: Fix double-free at snd_card_new() (git-fixes).
• ALSA: cs35l41: Check hw_config before using it (bsc#1203699).
• ALSA: cs35l41: Enable Internal Boost in shared lib (bsc#1203699).
• ALSA: cs35l41: Move cs35l41_gpio_config to shared lib (bsc#1203699).
• ALSA: cs35l41: Unify hardware configuration (bsc#1203699).
• ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() (git-fixes).
• ALSA: hda: add Intel 5 Series / 3400 PCI DID (git-fixes).
• ALSA: hda: cs35l41: Add Amp Name based on channel and index (bsc#1203699).
• ALSA: hda: cs35l41: Add Boost type flag (bsc#1203699).
• ALSA: hda: cs35l41: Add calls to newly added test key function (bsc#1203699).
• ALSA: hda: cs35l41: Add defaulted values into dsp bypass config sequence (bsc#1203699).
• ALSA: hda: cs35l41: Add initial DSP support and firmware loading (bsc#1203699).
• ALSA: hda: cs35l41: Add missing default cases (bsc#1203699).
• ALSA: hda: cs35l41: Add module parameter to control firmware load (bsc#1203699).
• ALSA: hda: cs35l41: Add support for CS35L41 in HDA systems (bsc#1203699).
• ALSA: hda: cs35l41: Add Support for Interrupts (bsc#1203699).
• ALSA: hda: cs35l41: Allow compilation test on non-ACPI configurations (bsc#1203699).
• ALSA: hda: cs35l41: Always configure the DAI (bsc#1203699).
• ALSA: hda: cs35l41: Avoid overwriting register patch (bsc#1203699).
• ALSA: hda: cs35l41: Clarify support for CSC3551 without _DSD Properties (bsc#1203699).
• ALSA: hda: cs35l41: Consolidate selections under SND_HDA_SCODEC_CS35L41 (bsc#1203699).
• ALSA: hda: cs35l41: Do not dereference fwnode handle (bsc#1203699).
• ALSA: hda: cs35l41: Drop wrong use of ACPI_PTR() (bsc#1203699).
• ALSA: hda: cs35l41: Enable GPIO2 Interrupt for CLSA0100 laptops (bsc#1203699).
• ALSA: hda: cs35l41: Fix comments wrt serial-multi-instantiate reference (bsc#1203699).
• ALSA: hda: cs35l41: fix double free on error in probe() (bsc#1203699). -…

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a denial of service upon binding to an already bound chain (bnc#1203117).
• CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page while it still has stale TLB entries (bnc#1203107).
• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564, bsc#1202860).
• CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be confused and incorrectly matches the message (bnc#1202097).
• CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module (bnc#1202154).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
• CVE-2021-4155: Fixed a data leak flaw that was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem (bnc#1194272).
• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).
• CVE-2020-27784: Fixed a vulnerability that was found in printer_ioctl() printer_ioctl() when accessing a deallocated instance (bnc#1202895).
• CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).
• CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bnc#1203769).
• CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c (bnc#1202960).
• CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to crash the system or escalate their privileges (bnc#1203552).
• CVE-2022-41848: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl (bnc#1203987).
• CVE-2022-41849: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open (bnc#1203992).
• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bnc#1202095).
• CVE-2022-41222: Fixed a use-after-free via a stale TLB because an rmap lock is not held during a PUD move (bnc#1203622).
• CVE-2022-2503: Fixed a bug in dm-verity, device-mapper table reloads allowed users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allowed root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates (bnc#1202677).
• CVE-2020-16119: Fixed a use-after-free vulnerability exploitable by a local attacker due to reuse of a DCCP socket. (bnc#1177471)

The following non-security bugs were fixed:

• ACPI: APEI: Better fix to avoid…

The SUSE Linux Enterprise 15 SP2 kernel was updated.

The following security bugs were fixed:

• CVE-2020-16119: Fixed a use-after-free vulnerability exploitable by a local attacker due to reuse of a DCCP socket. (bnc#1177471)
• CVE-2022-20008: Fixed a bug which allowed to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. (bnc#1199564)
• CVE-2022-2503: Fixed a bug in dm-verity, device-mapper table reloads allowed users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allowed root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates (bnc#1202677).
• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bnc#1202095).
• CVE-2022-32296: Fixed a bug which allowed TCP servers to identify clients by observing what source ports are used (bnc#1200288).
• CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to crash the system or escalate their privileges (bnc#1203552).
• CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bnc#1203769).
• CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c (bnc#1202960).
• CVE-2022-41222: Fixed a use-after-free via a stale TLB because an rmap lock is not held during a PUD move (bnc#1203622).
• CVE-2022-41674: Fixed a DoS issue where kernel can crash on the reception of specific WiFi Frames (bsc#1203770).
• CVE-2022-41848: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl (bnc#1203987).
• CVE-2022-41849: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open (bnc#1203992).
• CVE-2022-42719: Fixed remote code execution with wlan frames when parsing a multi-BSSID element (bsc#1204051).
• CVE-2022-42720: Fixed remote code execution due to refcounting bugs (bsc#1204059).
• CVE-2022-42721: Fixed remote code execution due list corruption in the wlan stack (bsc#1204060).

The following non-security bugs were fixed:

• net: mana: Add support of XDP_REDIRECT action (bsc#1201310, jsc#PED-529).
• net: mana: Add the Linux MANA PF driver (bsc#1201309, jsc#PED-529).
• x86/bugs: Reenable retbleed=off While for older kernels the return thunks are statically built in and cannot be dynamically patched out, retbleed=off should still work so that it can be disabled.

