CVE-2024-50269

usb: musb: sunxi: Fix accessing an released usb phy

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

usb: musb: sunxi: Fix accessing an released usb phy

Commit 6ed05c68cbca ("usb: musb: sunxi: Explicitly release USB PHY on exit") will cause that usb phy @glue->xceiv is accessed after released.

register platform driver @sunxi_musb_driver // get the usb phy @glue->xceiv sunxi_musb_probe() -> devm_usb_get_phy().
register and unregister platform driver @musb_driver musb_probe() -> sunxi_musb_init() use the phy here //the phy is released here musb_remove() -> sunxi_musb_exit() -> devm_usb_put_phy()
register @musb_driver again musb_probe() -> sunxi_musb_init() use the phy here but the phy has been released at 2). ...

Fixed by reverting the commit, namely, removing devm_usb_put_phy() from sunxi_musb_exit().

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.27%Up 0.2 points since Nov 19, 2024

What each source reports

NVD Score used 7.8

In the Linux kernel, the following vulnerability has been resolved:

usb: musb: sunxi: Fix accessing an released usb phy

Commit 6ed05c68cbca ("usb: musb: sunxi: Explicitly release USB PHY on exit") will cause that usb phy @glue->xceiv is accessed after released.

register platform driver @sunxi_musb_driver // get the usb phy @glue->xceiv sunxi_musb_probe() -> devm_usb_get_phy().
register and unregister platform driver @musb_driver musb_probe() -> sunxi_musb_init() use the phy here //the phy is released here musb_remove() -> sunxi_musb_exit() -> devm_usb_put_phy()
register @musb_driver again musb_probe() -> sunxi_musb_init() use the phy here but the phy has been released at 2). ...

Fixed by reverting the commit, namely, removing devm_usb_put_phy() from sunxi_musb_exit().

Record: CVE-2024-50269
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

CVE List 7.8

usb: musb: sunxi: Fix accessing an released usb phy

In the Linux kernel, the following vulnerability has been resolved:

usb: musb: sunxi: Fix accessing an released usb phy

Commit 6ed05c68cbca ("usb: musb: sunxi: Explicitly release USB PHY on exit") will cause that usb phy @glue->xceiv is accessed after released.

register platform driver @sunxi_musb_driver // get the usb phy @glue->xceiv sunxi_musb_probe() -> devm_usb_get_phy().
register and unregister platform driver @musb_driver musb_probe() -> sunxi_musb_init() use the phy here //the phy is released here musb_remove() -> sunxi_musb_exit() -> devm_usb_put_phy()
register @musb_driver again musb_probe() -> sunxi_musb_init() use the phy here but the phy has been released at 2). ...

Fixed by reverting the commit, namely, removing devm_usb_put_phy() from sunxi_musb_exit().

Record: CVE-2024-50269
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2024-44771 7.8

In the Linux kernel, the following vulnerability has been resolved:

usb: musb: sunxi: Fix accessing an released usb phy

Commit 6ed05c68cbca ("usb: musb: sunxi: Explicitly release USB PHY on exit") will cause that usb phy @glue->xceiv is accessed after released.

register platform driver @sunxi_musb_driver // get the usb phy @glue->xceiv sunxi_musb_probe() -> devm_usb_get_phy().
register and unregister platform driver @musb_driver musb_probe() -> sunxi_musb_init() use the phy here //the phy is released here musb_remove() -> sunxi_musb_exit() -> devm_usb_put_phy()
register @musb_driver again musb_probe() -> sunxi_musb_init() use the phy here but the phy has been released at 2). ...

Fixed by reverting the commit, namely, removing devm_usb_put_phy() from sunxi_musb_exit().

Record: EUVD-2024-44771
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-xrw7-56rh-2jrq 7.8

In the Linux kernel, the following vulnerability has been resolved: usb: musb: sunxi: Fix...

In the Linux kernel, the following vulnerability has been resolved:

usb: musb: sunxi: Fix accessing an released usb phy

Commit 6ed05c68cbca ("usb: musb: sunxi: Explicitly release USB PHY on exit") will cause that usb phy @glue->xceiv is accessed after released.

register platform driver @sunxi_musb_driver // get the usb phy @glue->xceiv sunxi_musb_probe() -> devm_usb_get_phy().
register and unregister platform driver @musb_driver musb_probe() -> sunxi_musb_init() use the phy here //the phy is released here musb_remove() -> sunxi_musb_exit() -> devm_usb_put_phy()
register @musb_driver again musb_probe() -> sunxi_musb_init() use the phy here but the phy has been released at 2). ...

Fixed by reverting the commit, namely, removing devm_usb_put_phy() from sunxi_musb_exit().

Record: GHSA-xrw7-56rh-2jrq
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVAZL-53727 7.8

CVE-2024-50269 affecting package kernel for versions less than 5.15.173.1-1

In the Linux kernel, the following vulnerability has been resolved:

usb: musb: sunxi: Fix accessing an released usb phy

Commit 6ed05c68cbca ("usb: musb: sunxi: Explicitly release USB PHY on exit") will cause that usb phy @glue->xceiv is accessed after released.

register platform driver @sunxi_musb_driver // get the usb phy @glue->xceiv sunxi_musb_probe() -> devm_usb_get_phy().
register and unregister platform driver @musb_driver musb_probe() -> sunxi_musb_init() use the phy here //the phy is released here musb_remove() -> sunxi_musb_exit() -> devm_usb_put_phy()
register @musb_driver again musb_probe() -> sunxi_musb_init() use the phy here but the phy has been released at 2). ...

Fixed by reverting the commit, namely, removing devm_usb_put_phy() from sunxi_musb_exit().