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive information from kernel memory. (bnc#1203514)
• CVE-2022-3169: Fixed a denial of service flaw which occurs when consecutive requests to NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET are sent. (bnc#1203290)
• CVE-2022-42722: Fixed crash in beacon protection for P2P-device. (bsc#1204125)
• CVE-2022-42719: Fixed MBSSID parsing use-after-free. (bsc#1204051)
• CVE-2022-42721: Avoid nontransmitted BSS list corruption. (bsc#1204060)
• CVE-2022-42720: Fixed BSS refcounting bugs. (bsc#1204059)
• CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bnc#1203769).
• CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c (bnc#1202960).
• CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to crash the system or escalate their privileges (bnc#1203552).
• CVE-2022-41848: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl (bnc#1203987).
• CVE-2022-41849: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open (bnc#1203992).
• CVE-2022-41674: Fixed a DoS issue where kernel can crash on the reception of specific WiFi Frames (bsc#1203770).
• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bnc#1202095).
• CVE-2022-41222: Fixed a use-after-free via a stale TLB because an rmap lock is not held during a PUD move (bnc#1203622).
• CVE-2022-2503: Fixed a bug in dm-verity, device-mapper table reloads allowed users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allowed root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates (bnc#1202677).
• CVE-2022-20008: Fixed a bug which allowed to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. (bnc#1199564)
• CVE-2020-16119: Fixed a use-after-free vulnerability exploitable by a local attacker due to reuse of a DCCP socket. (bnc#1177471)

The following non-security bugs were fixed:

• ALSA: aloop: Fix random zeros in capture data when using jiffies timer (git-fixes).
• ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() (git-fixes).
• ALSA: hda/realtek: Re-arrange quirk table entries (git-fixes).
• ALSA: seq: Fix data-race at module auto-loading (git-fixes).
• ALSA: seq: oss: Fix data-race for max_midi_devs access (git-fixes).
• ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() (git-fixes).
• ALSA: usb-audio: fix spelling mistakes (git-fixes).
• ALSA: usb-audio: Inform the delayed registration more properly (git-fixes).
• ALSA: usb-audio: Register card again for iface over delayed_register option (git-fixes).
• ALSA: usb-audio: Split endpoint setups for hw_params and prepare (git-fixes).
• arm64: cpufeature: Allow different PMU versions in ID_DFR0_EL1 (git-fixes)
• arm64: dts: allwinner: A64 Sopine: phy-mode rgmii-id (git-fixes)
• arm64: dts: allwinner: a64-sopine-baseboard: change RGMII mode to (bsc#1202341)
• arm64: dts: allwinner: H5: NanoPi Neo Plus2: phy-mode rgmii-id (git-fixes)
• arm64: dts: rockchip: Pull up wlan wake# on Gru-Bob (git-fixes)
• arm64: dts: rockchip: Remove 'enable-active-low' from rk3399-puma (git-fixes)
• arm64: dts: rockchip: Set RK3399-Gru PCLK_EDP to 24 MHz (git-fixes)
• arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC (git-fixes)
• arm64:…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).
• CVE-2020-16119: Fixed a use-after-free due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released (bnc#1177471).
• CVE-2020-27784: Fixed a vulnerability that was found in printer_ioctl() printer_ioctl() when accessing a deallocated instance (bnc#1202895).
• CVE-2021-4155: Fixed a data leak flaw that was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem (bnc#1194272).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-2503: Fixed a LoadPin bypass in Dm-verity (bnc#1202677).
• CVE-2022-2586: Fixed issue in netfilter that allowed CHAIN_ID to refer to another table (bsc#1202095).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be confused and incorrectly matches the message (bnc#1202097).
• CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564, bsc#1202860).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-3169: Fixed a denial of service that resulted in a PCIe link disconnect (bnc#1203290).
• CVE-2022-32296: Fixed issue where TCP servers were able to identify clients by observing what source ports are used (bnc#1200288).
• CVE-2022-3239: Fixed a use-after-free in the video4linux driver (bnc#1203552).
• CVE-2022-3303: Fixed a race at SNDCTL_DSP_SYNC (bsc#1203769).
• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page while it still has stale TLB entries (bnc#1203107).
• CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a denial of service upon binding to an already bound chain (bnc#1203117).
• CVE-2022-40768: Fixed information leak in drivers/scsi/stex.c due to stex_queuecommand_lck lack a memset for the PASSTHRU_CMD case (bnc#1203514).
• CVE-2022-41218: Fixed a use-after-free due to refcount races at releasing (bsc#1202960).
• CVE-2022-41222: Fixed a use-after-free via a stale TLB because an rmap lock is not held during a PUD move (bnc#1203622).
• CVE-2022-41674: Fixed a DoS issue where kernel can crash on the reception of specific WiFi Frames (bsc#1203770).
• CVE-2022-41848: Fixed a use-after-free in mgslpc_ops (bsc#1203987).
• CVE-2022-41849: Fixed a use-after-free in ufx_ops_open() (bsc#1203992).
• CVE-2022-42719: Fixed MBSSID parsing use-after-free (bsc#1204051).
• CVE-2022-42720: Fixed BSS refcounting bugs (bsc#1204059).
• CVE-2022-42721: Avoid nontransmitted BSS list corruption (bsc#1204060).
• CVE-2022-42722: Fixed crash in beacon protection for P2P-device (bsc#1204125).

The following non-security bugs were fixed:

• Fixed parsing of rpm/macros.kernel-source on SLE12 (bsc#1201019).
• acpi: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks (git-fixes).
• acpi: LPSS: Fix missing check in register_device_clock()…

The SUSE Linux Enterprise 15 SP4 kernel was updated.

The following security bugs were fixed:

• CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bnc#1203769).
• CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c (bnc#1202960).
• CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to crash the system or escalate their privileges (bnc#1203552).
• CVE-2022-41848: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl (bnc#1203987).
• CVE-2022-41849: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open (bnc#1203992).
• CVE-2022-41674: Fixed a DoS issue where kernel can crash on the reception of specific WiFi Frames (bsc#1203770).
• CVE-2022-1263: Fixed a NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allowed an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service (bnc#1198189).
• CVE-2022-32296: Fixed a bug which allowed TCP servers to identify clients by observing what source ports are used (bnc#1200288).
• CVE-2022-3202: Fixed a NULL pointer dereference flaw in Journaled File System. This could allow a local attacker to crash the system or leak kernel internal information (bnc#1203389).
• CVE-2022-39189: Fixed a bug in the x86 KVM subsystem which allows unprivileged guest users to compromise the guest kernel because TLB flush operations are mishandled (bnc#1203066).
• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bnc#1202095).
• CVE-2022-42722: Fixed crash in beacon protection for P2P-device. (bsc#1204125)
• CVE-2022-42719: Fixed MBSSID parsing use-after-free. (bsc#1204051)
• CVE-2022-42721: Avoid nontransmitted BSS list corruption. (bsc#1204060)
• CVE-2022-42720: Fixed BSS refcounting bugs. (bsc#1204059)

The following non-security bugs were fixed:

• ACPI / scan: Create platform device for CS35L41 (bsc#1203699).
• ACPI: processor idle: Practically limit 'Dummy wait' workaround to old Intel systems (bsc#1203767).
• ACPI: resource: skip IRQ override on AMD Zen platforms (git-fixes).
• ACPI: scan: Add CLSA0101 Laptop Support (bsc#1203699).
• ACPI: utils: Add api to read _SUB from ACPI (bsc#1203699).
• ALSA: aloop: Fix random zeros in capture data when using jiffies timer (git-fixes).
• ALSA: core: Fix double-free at snd_card_new() (git-fixes).
• ALSA: cs35l41: Check hw_config before using it (bsc#1203699).
• ALSA: cs35l41: Enable Internal Boost in shared lib (bsc#1203699).
• ALSA: cs35l41: Move cs35l41_gpio_config to shared lib (bsc#1203699).
• ALSA: cs35l41: Unify hardware configuration (bsc#1203699).
• ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() (git-fixes).
• ALSA: hda: add Intel 5 Series / 3400 PCI DID (git-fixes).
• ALSA: hda: cs35l41: Add Amp Name based on channel and index (bsc#1203699).
• ALSA: hda: cs35l41: Add Boost type flag (bsc#1203699).
• ALSA: hda: cs35l41: Add calls to newly added test key function (bsc#1203699).
• ALSA: hda: cs35l41: Add defaulted values into dsp bypass config sequence (bsc#1203699).
• ALSA: hda: cs35l41: Add initial DSP support and firmware loading (bsc#1203699).
• ALSA: hda: cs35l41: Add missing default cases (bsc#1203699).
• ALSA: hda: cs35l41: Add module parameter to control firmware load (bsc#1203699).
• ALSA: hda: cs35l41: Add support for CS35L41 in HDA systems (bsc#1203699).
• ALSA: hda: cs35l41: Add Support for Interrupts (bsc#1203699).
• ALSA: hda: cs35l41: Allow compilation test on non-ACPI configurations (bsc#1203699).
• ALSA: hda: cs35l41: Always configure the DAI (bsc#1203699).
• ALSA: hda: cs35l41: Avoid overwriting register patch (bsc#1203699).
• ALSA: hda: cs35l41:…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-42328: Guests could trigger denial of service via the netback driver (bsc#1206114).
• CVE-2022-42329: Guests could trigger denial of service via the netback driver (bsc#1206113).
• CVE-2022-3643: Guests could trigger NIC interface reset/abort/crash via netback driver (bsc#1206113).
• CVE-2022-3633: Fixed a memory leak in j1939_session_destroy of the file net/can/j1939/transport.c (bsc#1204650).
• CVE-2022-3114: Fixed a denial of service in imx_register_uart_clocks() in drivers/clk/imx/clk.c (bsc#1206391).
• CVE-2022-3619: Fixed a memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (bsc#1204569).
• CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c (bsc#1204631).
• CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c (bsc#1203960).
• CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in net/bluetooth/l2cap_core.c (bsc#1205796).
• CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).
• CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
• CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
• CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect() and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively) remotely via Bluetooth (bsc#1205709).
• CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req() which can be used to leak kernel pointers remotely (bsc#1205705).
• CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
• CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac (bsc#1204868).
• CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).
• CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set (bsc#1198702).
• CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's internal memory (bsc#1204653).
• CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c (bsc#1204402).
• CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bsc#1204635).
• CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bsc#1204646).
• CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bsc#1204647).
• CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c (bsc#1204574).
• CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bsc#1204479).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bsc#1204431).
• CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bsc#1204354).
• CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive information from kernel memory (bsc#1203514).
• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).

The following non-security bugs were fixed:

• Fix termination state for idr_for_each_entry_ul() (bsc#1109837).
• Input: powermate - fix use-after-free in powermate_config_complete (git-fixes).
• KVM: s390/mm: Properly reset no-dat (git-fixes bsc#1218057).
• KVM: s390: vsie: fix wrong VIR 37 when MSO is used (git-fixes bsc#1217936).
• Limit kernel-source build to architectures for which the kernel binary is built (bsc#1108281).
• PCI: Disable ATS for specific Intel IPU E2000 devices (bsc#1218622).
• Resolve build warnings from previous series due to missing commit for Ice Lake freerunning counters perf/x86/intel/uncore: Add box_offsets for free-running counters (jsc#PED-5023 bsc#1211439).
• Revert 'Limit kernel-source-azure build to architectures for which we build binaries (bsc#1108281).'
• bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent (git-fixes).
• bcache: Remove unnecessary NULL point check in node allocations (git-fixes).
• bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (git-fixes).
• bcache: check return value from btree_node_alloc_replacement() (git-fixes).
• bcache: prevent potential division by zero error (git-fixes).
• bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce() (git-fixes).
• bcache: revert replacing IS_ERR_OR_NULL with IS_ERR (git-fixes).
• dm cache policy smq: ensure IO does not prevent cleaner policy progress (git-fixes).
• dm cache: add cond_resched() to various workqueue loops (git-fixes).
• dm crypt: add cond_resched() to dmcrypt_write() (git-fixes).
• dm flakey: do not corrupt the zero page (git-fixes).
• dm flakey: fix a crash with invalid table line (git-fixes).
• dm flakey: fix logic when corrupting a bio (git-fixes).
• dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (git-fixes).
• dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths (git-fixes).
• dm stats: check for and propagate alloc_percpu failure (git-fixes).
• dm thin: add cond_resched() to various workqueue loops (git-fixes).
• dm verity: do not perform FEC for failed readahead IO (git-fixes).
• dm verity: fix error handling for check_at_most_once on FEC (git-fixes).
• dm verity: skip redundant verity_handle_err() on I/O errors (git-fixes).
• dm-integrity: do not modify bio's immutable bio_vec in integrity_metadata() (git-fixes).
• dm-verity: align struct dm_verity_fec_io properly (git-fixes).
• dm: remove flush_scheduled_work() during local_exit() (git-fixes).
• doc/README.SUSE: Add how to update the config for module signing (jsc#PED-5021)
• doc/README.SUSE: Remove how to build…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095).
• CVE-2023-6121: Fixed an information leak via dmesg when receiving a crafted packet in the NVMe-oF/TCP subsystem (bsc#1217250).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsystem when adding a new event (bsc#1214158 bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free issue when receiving an IGMP query packet due to reference count mismanagement (bsc#1218253).
• CVE-2020-26555: Fixed an issue during BR/EDR PIN code pairing in the Bluetooth subsystem that would allow replay attacks (bsc#1179610 bsc#1215237).
• CVE-2023-51779: Fixed a use-after-free issue due to a race condition during Bluetooth message reception (bsc#1218559).