Record: AZL-53727
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBELL-CVE-2024-50269 7.8

Record: BELL-CVE-2024-50269
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 45 moreShow less

OSV 7.8

usb: musb: sunxi: Fix accessing an released usb phy

In the Linux kernel, the following vulnerability has been resolved:

usb: musb: sunxi: Fix accessing an released usb phy

Commit 6ed05c68cbca ("usb: musb: sunxi: Explicitly release USB PHY on exit") will cause that usb phy @glue->xceiv is accessed after released.

register platform driver @sunxi_musb_driver // get the usb phy @glue->xceiv sunxi_musb_probe() -> devm_usb_get_phy().
register and unregister platform driver @musb_driver musb_probe() -> sunxi_musb_init() use the phy here //the phy is released here musb_remove() -> sunxi_musb_exit() -> devm_usb_put_phy()
register @musb_driver again musb_probe() -> sunxi_musb_init() use the phy here but the phy has been released at 2). ...

Fixed by reverting the commit, namely, removing devm_usb_put_phy() from sunxi_musb_exit().

Record: CVE-2024-50269
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-50269 7.8

In the Linux kernel, the following vulnerability has been resolved: usb: musb: sunxi: Fix accessing an released usb phy Commit 6ed05c68cbca ("usb: musb: sunxi: Explicitly release USB PHY on exit") will cause that usb phy @glue->xceiv is accessed after released. 1) register platform driver @sunxi_musb_driver // get the usb phy @glue->xceiv sunxi_musb_probe() -> devm_usb_get_phy(). 2) register and unregister platform driver @musb_driver musb_probe() -> sunxi_musb_init() use the phy here //the phy is released here musb_remove() -> sunxi_musb_exit() -> devm_usb_put_phy() 3) register @musb_driver again musb_probe() -> sunxi_musb_init() use the phy here but the phy has been released at 2). ... Fixed by reverting the commit, namely, removing devm_usb_put_phy() from sunxi_musb_exit().

Record: DEBIAN-CVE-2024-50269
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2024-2491 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Fix NULL sring after live migration A NAPI is setup for each network sring to poll data to kernel The sring with source host is destroyed before live migration and new sring with target host is setup after live migration. The NAPI for the old sring is not deleted until setup new sring with target host after migration. With busy_poll/busy_read enabled, the NAPI can be polled before got deleted when resume VM. BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: xennet_poll+0xae/0xd20 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI Call Trace: finish_task_switch+0x71/0x230 timerqueue_del+0x1d/0x40 hrtimer_try_to_cancel+0xb5/0x110 xennet_alloc_rx_buffers+0x2a0/0x2a0 napi_busy_loop+0xdb/0x270 sock_poll+0x87/0x90 do_sys_poll+0x26f/0x580 tracing_map_insert+0x1d4/0x2f0 event_hist_trigger+0x14a/0x260 finish_task_switch+0x71/0x230 __schedule+0x256/0x890 recalc_sigpending+0x1b/0x50 xen_sched_clock+0x15/0x20 __rb_reserve_next+0x12d/0x140 ring_buffer_lock_reserve+0x123/0x3d0 event_triggers_call+0x87/0xb0 trace_event_buffer_commit+0x1c4/0x210 xen_clocksource_get_cycles+0x15/0x20 ktime_get_ts64+0x51/0xf0 SyS_ppoll+0x160/0x1a0 SyS_ppoll+0x160/0x1a0 do_syscall_64+0x73/0x130 entry_SYSCALL_64_after_hwframe+0x41/0xa6 ... RIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900 CR2: 0000000000000008 ---[ end trace f8601785b354351c ]--- xen frontend should remove the NAPIs for the old srings before live migration as the bond srings are destroyed There is a tiny window between the srings are set to NULL and the NAPIs are disabled, It is safe as the NAPI threads are still frozen at that time(CVE-2022-48969)

In the Linux kernel, the following vulnerability has been resolved:

bonding: stop the device in bond_setup_by_slave()

Commit 9eed321cde22 ("net: lapbether: only support ethernet devices") has been able to keep syzbot away from net/lapb, until today.

In the following splat [1], the issue is that a lapbether device has been created on a bonding device without members. Then adding a non ARPHRD_ETHER member forced the bonding master to change its type.

The fix is to make sure we call dev_close() in bond_setup_by_slave() so that the potential linked lapbether devices (or any other devices having assumptions on the physical device) are removed.

A similar bug has been addressed in commit 40baec225765 ("bonding: fix panic on non-ARPHRD_ETHER enslave failure")

Record: OESA-2024-2491
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2024-2492 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: bpf: support non-r10 register spill/fill to/from stack in precision tracking Use instruction (jump) history to record instructions that performed register spill/fill to/from stack, regardless if this was done through read-only r10 register, or any other register after copying r10 into it and potentially adjusting offset. To make this work reliably, we push extra per-instruction flags into instruction history, encoding stack slot index (spi) and stack frame number in extra 10 bit flags we take away from prev_idx in instruction history. We don't touch idx field for maximum performance, as it's checked most frequently during backtracking. This change removes basically the last remaining practical limitation of precision backtracking logic in BPF verifier. It fixes known deficiencies, but also opens up new opportunities to reduce number of verified states, explored in the subsequent patches. There are only three differences in selftests' BPF object files according to veristat, all in the positive direction (less states). File Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF) -------------------------------------- ------------- --------- --------- ------------- ---------- ---------- ------------- test_cls_redirect_dynptr.bpf.linked3.o cls_redirect 2987 2864 -123 (-4.12%) 240 231 -9 (-3.75%) xdp_synproxy_kern.bpf.linked3.o syncookie_tc 82848 82661 -187 (-0.23%) 5107 5073 -34 (-0.67%) xdp_synproxy_kern.bpf.linked3.o syncookie_xdp 85116 84964 -152 (-0.18%) 5162 5130 -32 (-0.62%) Note, I avoided renaming jmp_history to more generic insn_hist to minimize number of lines changed and potential merge conflicts between bpf and bpf-next trees. Notice also cur_hist_entry pointer reset to NULL at the beginning of instruction verification loop. This pointer avoids the problem of relying on last jump history entry's insn_idx to determine whether we already have entry for current instruction or not. It can happen that we added jump history entry because current instruction is_jmp_point(), but also we need to add instruction flags for stack access. In this case, we don't want to entries, so we need to reuse last added entry, if it is present. Relying on insn_idx comparison has the same ambiguity problem as the one that was fixed recently in [0], so we avoid that. [0] https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/(CVE-2023-52920)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: only mark 'subflow' endp as available

Adding the following warning ...