The following non-security bugs were fixed:

• Enabled the LLC counters for “perf” (perf stat) on the Ice-Lake and Rocket-Lake CPUs (jsc#PED-5023 bsc#1211439).
• Reviewed and added more information to README.SUSE (jsc#PED-5021).
• Enabled multibuild for kernel packages (JSC-SLE#5501, boo#1211226, bsc#1218184).
• Fix termination state for idr_for_each_entry_ul() (bsc#1109837).
• KVM: s390/mm: Properly reset no-dat (bsc#1218057).
• KVM: s390: vsie: fix wrong VIR 37 when MSO is used (bsc#1217936).
• PCI: Disable ATS for specific Intel IPU E2000 devices (bsc#1218622).
• gve: Add XDP DROP and TX support for GQI-QPL format (bsc#1214479).
• gve: Add XDP REDIRECT support for GQI-QPL format (bsc#1214479).
• gve: Changes to add new TX queues (bsc#1214479).
• gve: Control path for DQO-QPL (bsc#1214479).
• gve: Do not fully free QPL pages on prefill errors (bsc#1214479).
• gve: Fix gve interrupt names (bsc#1214479).
• gve: Fixes for napi_poll when budget is 0 (bsc#1214479).
• gve: RX path for DQO-QPL (bsc#1214479).
• gve: Set default duplex configuration to full (bsc#1214479).
• gve: Tx path for DQO-QPL (bsc#1214479).
• gve: Unify duplicate GQ min pkt desc size constants (bsc#1214479).
• gve: XDP support GQI-QPL: helper function changes (bsc#1214479).
• gve: fix frag_list chaining (bsc#1214479).
• gve: trivial spell fix Recive to Receive (bsc#1214479).
• gve: unify driver name usage (bsc#1214479).
• net/tg3: fix race condition in tg3_reset_task() (bsc#1217801).
• net/tg3: resolve deadlock in tg3_reset_task() during EEH (bsc#1217801).
• s390/vx: fix save/restore of fpu kernel context (bsc#1218362).
• tracing: Fix a possible race when disabling buffered events (bsc#1217036).
• tracing: Fix a warning when allocating buffered events fails (bsc#1217036).
• tracing: Fix incomplete locking when disabling buffered events (bsc#1217036).
• tracing: Fix warning in trace_buffered_event_disable() (bsc#1217036).

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-26555: Fixed an issue during BR/EDR PIN code pairing in the Bluetooth subsystem that would allow replay attacks (bsc#1179610 bsc#1215237).
• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsystem when adding a new event (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free issue when receiving an IGMP query packet due to reference count mismanagement (bsc#1218253).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).

The following non-security bugs were fixed:

• Enabled the LLC counters for “perf” (perf stat) on the Ice-Lake and Rocket-Lake CPUs (jsc#PED-5023 bsc#1211439).
• Reviewed and added more information to README.SUSE (jsc#PED-5021).
• Enabled multibuild for kernel packages (JSC-SLE#5501, boo#1211226, bsc#1218184).
• Fix termination state for idr_for_each_entry_ul() (bsc#1109837).
• KVM: s390/mm: Properly reset no-dat (bsc#1218057).
• KVM: s390: vsie: fix wrong VIR 37 when MSO is used (bsc#1217936).
• PCI: Disable ATS for specific Intel IPU E2000 devices (bsc#1218622).
• Previous perf cve-4.12->SLE12-SP5 manual merge was incorrect. Fix.
• gve: Add XDP DROP and TX support for GQI-QPL format (bsc#1214479).
• gve: Add XDP REDIRECT support for GQI-QPL format (bsc#1214479).
• gve: Changes to add new TX queues (bsc#1214479).
• gve: Control path for DQO-QPL (bsc#1214479).
• gve: Do not fully free QPL pages on prefill errors (bsc#1214479).
• gve: Fix gve interrupt names (bsc#1214479).
• gve: Fixes for napi_poll when budget is 0 (bsc#1214479).
• gve: RX path for DQO-QPL (bsc#1214479).
• gve: Set default duplex configuration to full (bsc#1214479).
• gve: Tx path for DQO-QPL (bsc#1214479).
• gve: Unify duplicate GQ min pkt desc size constants (bsc#1214479).
• gve: XDP support GQI-QPL: helper function changes (bsc#1214479).
• gve: fix frag_list chaining (bsc#1214479).
• gve: trivial spell fix Recive to Receive (bsc#1214479).
• gve: unify driver name usage (bsc#1214479).
• net/tg3: fix race condition in tg3_reset_task() (bsc#1217801).
• net/tg3: resolve deadlock in tg3_reset_task() during EEH (bsc#1217801).
• s390/vx: fix save/restore of fpu kernel context (bsc#1218362).
• tracing: Fix a possible race when disabling buffered events (bsc#1217036).
• tracing: Fix a warning when allocating buffered events fails (bsc#1217036).
• tracing: Fix incomplete locking when disabling buffered events (bsc#1217036).
• tracing: Fix warning in trace_buffered_event_disable() (bsc#1217036).