WARN_ON_ONCE(msk->pm.local_addr_used == 0)

... before decrementing the local_addr_used counter helped to find a bug when running the "remove single address" subtest from the mptcp_join.sh selftests.

Removing a 'signal' endpoint will trigger the removal of all subflows linked to this endpoint via mptcp_pm_nl_rm_addr_or_subflow() with rm_type == MPTCP_MIB_RMSUBFLOW. This will decrement the local_addr_used counter, which is wrong in this case because this counter is linked to 'subflow' endpoints, and here it is a 'signal' endpoint that is being removed.

Now, the counter is decremented, only if the ID is being used outside of mptcp_pm_nl_rm_addr_or_subflow(), only for 'subflow' endpoints, and if the ID is not 0 -- local_addr_used is not taking into account these ones. This marking of the ID as being available, and the decrement is done no matter if a subflow using this ID is currently available, because the subflow could have been closed before.(CVE-2024-45010)

In the Linux…

Record: OESA-2024-2492
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2024-2493 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: missing check virtio

Two missing check in virtio_net_hdr_to_skb() allowed syzbot to crash kernels again

After the skb_segment function the buffer may become non-linear (nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere the __skb_linearize function will not be executed, then the buffer will remain non-linear. Then the condition (offset >= skb_headlen(skb)) becomes true, which causes WARN_ON_ONCE in skb_checksum_help.
The struct sk_buff and struct virtio_net_hdr members must be mathematically related. (gso_size) must be greater than (needed) otherwise WARN_ON_ONCE. (remainder) must be greater than (needed) otherwise WARN_ON_ONCE. (remainder) may be 0 if division is without remainder.

offset+2 (4191) > skb_headlen() (1116) WARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 Modules linked in: CPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 Code: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 <0f> 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef RSP: 0018:ffffc90003a9f338 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209 RDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001 RBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c R13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d FS: 0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777 ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584 ip_finish_output_gso net/ipv4/ip_output.c:286 [inline] __ip_finish_output net/ipv4/ip_output.c:308 [inline] __ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295 ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433 dst_output include/net/dst.h:451 [inline] ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129 iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82 ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline] sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3545 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561 __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346 dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Found by Linux Verification Center (linuxtesting.org) with Syzkaller(CVE-2024-43817)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: initialise extack…

Record: OESA-2024-2493
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2024-2494 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

bonding: stop the device in bond_setup_by_slave()

Commit 9eed321cde22 ("net: lapbether: only support ethernet devices") has been able to keep syzbot away from net/lapb, until today.

The fix is to make sure we call dev_close() in bond_setup_by_slave() so that the potential linked lapbether devices (or any other devices having assumptions on the physical device) are removed.

A similar bug has been addressed in commit 40baec225765 ("bonding: fix panic on non-ARPHRD_ETHER enslave failure")

[1] skbuff: skb_under_panic: text:ffff800089508810 len:44 put:40 head:ffff0000c78e7c00 data:ffff0000c78e7bea tail:0x16 end:0x140 dev:bond0 kernel BUG at net/core/skbuff.c:192 ! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6007 Comm: syz-executor383 Not tainted 6.6.0-rc3-syzkaller-gbf6547d8715b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic net/core/skbuff.c:188 [inline] pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202 lr : skb_panic net/core/skbuff.c:188 [inline] lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202 sp : ffff800096a06aa0 x29: ffff800096a06ab0 x28: ffff800096a06ba0 x27: dfff800000000000 x26: ffff0000ce9b9b50 x25: 0000000000000016 x24: ffff0000c78e7bea x23: ffff0000c78e7c00 x22: 000000000000002c x21: 0000000000000140 x20: 0000000000000028 x19: ffff800089508810 x18: ffff800096a06100 x17: 0000000000000000 x16: ffff80008a629a3c x15: 0000000000000001 x14: 1fffe00036837a32 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000201 x10: 0000000000000000 x9 : cb50b496c519aa00 x8 : cb50b496c519aa00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800096a063b8 x4 : ffff80008e280f80 x3 : ffff8000805ad11c x2 : 0000000000000001 x1 : 0000000100000201 x0 : 0000000000000086 Call trace: skb_panic net/core/skbuff.c:188 [inline] skb_under_panic+0x13c/0x140 net/core/skbuff.c:202 skb_push+0xf0/0x108 net/core/skbuff.c:2446 ip6gre_header+0xbc/0x738 net/ipv6/ip6_gre.c:1384 dev_hard_header include/linux/netdevice.h:3136 [inline] lapbeth_data_transmit+0x1c4/0x298 drivers/net/wan/lapbether.c:257 lapb_data_transmit+0x8c/0xb0 net/lapb/lapb_iface.c:447 lapb_transmit_buffer+0x178/0x204 net/lapb/lapb_out.c:149 lapb_send_control+0x220/0x320 net/lapb/lapb_subr.c:251 __lapb_disconnect_request+0x9c/0x17c net/lapb/lapb_iface.c:326 lapb_device_event+0x288/0x4e0 net/lapb/lapb_iface.c:492 notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 call_netdevice_notifiers_info net/core/dev.c:1970 [inline] call_netdevice_notifiers_extack net/core/dev.c:2008 [inline] call_netdevice_notifiers net/core/dev.c:2022 [inline] __dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508 dev_close_many+0x1e0/0x470 net/core/dev.c:1559 dev_close+0x174/0x250 net/core/dev.c:1585 lapbeth_device_event+0x2e4/0x958 drivers/net/wan/lapbether.c:466 notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 call_netdevice_notifiers_info net/core/dev.c:1970 [inline] call_netdevice_notifiers_extack net/core/dev.c:2008 [inline] call_netdevice_notifiers net/core/dev.c:2022 [inline] __dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508 dev_close_many+0x1e0/0x470 net/core/dev.c:1559 dev_close+0x174/0x250 net/core/dev.c:1585 bond_enslave+0x2298/0x30cc drivers/net/bonding/bond_main.c:2332 bond_do_ioctl+0x268/0xc64 drivers/net/bonding/bond_main.c:4539 dev_ifsioc+0x754/0x9ac dev_ioctl+0x4d8/0xd34 net/core/dev_ioctl.c:786 sock_do_ioctl+0x1d4/0x2d0…

Record: OESA-2024-2494
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-2883 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:usb: musb: sunxi: Fix accessing an released usb phyCommit 6ed05c68cbca ( usb: musb: sunxi: Explicitly release USB PHY onexit ) will cause that usb phy @glue->xceiv is accessed after released.1) register platform driver @sunxi_musb_driver// get the usb phy @glue->xceivsunxi_musb_probe() -> devm_usb_get_phy().2) register and unregister platform driver @musb_drivermusb_probe() -> sunxi_musb_init()use the phy here//the phy is released heremusb_remove() -> sunxi_musb_exit() -> devm_usb_put_phy()3) register @musb_driver againmusb_probe() -> sunxi_musb_init()use the phy here but the phy has been released at 2)....Fixed by reverting the commit, namely, removing devm_usb_put_phy()from sunxi_musb_exit().(CVE-2024-50269)

In the Linux kernel, the following vulnerability has been resolved:dm cache: fix out-of-bounds access to the dirty bitset when resizingdm-cache checks the dirty bits of the cache blocks to be dropped whenshrinking the fast device, but an index bug in bitset iteration causesout-of-bounds access.Reproduce steps:1. create a cache device of 1024 cache blocks (128 bytes dirty bitset)dmsetup create cmeta --table 0 8192 linear /dev/sdc 0 dmsetup create cdata --table 0 131072 linear /dev/sdc 8192 dmsetup create corig --table 0 524288 linear /dev/sdc 262144 dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=directdmsetup create cache --table 0 524288 cache /dev/mapper/cmeta /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0 2. shrink the fast device to 512 cache blocks, triggering out-of-bounds access to the dirty bitset (offset 0x80)dmsetup suspend cachedmsetup reload cdata --table 0 65536 linear /dev/sdc 8192 dmsetup resume cdatadmsetup resume cacheKASAN reports: BUG: KASAN: vmalloc-out-of-bounds in cache_preresume+0x269/0x7b0 Read of size 8 at addr ffffc900000f3080 by task dmsetup/131 (...snip...) The buggy address belongs to the virtual mapping at [ffffc900000f3000, ffffc900000f5000) created by: cache_ctr+0x176a/0x35f0 (...snip...) Memory state around the buggy address: ffffc900000f2f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900000f3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc900000f3080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc900000f3100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900000f3180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8Fix by making the index post-incremented.(CVE-2024-50279)

In the Linux kernel, the following vulnerability has been resolved:iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table()If per_time_scales[i] or per_time_gains[i] kcalloc fails in the for loopof iio_gts_build_avail_scale_table(), the err_free_out will fail to callkfree() each time when i is reduced to 0, so all the per_time_scales[0]and per_time_gains[0] will not be freed, which will cause memory leaks.Fix it by checking if i >= 0.(CVE-2024-53076)

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath10k: avoid NULL pointer error during sdio remove

When running 'rmmod ath10k', ath10k_sdio_remove() will free sdio workqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON is set to yes, kernel panic will happen: Call trace: destroy_workqueue+0x1c/0x258 ath10k_sdio_remove+0x84/0x94 sdio_bus_remove+0x50/0x16c device_release_driver_internal+0x188/0x25c device_driver_detach+0x20/0x2c

This is because during 'rmmod ath10k', ath10k_sdio_remove() will call ath10k_core_destroy() before destroy_workqueue(). wiphy_dev_release() will finally be called in ath10k_core_destroy(). This function will free struct cfg80211_registered_device *rdev and all its members, including wiphy, dev and the pointer of sdio workqueue. Then the pointer of sdio workqueue…

Record: OESA-2025-2883
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-50269 7.8

Record: UBUNTU-CVE-2024-50269
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVCLSA-2025-1742469561 No score

kernel: Fix of 21 CVEs

net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
smb: client: fix potential deadlock when releasing mids {CVE-2023-52757}
tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). {CVE-2024-50154}
ALSA: 6fire: Release resources at card release {CVE-2024-53239}
smb: client: fix use-after-free of signing key {CVE-2024-53179}
tun: avoid double free in tun_free_netdev {CVE-2022-4744}
Revert "tun: call dev_get_valid_name() before register_netdevice()" {CVE-2022-4744}
USB: serial: io_edgeport: fix use after free in debug printk {CVE-2024-50267}
igb: Fix use-after-free error during reset {CVE-2021-47301}
HID: core: zero-initialize the report buffer {CVE-2024-50302}
usb: musb: sunxi: Fix accessing an released usb phy {CVE-2024-50269}
dm cache: fix potential out-of-bounds access on the first resume {CVE-2024-50278}
dm cache: fix out-of-bounds access to the dirty bitset when resizing {CVE-2024-50278}
wifi: iwlegacy: Clear stale interrupts before resuming device {CVE-2024-50234}
security/keys: fix slab-out-of-bounds in key_task_permission {CVE-2024-50301}
udf: fix uninit-value use in udf_get_fileshortad {CVE-2024-50143}
overflow: Allow mixed type arguments {CVE-2024-50143}
compiler.h: drop fallback overflow checkers {CVE-2024-50143}
overflow: Add _must_check attribute to check*() helpers {CVE-2024-50143}
media: s5p-jpeg: prevent buffer overflows {CVE-2024-53061}
mptcp: fix double-free on socket dismantle {CVE-2024-26782}
drm/amdgpu: fix usage slab after free {CVE-2024-56551}
bpf: fix OOB devmap writes when deleting elements {CVE-2024-56615}
uprobe: avoid out-of-bounds memory access of fetching args {CVE-2024-50067}