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).
• CVE-2023-6606: Fixed an out-of-bounds read vulnerability in smbCalcSize in fs/smb/client/netmisc.c that could allow a local attacker to crash the system or leak internal kernel information (bsc#1217947).
• CVE-2023-6610: Fixed an out-of-bounds read vulnerability in smb2_dump_detail in fs/smb/client/smb2ops.c that could allow a local attacker to crash the system or leak internal kernel information (bsc#1217946).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).

The following non-security bugs were fixed:

• doc/README.SUSE: Add how to update the config for module signing (jsc#PED-5021)
• doc/README.SUSE: Remove how to build modules using kernel-source (jsc#PED-5021)
• doc/README.SUSE: Simplify the list of references (jsc#PED-5021)

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47557: net/sched: sch_ets: do not peek at classes beyond 'nbands' (bsc#1207361 bsc#1225468).
• CVE-2021-47595: net/sched: sch_ets: do not remove idle classes from the round-robin list (bsc#1207361 bsc#1226552).
• CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
• CVE-2023-52925: netfilter: nf_tables: do not fail inserts if duplicate has expired (bsc#1236822).
• CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
• CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
• CVE-2024-53197: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (bsc#1235464).
• CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
• CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
• CVE-2025-21756: vsock: Orphan socket after transport release (bsc#1238876).
• CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
• CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
• CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
• CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (bsc#1243330).
• CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
• CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
• CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38060: bpf: abort verification if env->cur_state->loop_entry != NULL (bsc#1245155).
• CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).

The following non-security bugs were fixed:

• ALSA: usb-audio: Fix a DMA to stack memory bug (git-fixes).
• Fix reference in 'net_sched: sch_sfq: use a temporary work area for validating configuration' (bsc#1242504)
• MyBS: Correctly generate build flags for non-multibuild package limit (bsc# 1244241) Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build')
• MyBS: Do not build kernel-obs-qa with limit_packages Fixes: 58e3f8c34b2b ('bs-upload-kernel: Pass limit_packages also on multibuild')
• MyBS: Simplify qa_expr generation Start with a 0 which makes the expression valid even if there are no QA repositories (currently does not happen). Then separator is always needed.
• bs-upload-kernel: Pass limit_packages also on multibuild Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build') Fixes: 747f601d4156 ('bs-upload-kernel, MyBS, Buildresults: Support multibuild (JSC-SLE#5501, boo#1211226, bsc#1218184)')
• hugetlb: unshare some PMDs when splitting VMAs (bsc#1245431).
• kernel-source: Do not use multiple -r in sed parameters
• kernel-source: Remove log.sh from sources
• mkspec: Exclude rt flavor from kernel-syms dependencies (bsc#1244337).
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431).
• mm/hugetlb: unshare…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50085: dm raid: fix address sanitizer warning in raid_resume (bsc#1245147).
• CVE-2022-50087: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (bsc#1245119).
• CVE-2022-50200: selinux: Add boundary check in put_entry() (bsc#1245149).
• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
• CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
• CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
• CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
• CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
• CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
• CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (bsc#1243330).
• CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
• CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
• CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
• CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).

The following non-security bugs were fixed:

• Fix conditional for selecting gcc-13 Fixes: 51dacec21eb1 ('Use gcc-13 for build on SLE16 (jsc#PED-10028).')
• MyBS: Correctly generate build flags for non-multibuild package limit (bsc# 1244241) Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build')
• MyBS: Do not build kernel-obs-qa with limit_packages Fixes: 58e3f8c34b2b ('bs-upload-kernel: Pass limit_packages also on multibuild')
• MyBS: Simplify qa_expr generation Start with a 0 which makes the expression valid even if there are no QA repositories (currently does not happen). Then separator is always needed.
• Require zstd in kernel-default-devel when module compression is zstd To use ksym-provides tool modules need to be uncompressed. Without zstd at least kernel-default-base does not have provides. Link: https://github.com/openSUSE/rpm-config-SUSE/pull/82
• Test the correct macro to detect RT kernel build Fixes: 470cd1a41502 ('kernel-binary: Support livepatch_rt with merged RT branch')
• Use gcc-13 for build on SLE16 (jsc#PED-10028).
• add nf_tables for iptables non-legacy network handling This is needed for example by docker on the Alpine Linux distribution, but can also be used on openSUSE.
• bs-upload-kernel: Pass limit_packages also on multibuild Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build') Fixes: 747f601d4156 ('bs-upload-kernel, MyBS, Buildresults: Support multibuild (JSC-SLE#5501, boo#1211226, bsc#1218184)')
• check-for-config-changes: Fix flag name typo
• drop ax25 drivers (bsc#1238471).
• drop hamradio drivers (bsc#1238471).
• drop netrom drivers (bsc#1238471).
• drop rose drivers (bsc#1238471).
• kabi/severities: workaround kABI checker complains after AX25 and HAMRADIO removals KABI: symbol asc2ax(mod:net/ax25/ax25) lost KABI: symbol ax25_bcast(mod:net/ax25/ax25) lost KABI: symbol ax25_defaddr(mod:net/ax25/ax25) lost KABI: symbol ax25_display_timer(mod:net/ax25/ax25) lost KABI: symbol ax25_find_cb(mod:net/ax25/ax25) lost KABI: symbol ax25_findbyuid(mod:net/ax25/ax25) lost KABI: symbol ax25_header_ops(mod:net/ax25/ax25) lost…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50085: dm raid: fix address sanitizer warning in raid_resume (bsc#1245147).
• CVE-2022-50087: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (bsc#1245119).
• CVE-2022-50200: selinux: Add boundary check in put_entry() (bsc#1245149).
• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
• CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
• CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
• CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
• CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
• CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
• CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (bsc#1243330).
• CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
• CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
• CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
• CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).