Record: CLSA-2025-1742469561
Updated: 2026-11-02

OSVCLSA-2025-1742471200 No score

kernel: Fix of 21 CVEs

net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
smb: client: fix potential deadlock when releasing mids {CVE-2023-52757}
tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). {CVE-2024-50154}
ALSA: 6fire: Release resources at card release {CVE-2024-53239}
smb: client: fix use-after-free of signing key {CVE-2024-53179}
inet_connection_sock: remove unused parameter of reqsk_queue_unlink func {CVE-2024-50154}
tun: avoid double free in tun_free_netdev {CVE-2022-4744}
USB: serial: io_edgeport: fix use after free in debug printk {CVE-2024-50267}
igb: Fix use-after-free error during reset {CVE-2021-47301}
HID: core: zero-initialize the report buffer {CVE-2024-50302}
usb: musb: sunxi: Fix accessing an released usb phy {CVE-2024-50269}
dm cache: fix potential out-of-bounds access on the first resume {CVE-2024-50278}
dm cache: fix out-of-bounds access to the dirty bitset when resizing {CVE-2024-50278}
wifi: iwlegacy: Clear stale interrupts before resuming device {CVE-2024-50234}
security/keys: fix slab-out-of-bounds in key_task_permission {CVE-2024-50301}
udf: fix uninit-value use in udf_get_fileshortad {CVE-2024-50143}
overflow: Allow mixed type arguments {CVE-2024-50143}
compiler.h: drop fallback overflow checkers {CVE-2024-50143}
overflow: Add _must_check attribute to check*() helpers {CVE-2024-50143}
media: s5p-jpeg: prevent buffer overflows {CVE-2024-53061}
mptcp: fix double-free on socket dismantle {CVE-2024-26782}
drm/amdgpu: fix usage slab after free {CVE-2024-56551}
bpf: fix OOB devmap writes when deleting elements {CVE-2024-56615}
uprobe: avoid out-of-bounds memory access of fetching args {CVE-2024-50067}

Record: CLSA-2025-1742471200
Updated: 2026-11-02

OSVCLSA-2025-1744213128 No score

Fix of 55 CVEs

CVE-url: https://ubuntu.com/security/CVE-2025-21858
- geneve: Fix use-after-free in geneve_find_dev().
CVE-url: https://ubuntu.com/security/CVE-2024-36921
- wifi: iwlwifi: mvm: guard against invalid STA ID on removal
CVE-url: https://ubuntu.com/security/CVE-2023-52621
- bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
CVE-url: https://ubuntu.com/security/CVE-2025-21855
- ibmvnic: Don't reference skb after sending to VIOS
CVE-url: https://ubuntu.com/security/CVE-2021-47110
- x86/kvm: Disable kvmclock on all CPUs on shutdown
CVE-url: https://ubuntu.com/security/CVE-2025-21791
- vrf: use RCU protection in l3mdev_l3_out()
CVE-url: https://ubuntu.com/security/CVE-2024-57980
- media: uvcvideo: Fix double free in error path
CVE-url: https://ubuntu.com/security/CVE-2025-21718
- net: rose: fix timer races against user threads
CVE-url: https://ubuntu.com/security/CVE-2025-21735
- NFC: nci: Add bounds checking in nci_hci_create_pipe()
CVE-url: https://ubuntu.com/security/CVE-2023-52805
- jfs: fix array-index-out-of-bounds in diAlloc
CVE-url: https://ubuntu.com/security/CVE-2023-52847
- media: bttv: fix use after free error due to btv->timeout timer
CVE-url: https://ubuntu.com/security/CVE-2024-41014
- xfs: add bounds checking to xlog_recover_process_data
CVE-url: https://ubuntu.com/security/CVE-2025-21782
- orangefs: fix a oob in orangefs_debug_write
CVE-url: https://ubuntu.com/security/CVE-2024-26872
- RDMA/srpt: Do not register event handler until srpt device is fully setup
CVE-url: https://ubuntu.com/security/CVE-2024-26982
- Squashfs: check the inode number is not the invalid value of zero
CVE-url: https://ubuntu.com/security/CVE-2024-56548
- hfsplus: don't query the device logical block size multiple times
CVE-url: https://ubuntu.com/security/CVE-2024-57850
- jffs2: Prevent rtime decompress memory corruption
CVE-url: https://ubuntu.com/security/CVE-2024-49982
- aoe: fix the potential use-after-free problem in more places
CVE-url: https://ubuntu.com/security/CVE-2024-47696
- RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
CVE-url: https://ubuntu.com/security/CVE-2024-50074
- parport: Proper fix for array out-of-bounds access
CVE-url: https://ubuntu.com/security/CVE-2025-21687
- vfio/platform: check the bounds of read/write syscalls
CVE-url: https://ubuntu.com/security/CVE-2024-57889
- regmap: allow to disable all locking mechanisms
- pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
CVE-url: https://ubuntu.com/security/CVE-2024-56539
- wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
CVE-url: https://ubuntu.com/security/CVE-2024-53680
- ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
CVE-url: https://ubuntu.com/security/CVE-2024-56630
- ocfs2: free inode when ocfs2_get_init_inode() fails
CVE-url: https://ubuntu.com/security/CVE-2024-53184
- um: ubd: Do not use drvdata in release
CVE-url: https://ubuntu.com/security/CVE-2024-57884
- mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
CVE-url: https://ubuntu.com/security/CVE-2024-56597
- jfs: fix shift-out-of-bounds in dbSplit
CVE-url: https://ubuntu.com/security/CVE-2025-21664
- dm thin: make get_first_thin use rcu-safe list first function
CVE-url: https://ubuntu.com/security/CVE-2024-56594
- drm/amdgpu: set the right AMDGPU sg segment limitation
CVE-url: https://ubuntu.com/security/CVE-2024-56681
- crypto: bcm - add error check in the ahash_hmac_init function
CVE-url: https://ubuntu.com/security/CVE-2024-52332
- igb: Fix potential invalid memory access in igb_init_module()
CVE-url:…

Record: CLSA-2025-1744213128
Updated: 2026-11-02

OSVCLSA-2025-1744624441 No score

Fix of 56 CVEs

[ Ubuntu: 4.15.0-246.257 ]

CVE-url: https://ubuntu.com/security/CVE-2025-21858
- geneve: Fix use-after-free in geneve_find_dev().
CVE-url: https://ubuntu.com/security/CVE-2024-36921
- wifi: iwlwifi: mvm: guard against invalid STA ID on removal
CVE-url: https://ubuntu.com/security/CVE-2023-52621
- bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
CVE-url: https://ubuntu.com/security/CVE-2025-21855
- ibmvnic: Don't reference skb after sending to VIOS
CVE-url: https://ubuntu.com/security/CVE-2021-47110
- x86/kvm: Disable kvmclock on all CPUs on shutdown
CVE-url: https://ubuntu.com/security/CVE-2025-21791
- vrf: use RCU protection in l3mdev_l3_out()
CVE-url: https://ubuntu.com/security/CVE-2024-57980
- media: uvcvideo: Fix double free in error path
CVE-url: https://ubuntu.com/security/CVE-2025-21718
- net: rose: fix timer races against user threads
CVE-url: https://ubuntu.com/security/CVE-2025-21735
- NFC: nci: Add bounds checking in nci_hci_create_pipe()
CVE-url: https://ubuntu.com/security/CVE-2023-52805
- jfs: fix array-index-out-of-bounds in diAlloc
CVE-url: https://ubuntu.com/security/CVE-2023-52847
- media: bttv: fix use after free error due to btv->timeout timer
CVE-url: https://ubuntu.com/security/CVE-2024-41014
- xfs: add bounds checking to xlog_recover_process_data
CVE-url: https://ubuntu.com/security/CVE-2025-21782
- orangefs: fix a oob in orangefs_debug_write
CVE-url: https://ubuntu.com/security/CVE-2024-26872
- RDMA/srpt: Do not register event handler until srpt device is fully setup
CVE-url: https://ubuntu.com/security/CVE-2024-26982
- Squashfs: check the inode number is not the invalid value of zero
CVE-url: https://ubuntu.com/security/CVE-2024-56548
- hfsplus: don't query the device logical block size multiple times
CVE-url: https://ubuntu.com/security/CVE-2024-57850
- jffs2: Prevent rtime decompress memory corruption
CVE-url: https://ubuntu.com/security/CVE-2024-49982
- aoe: fix the potential use-after-free problem in more places
CVE-url: https://ubuntu.com/security/CVE-2024-47696
- RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
CVE-url: https://ubuntu.com/security/CVE-2024-50074
- parport: Proper fix for array out-of-bounds access
CVE-url: https://ubuntu.com/security/CVE-2025-21687
- vfio/platform: check the bounds of read/write syscalls
CVE-url: https://ubuntu.com/security/CVE-2024-57889
- regmap: allow to disable all locking mechanisms
- pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
CVE-url: https://ubuntu.com/security/CVE-2024-56539
- wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
CVE-url: https://ubuntu.com/security/CVE-2024-53680
- ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
CVE-url: https://ubuntu.com/security/CVE-2024-56630
- ocfs2: free inode when ocfs2_get_init_inode() fails
CVE-url: https://ubuntu.com/security/CVE-2024-53184
- um: ubd: Do not use drvdata in release
CVE-url: https://ubuntu.com/security/CVE-2024-57884
- mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
CVE-url: https://ubuntu.com/security/CVE-2024-56597
- jfs: fix shift-out-of-bounds in dbSplit
CVE-url: https://ubuntu.com/security/CVE-2025-21664
- dm thin: make get_first_thin use rcu-safe list first function
CVE-url: https://ubuntu.com/security/CVE-2024-56594
- drm/amdgpu: set the right AMDGPU sg segment limitation
CVE-url: https://ubuntu.com/security/CVE-2024-56681
- crypto: bcm - add error check in the ahash_hmac_init function
CVE-url: https://ubuntu.com/security/CVE-2024-52332
- igb: Fix potential invalid memory access in…

Record: CLSA-2025-1744624441
Updated: 2026-11-02

OSVCLSA-2025-1744713316 No score

Fix of 50 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-26872
- RDMA/srpt: Do not register event handler until srpt device is fully setup
CVE-url: https://ubuntu.com/security/CVE-2024-53179
- smb: client: fix use-after-free of signing key
CVE-url: https://ubuntu.com/security/CVE-2021-47357
- atm: iphase: fix possible use-after-free in ia_module_exit()
Bionic update: upstream stable patchset 2022-11-15 (LP: #1996650) // CVE- url: https://ubuntu.com/security/CVE-2021-47103
- inet: fully convert sk->sk_rx_dst to RCU rules
CVE-url: https://ubuntu.com/security/CVE-2025-21858
- geneve: Fix use-after-free in geneve_find_dev().
CVE-url: https://ubuntu.com/security/CVE-2024-36921
- wifi: iwlwifi: mvm: guard against invalid STA ID on removal
Bionic update: upstream stable patchset 2022-07-25 (LP: #1982782) // CVE- url: https://ubuntu.com/security/CVE-2022-49478
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
CVE-url: https://ubuntu.com/security/CVE-2023-52621
- bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
CVE-url: https://ubuntu.com/security/CVE-2025-21855
- ibmvnic: Don't reference skb after sending to VIOS
CVE-url: https://ubuntu.com/security/CVE-2021-47110
- x86/kvm: Disable kvmclock on all CPUs on shutdown
CVE-url: https://ubuntu.com/security/CVE-2024-57980
- media: uvcvideo: Fix double free in error path
CVE-url: https://ubuntu.com/security/CVE-2025-21718
- net: rose: fix timer races against user threads
CVE-url: https://ubuntu.com/security/CVE-2025-21735
- NFC: nci: Add bounds checking in nci_hci_create_pipe()
CVE-url: https://ubuntu.com/security/CVE-2023-52805
- jfs: fix array-index-out-of-bounds in diAlloc
CVE-url: https://ubuntu.com/security/CVE-2023-52847
- media: bttv: fix use after free error due to btv->timeout timer
CVE-url: https://ubuntu.com/security/CVE-2024-41014
- xfs: add bounds checking to xlog_recover_process_data
Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE- url: https://ubuntu.com/security/CVE-2022-48702
- ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE- url: https://ubuntu.com/security/CVE-2022-48701
- ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()
CVE-url: https://ubuntu.com/security/CVE-2024-26982
- Squashfs: check the inode number is not the invalid value of zero
CVE-url: https://ubuntu.com/security/CVE-2024-56548
- hfsplus: don't query the device logical block size multiple times
CVE-url: https://ubuntu.com/security/CVE-2024-57850
- jffs2: Prevent rtime decompress memory corruption
CVE-url: https://ubuntu.com/security/CVE-2024-49982
- aoe: fix the potential use-after-free problem in more places
CVE-url: https://ubuntu.com/security/CVE-2025-21687
- vfio/platform: check the bounds of read/write syscalls
CVE-url: https://ubuntu.com/security/CVE-2024-56539
- wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
CVE-url: https://ubuntu.com/security/CVE-2024-53680
- ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
CVE-url: https://ubuntu.com/security/CVE-2024-56630
- ocfs2: free inode when ocfs2_get_init_inode() fails
CVE-url: https://ubuntu.com/security/CVE-2024-53184
- um: ubd: Do not use drvdata in release
CVE-url: https://ubuntu.com/security/CVE-2024-57884
- mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
CVE-url: https://ubuntu.com/security/CVE-2024-56597
- jfs: fix shift-out-of-bounds in dbSplit
CVE-url: https://ubuntu.com/security/CVE-2025-21664
- dm thin: make get_first_thin use rcu-safe…