The following non-security bugs were fixed:

• net_sched: sch_fifo: implement lockless __fifo_dump() (bsc#1237312)
• net_sched: sch_sfq: use a temporary work area for validating configuration (bsc#1232504)
• scsi: storvsc: Do not report the host packet status as the hv status (git-fixes).
• scsi: storvsc: Increase the timeouts to storvsc_timeout (bsc#1245455).
• wifi: cfg80211: Add my certificate (bsc#1243001).
• wifi: cfg80211: fix certs build to not depend on file order (bsc#1243001).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47557: net/sched: sch_ets: do not peek at classes beyond 'nbands' (bsc#1207361 bsc#1225468).
• CVE-2021-47595: net/sched: sch_ets: do not remove idle classes from the round-robin list (bsc#1207361 bsc#1226552).
• CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
• CVE-2023-52925: netfilter: nf_tables: do not fail inserts if duplicate has expired (bsc#1236822).
• CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
• CVE-2024-28956: x86/its: Add support for ITS-safe indirect thunk (bsc#1242006).
• CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
• CVE-2024-53197: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (bsc#1235464).
• CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
• CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
• CVE-2025-21756: vsock: Orphan socket after transport release (bsc#1238876).
• CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
• CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
• CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).
• CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
• CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (bsc#1243330).
• CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
• CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
• CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38060: bpf: abort verification if env->cur_state->loop_entry != NULL (bsc#1245155).
• CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).

The following non-security bugs were fixed:

• ALSA: usb-audio: Fix a DMA to stack memory bug (git-fixes).
• Fix conditional for selecting gcc-13 Fixes: 51dacec21eb1 ('Use gcc-13 for build on SLE16 (jsc#PED-10028).')
• Fix reference in 'net_sched: sch_sfq: use a temporary work area for validating configuration' (bsc#1242504)
• MyBS: Correctly generate build flags for non-multibuild package limit (bsc# 1244241) Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build')
• MyBS: Do not build kernel-obs-qa with limit_packages Fixes: 58e3f8c34b2b ('bs-upload-kernel: Pass limit_packages also on multibuild')
• MyBS: Simplify qa_expr generation Start with a 0 which makes the expression valid even if there are no QA repositories (currently does not happen). Then separator is always needed.
• Require zstd in kernel-default-devel when module compression is zstd To use ksym-provides tool modules need to be uncompressed. Without zstd at least kernel-default-base does not have provides. Link: https://github.com/openSUSE/rpm-config-SUSE/pull/82
• Use gcc-13 for build on SLE16 (jsc#PED-10028).
• add…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47557: net/sched: sch_ets: do not peek at classes beyond 'nbands' (bsc#1207361 bsc#1225468).
• CVE-2021-47595: net/sched: sch_ets: do not remove idle classes from the round-robin list (bsc#1207361 bsc#1226552).
• CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
• CVE-2023-52925: netfilter: nf_tables: do not fail inserts if duplicate has expired (bsc#1236822).
• CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
• CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
• CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
• CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
• CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
• CVE-2025-21756: vsock: Orphan socket after transport release (bsc#1238876).
• CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
• CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
• CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
• CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
• CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (bsc#1243330).
• CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
• CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
• CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).

The following non-security bugs were fixed:

• Fix conditional for selecting gcc-13 Fixes: 51dacec21eb1 ('Use gcc-13 for build on SLE16 (jsc#PED-10028).')
• Fix reference in 'net_sched: sch_sfq: use a temporary work area for validating configuration' (bsc#1242504)
• MyBS: Correctly generate build flags for non-multibuild package limit (bsc# 1244241) Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build')
• MyBS: Do not build kernel-obs-qa with limit_packages Fixes: 58e3f8c34b2b ('bs-upload-kernel: Pass limit_packages also on multibuild')
• MyBS: Simplify qa_expr generation Start with a 0 which makes the expression valid even if there are no QA repositories (currently does not happen). Then separator is always needed.
• Require zstd in kernel-default-devel when module compression is zstd To use ksym-provides tool modules need to be uncompressed. Without zstd at least kernel-default-base does not have provides. Link: https://github.com/openSUSE/rpm-config-SUSE/pull/82
• Test the correct macro to detect RT kernel build Fixes: 470cd1a41502 ('kernel-binary: Support livepatch_rt with merged RT branch')
• Use gcc-13 for build on SLE16 (jsc#PED-10028).
• add nf_tables for iptables non-legacy network…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47212: net/mlx5: Update error handler for UCTX and UMEM (bsc#1222709).
• CVE-2021-47455: ptp: Fix possible memory leak in ptp_clock_register() (bsc#1225254).
• CVE-2021-47527: serial: core: fix transmit-buffer reset and memleak (bsc#1227768).
• CVE-2022-21546: scsi: target: Fix WRITE_SAME No Data Buffer crash (bsc#1242243).
• CVE-2022-49154: KVM: SVM: fix panic on out-of-bounds guest IRQ (bsc#1238167).
• CVE-2022-49622: netfilter: nf_tables: fix crash when nf_trace is enabled (bsc#1239042).
• CVE-2022-49731: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (bsc#1239071).
• CVE-2022-49764: kABI: workaround 'bpf: Prevent bpf program recursion for raw tracepoint probes' changes (bsc#1242301).
• CVE-2022-49780: scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() (bsc#1242262).
• CVE-2022-49814: kcm: close race conditions on sk_receive_queue (bsc#1242498).
• CVE-2022-49879: ext4: fix BUG_ON() when directory entry has invalid rec_len (bsc#1242733).
• CVE-2022-49881: wifi: cfg80211: fix memory leak in query_regdb_file() (bsc#1242481).
• CVE-2022-49917: ipvs: fix WARNING in ip_vs_app_net_cleanup() (bsc#1242406).
• CVE-2022-49921: net: sched: Fix use after free in red_enqueue() (bsc#1242359).
• CVE-2022-50055: iavf: Fix adminq error handling (bsc#1245039).
• CVE-2022-50087: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (bsc#1245119).
• CVE-2022-50134: RDMA/hfi1: fix potential memory leak in setup_base_ctxt() (bsc#1244802).
• CVE-2022-50200: selinux: Add boundary check in put_entry() (bsc#1245149).
• CVE-2023-52500: Fixed information leaking when processing OPC_INB_SET_CONTROLLER_CONFIG command (bsc#1220883).
• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2023-53020: l2tp: fix lockdep splat (bsc#1240224).
• CVE-2023-53090: drm/amdkfd: Fix an illegal memory access (bsc#1242753).
• CVE-2023-53091: ext4: update s_journal_inum if it changes after journal replay (bsc#1242767).
• CVE-2023-53133: bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() (bsc#1242423).
• CVE-2024-26586: mlxsw: spectrum_acl_tcam: Fix stack corruption (bsc#1220243).
• CVE-2024-26825: nfc: nci: free rx_data_reassembly skb on NCI device cleanup (bsc#1223065).
• CVE-2024-26872: RDMA/srpt: Do not register event handler until srpt device is fully setup (bsc#1223115).
• CVE-2024-26875: media: pvrusb2: fix uaf in pvr2_context_set_notify (bsc#1223118).
• CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (bsc#1224712).
• CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).
• CVE-2024-38588: ftrace: Fix possible use-after-free issue in ftrace_location() (bsc#1226837).
• CVE-2024-57982: xfrm: state: fix out-of-bounds read during lookup (bsc#1237913).
• CVE-2025-21898: ftrace: Avoid potential division by zero in function_stat_show() (bsc#1240610).
• CVE-2025-21920: vlan: enforce underlying device type (bsc#1240686).
• CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
• CVE-2025-22035: tracing: Fix use-after-free in print_graph_function_flags during tracer switching (bsc#1241544).
• CVE-2025-23149: tpm: do not start chip while suspended (bsc#1242758).
• CVE-2025-37756: net: tls: explicitly disallow disconnect (bsc#1242515).
• CVE-2025-37757: tipc: fix memory leak in tipc_link_xmit (bsc#1242521).
• CVE-2025-37781: i2c: cros-ec-tunnel: defer probe if parent EC is not present (bsc#1242575).
• CVE-2025-37800: driver core: fix potential NULL pointer dereference in dev_uevent() (bsc#1242849).
• CVE-2025-37810: usb: dwc3: gadget: check that event count does not exceed event buffer length (bsc#1242906).
• CVE-2025-37836: PCI: Fix reference…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47557: net/sched: sch_ets: do not peek at classes beyond 'nbands' (bsc#1207361 bsc#1225468).
• CVE-2021-47595: net/sched: sch_ets: do not remove idle classes from the round-robin list (bsc#1207361 bsc#1226552).
• CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
• CVE-2023-52925: netfilter: nf_tables: do not fail inserts if duplicate has expired (bsc#1236822).
• CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
• CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
• CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
• CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
• CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
• CVE-2025-21756: vsock: Orphan socket after transport release (bsc#1238876).
• CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
• CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
• CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
• CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
• CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (bsc#1243330).
• CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
• CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
• CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).

The following non-security bugs were fixed:

• Fix conditional for selecting gcc-13 Fixes: 51dacec21eb1 ('Use gcc-13 for build on SLE16 (jsc#PED-10028).')
• Fix reference in 'net_sched: sch_sfq: use a temporary work area for validating configuration' (bsc#1242504)
• MyBS: Correctly generate build flags for non-multibuild package limit (bsc# 1244241) Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build')
• MyBS: Do not build kernel-obs-qa with limit_packages Fixes: 58e3f8c34b2b ('bs-upload-kernel: Pass limit_packages also on multibuild')
• MyBS: Simplify qa_expr generation Start with a 0 which makes the expression valid even if there are no QA repositories (currently does not happen). Then separator is always needed.
• Require zstd in kernel-default-devel when module compression is zstd To use ksym-provides tool modules need to be uncompressed. Without zstd at least kernel-default-base does not have provides. Link: https://github.com/openSUSE/rpm-config-SUSE/pull/82
• Use gcc-13 for build on SLE16 (jsc#PED-10028).
• add nf_tables for iptables non-legacy network handling This is needed for example by docker on the Alpine Linux distribution, but can also be used on openSUSE.
• bs-upload-kernel: Pass…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47557: net/sched: sch_ets: do not peek at classes beyond 'nbands' (bsc#1207361 bsc#1225468).
• CVE-2021-47595: net/sched: sch_ets: do not remove idle classes from the round-robin list (bsc#1207361 bsc#1226552).
• CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
• CVE-2023-52925: netfilter: nf_tables: do not fail inserts if duplicate has expired (bsc#1236822).
• CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
• CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
• CVE-2024-53197: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (bsc#1235464).
• CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
• CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
• CVE-2025-21756: vsock: Orphan socket after transport release (bsc#1238876).
• CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
• CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
• CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
• CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (bsc#1243330).
• CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
• CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
• CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38060: bpf: abort verification if env->cur_state->loop_entry != NULL (bsc#1245155).
• CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).