Record: CLSA-2025-1744713316
Updated: 2026-11-02

OSVCLSA-2025-1746479711 No score

kernel-uek: Fix of 225 CVEs

sctp: sysctl: auth_enable: avoid using current->nsproxy
sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy {CVE-2025-21640}
bpf: Use preempt_count() directly in bpf_send_signal_common()
Revert "sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy"
jfs: fix slab-out-of-bounds read in ea_get()
serial: 8250_dma: terminate correct DMA in tx_dma_flush()
Revert "sctp: sysctl: auth_enable: avoid using current->nsproxy"
net: usb: usbnet: restore usb%d name exception for local mac addresses
vlan: fix memory leak in vlan_newlink() {CVE-2022-49636}
rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity
LTS tag: v5.4.291
eeprom: digsy_mtc: Make GPIO lookup table match the device
slimbus: messaging: Free transaction ID in delayed interrupt scenario {CVE-2025-21914}
intel_th: pci: Add Panther Lake-P/U support
intel_th: pci: Add Panther Lake-H support
intel_th: pci: Add Arrow Lake support
Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
xhci: pci: Fix indentation in the PCI device ID definitions
usb: gadget: Check bmAttributes only if configuration is valid
usb: gadget: Fix setting self-powered state on suspend
usb: gadget: Set self-powered based on MaxPower and bmAttributes
usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality
usb: typec: ucsi: increase timeout for PPM reset operations
usb: atm: cxacru: fix a flaw in existing endpoint checks {CVE-2025-21916}
usb: renesas_usbhs: Flush the notify_hotplug_work {CVE-2025-21917}
usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader
usb: renesas_usbhs: Use devm_usb_get_phy()
usb: renesas_usbhs: Call clk_put()
Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"
gpio: rcar: Fix missing of_node_put() call
net: ipv6: fix missing dst ref drop in ila lwtunnel
net: ipv6: fix dst ref loop in ila lwtunnel
net-timestamp: support TCP GSO case for a few missing flags
vlan: enforce underlying device type {CVE-2025-21920}
ppp: Fix KMSAN uninit-value warning with bpf {CVE-2025-21922}
be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
drm/sched: Fix preprocessor guard
hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()
llc: do not use skb_get() before dev_queue_xmit() {CVE-2025-21925}
hwmon: (ad7314) Validate leading zero bits and return error
hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
hwmon: (pmbus) Initialise page count in pmbus_identify()
caif_virtio: fix wrong pointer check in cfv_probe() {CVE-2025-21904}
net: gso: fix ownership in __udp_gso_segment {CVE-2025-21926}
HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
HID: google: fix unused variable warning under !CONFIG_ACPI
wifi: iwlwifi: limit printed string from FW file {CVE-2025-21905}
mm/page_alloc: fix uninitialized variable
rapidio: fix an API misues when rio_add_net() fails {CVE-2025-21934}
rapidio: add check for rio_add_net() in rio_scan_alloc_net()
wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
wifi: cfg80211: regulatory: improve invalid hints checking {CVE-2025-21910}
x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
x86/cpu: Validate CPUID leaf 0x2 EDX output
x86/cacheinfo: Validate CPUID leaf 0x2 EDX output
platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
ALSA: hda/realtek: update ALC222 depop optimize
ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'"
drm/amdgpu: disable BAR resize on Dell G5 SE
drm/amdgpu: Check extended configuration space register when system uses large bar
drm/amdgpu: skip BAR resizing if the bios already…

Record: CLSA-2025-1746479711
Updated: 2026-11-02

OSVSUSE-SU-2024:4314-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
CVE-2024-47703: bpf, lsm: add check for BPF LSM return value (bsc#1231946).
CVE-2024-49852: scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del() (bsc#1232819).
CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
CVE-2024-49881: ext4: update orig_path in ext4_find_extent() (bsc#1232201).
CVE-2024-49883: ext4: aovid use-after-free in ext4_ext_insert_extent() (bsc#1232199).
CVE-2024-49894: drm/amd/display: Fix index out of bounds in degamma hardware format translation (bsc#1232354).
CVE-2024-49895: drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation (bsc#1232352).
CVE-2024-49897: drm/amd/display: Check phantom_stream before it is used (bsc#1232355).
CVE-2024-49899: drm/amd/display: Initialize denominators' default to 1 (bsc#1232358).
CVE-2024-49901: drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs (bsc#1232305).
CVE-2024-49909: drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func (bsc#1232337).
CVE-2024-49911: drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func (bsc#1232366).
CVE-2024-49912: drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream' (bsc#1232367).
CVE-2024-49913: drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream (bsc#1232307).
CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
CVE-2024-49922:…