The following non-security bugs were fixed:

• ALSA: usb-audio: Fix a DMA to stack memory bug (git-fixes).
• Fix reference in 'net_sched: sch_sfq: use a temporary work area for validating configuration' (bsc#1242504)
• MyBS: Correctly generate build flags for non-multibuild package limit (bsc# 1244241) Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build')
• MyBS: Do not build kernel-obs-qa with limit_packages Fixes: 58e3f8c34b2b ('bs-upload-kernel: Pass limit_packages also on multibuild')
• MyBS: Simplify qa_expr generation Start with a 0 which makes the expression valid even if there are no QA repositories (currently does not happen). Then separator is always needed.
• bs-upload-kernel: Pass limit_packages also on multibuild Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build') Fixes: 747f601d4156 ('bs-upload-kernel, MyBS, Buildresults: Support multibuild (JSC-SLE#5501, boo#1211226, bsc#1218184)')
• hugetlb: unshare some PMDs when splitting VMAs (bsc#1245431).
• kernel-source: Do not use multiple -r in sed parameters
• kernel-source: Remove log.sh from sources
• mkspec: Exclude rt flavor from kernel-syms dependencies (bsc#1244337).
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431).
• mm/hugetlb: unshare…

Zhenpeng Lin discovered that the network packet scheduler implementation in the Linux kernel did not properly remove all references to a route filter before freeing it in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-2588)

It was discovered that the netfilter subsystem of the Linux kernel did not prevent one nft object from referencing an nft set in another nft table, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-2586)

Zhenpeng Lin discovered that the network packet scheduler implementation in the Linux kernel did not properly remove all references to a route filter before freeing it in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-2588)

It was discovered that the netfilter subsystem of the Linux kernel did not prevent one nft object from referencing an nft set in another nft table, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-2586)

It was discovered that the block layer subsystem in the Linux kernel did not properly initialize memory in some situations. A privileged local attacker could use this to expose sensitive information (kernel memory). (CVE-2022-0494)

Hu Jiahui discovered that multiple race conditions existed in the Advanced Linux Sound Architecture (ALSA) framework, leading to use-after-free vulnerabilities. A local attacker could use these to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1048)

It was discovered that the implementation of the 6pack and mkiss protocols in the Linux kernel did not handle detach events properly in some situations, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1195)

Minh Yuan discovered that the floppy disk driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-1652)

It was discovered that the Atheros ath9k wireless device driver in the Linux kernel did not properly handle some error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1679)

Norbert Slusarek discovered that a race condition existed in the perf subsystem in the Linux kernel, resulting in a use-after-free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1729)

It was discovered that the Marvell NFC device driver implementation in the Linux kernel did not properly perform memory cleanup operations in some situations, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-1734)

Duoming Zhou discovered a race condition in the NFC subsystem in the Linux kernel, leading to a use-after-free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1974)

Duoming Zhou discovered that the NFC subsystem in the Linux kernel did not properly prevent context switches from occurring during certain atomic context operations. A privileged local attacker could use this to cause a denial of service (system crash). (CVE-2022-1975)

Minh Yuan discovered that the floppy driver in the Linux kernel contained a race condition in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-33981)

Arthur Mongodin discovered that the netfilter subsystem in the Linux kernel did not properly perform data validation. A local attacker could use this to escalate privileges in certain situations. (CVE-2022-34918)

Zhenpeng Lin discovered that the network packet scheduler implementation in the Linux kernel did not properly remove all references to a route filter before freeing it in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-2588)

It was discovered that the netfilter subsystem of the Linux kernel did not prevent one nft object from referencing an nft set in another nft table, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-2586)

It was discovered that the block layer subsystem in the Linux kernel did not properly initialize memory in some situations. A privileged local attacker could use this to expose sensitive information (kernel memory). (CVE-2022-0494)

Hu Jiahui discovered that multiple race conditions existed in the Advanced Linux Sound Architecture (ALSA) framework, leading to use-after-free vulnerabilities. A local attacker could use these to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1048)

It was discovered that the implementation of the 6pack and mkiss protocols in the Linux kernel did not handle detach events properly in some situations, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1195)

Minh Yuan discovered that the floppy disk driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-1652)

It was discovered that the Atheros ath9k wireless device driver in the Linux kernel did not properly handle some error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1679)

Norbert Slusarek discovered that a race condition existed in the perf subsystem in the Linux kernel, resulting in a use-after-free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1729)

It was discovered that the Marvell NFC device driver implementation in the Linux kernel did not properly perform memory cleanup operations in some situations, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-1734)

Duoming Zhou discovered a race condition in the NFC subsystem in the Linux kernel, leading to a use-after-free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1974)

Duoming Zhou discovered that the NFC subsystem in the Linux kernel did not properly prevent context switches from occurring during certain atomic context operations. A privileged local attacker could use this to cause a denial of service (system crash). (CVE-2022-1975)

Minh Yuan discovered that the floppy driver in the Linux kernel contained a race condition in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-33981)

Arthur Mongodin discovered that the netfilter subsystem in the Linux kernel did not properly perform data validation. A local attacker could use this to escalate privileges in certain situations. (CVE-2022-34918)

Zhenpeng Lin discovered that the network packet scheduler implementation in the Linux kernel did not properly remove all references to a route filter before freeing it in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-2588)

It was discovered that the netfilter subsystem of the Linux kernel did not prevent one nft object from referencing an nft set in another nft table, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-2586)

It was discovered that the block layer subsystem in the Linux kernel did not properly initialize memory in some situations. A privileged local attacker could use this to expose sensitive information (kernel memory). (CVE-2022-0494)

Hu Jiahui discovered that multiple race conditions existed in the Advanced Linux Sound Architecture (ALSA) framework, leading to use-after-free vulnerabilities. A local attacker could use these to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1048)

Minh Yuan discovered that the floppy disk driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-1652)

It was discovered that the Atheros ath9k wireless device driver in the Linux kernel did not properly handle some error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1679)

It was discovered that the Marvell NFC device driver implementation in the Linux kernel did not properly perform memory cleanup operations in some situations, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-1734)

Duoming Zhou discovered a race condition in the NFC subsystem in the Linux kernel, leading to a use-after-free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1974)

Duoming Zhou discovered that the NFC subsystem in the Linux kernel did not properly prevent context switches from occurring during certain atomic context operations. A privileged local attacker could use this to cause a denial of service (system crash). (CVE-2022-1975)

Felix Fu discovered that the Sun RPC implementation in the Linux kernel did not properly handle socket states, leading to a use-after-free vulnerability. A remote attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-28893)

Arthur Mongodin discovered that the netfilter subsystem in the Linux kernel did not properly perform data validation. A local attacker could use this to escalate privileges in certain situations. (CVE-2022-34918)