Record: SUSE-SU-2024:4314-1
Updated: 2026-11-02

OSVSUSE-SU-2024:4315-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
CVE-2024-47745: mm: call the security_mmap_file() LSM hook in remap_file_pages() (bsc#1232135).
CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
CVE-2024-49934: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (bsc#1232387).
CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
CVE-2024-49968: ext4: filesystems without casefold feature cannot be mounted with siphash (bsc#1232264).
CVE-2024-49983: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (bsc#1232096).
CVE-2024-49989: drm/amd/display: fix double free issue during amdgpu module unload (bsc#1232483).
CVE-2024-50009: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (bsc#1232318).
CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500).
CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
CVE-2024-50093: thermal: intel: int340x: processor: Fix warning during module unload (bsc#1232877).
CVE-2024-50098: scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down (bsc#1232881).
CVE-2024-50108: drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too (bsc#1232884).
CVE-2024-50110: xfrm: fix one more kernel-infoleak in algo dumping (bsc#1232885).
CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
CVE-2024-50127: net: sched: fix…

Record: SUSE-SU-2024:4315-1
Updated: 2026-11-02

OSVSUSE-SU-2024:4316-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
CVE-2024-47703: bpf, lsm: add check for BPF LSM return value (bsc#1231946).
CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
CVE-2024-49888: bpf: Fix a sdiv overflow issue (bsc#1232208).
CVE-2024-49899: drm/amd/display: Initialize denominators' default to 1 (bsc#1232358).
CVE-2024-49911: drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func (bsc#1232366).
CVE-2024-49912: drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream' (bsc#1232367).
CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
CVE-2024-49922: drm/amd/display: Check null pointers before using them (bsc#1232374).
CVE-2024-49923: drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags (bsc#1232361).
CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
CVE-2024-49933: blk_iocost: fix more out of bound shifts (bsc#1232368).
CVE-2024-49934: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (bsc#1232387).
CVE-2024-49944: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start (bsc#1232166).
CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
CVE-2024-49968: ext4: filesystems without casefold feature cannot be mounted with siphash (bsc#1232264).
CVE-2024-49983:…

Record: SUSE-SU-2024:4316-1
Updated: 2026-11-02

OSVSUSE-SU-2024:4318-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-53095: smb: client: Fix use-after-free of network namespace (bsc#1233642).
CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
CVE-2023-6270: aoe: fix the potential use-after-free problem in more places (bsc#1218562).
CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
CVE-2024-46828: sched: sch_cake: fix bulk flow accounting logic for host fairness (bsc#1231114).
CVE-2024-46831: net: microchip: vcap: Fix use-after-free…

Record: SUSE-SU-2024:4318-1
Updated: 2026-11-02

OSVSUSE-SU-2024:4364-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
CVE-2022-48957: dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() (bsc#1231973).
CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
CVE-2022-48980: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() (bsc#1232233).
CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
CVE-2022-49017: tipc: re-fetch skb cb after tipc_msg_validate (bsc#1232004).
CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB (bsc#1228709).
CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005).
CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837).
CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
CVE-2024-46716: dmaengine: altera-msgdma:…

Record: SUSE-SU-2024:4364-1
Updated: 2026-11-02

OSVSUSE-SU-2024:4376-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
CVE-2024-47701: ext4: explicitly exit when ext4_find_inline_entry returns an error (bsc#1231920).
CVE-2024-47745: mm: split critical region in remap_file_pages() and invoke LSMs in between (bsc#1232135).
CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
CVE-2024-49934: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (bsc#1232387).
CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
CVE-2024-49968: ext4: fix error message when rejecting the default hash (bsc#1232264).
CVE-2024-49983: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (bsc#1232096).
CVE-2024-49989: drm/amd/display: fix double free issue during amdgpu module unload (bsc#1232483).
CVE-2024-50009: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (bsc#1232318).
CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500).
CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
CVE-2024-50093: thermal: intel: int340x: processor: Fix warning during module unload (bsc#1232877).
CVE-2024-50098: scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down (bsc#1232881).
CVE-2024-50108: drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too (bsc#1232884).
CVE-2024-50110: xfrm: fix one more kernel-infoleak in algo dumping (bsc#1232885).
CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
CVE-2024-50127: net: sched: fix…

Record: SUSE-SU-2024:4376-1
Updated: 2026-11-02

OSVSUSE-SU-2024:4387-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
CVE-2023-6270: aoe: fix the potential use-after-free problem in more places (bsc#1218562).
CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
CVE-2024-46828: sched: sch_cake: fix bulk flow accounting logic for host fairness (bsc#1231114).
CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
CVE-2024-46841: btrfs: do not BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() (bsc#1231094).
CVE-2024-46843: scsi: ufs: core: Remove SCSI host only if added…

Record: SUSE-SU-2024:4387-1
Updated: 2026-11-02

OSVSUSE-SU-2025:1293-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
CVE-2021-47645: media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com (bsc#1237767).
CVE-2021-47648: gpu: host1x: Fix a memory leak in 'host1x_remove()' (bsc#1237725).
CVE-2022-49046: i2c: dev: check return value when calling dev_set_name() (bsc#1237842).
CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (bsc#1237903).
CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
CVE-2022-49059: nfc: nci: add flush_workqueue to prevent uaf (bsc#1238007).
CVE-2022-49074: irqchip/gic-v3: Fix GICR_CTLR.RWP polling (bsc#1237728).
CVE-2022-49075: btrfs: fix qgroup reserve overflow the qgroup limit (bsc#1237733).
CVE-2022-49084: qede: confirm skb is allocated before using (bsc#1237751).
CVE-2022-49107: ceph: fix memory leak in ceph_readdir when note_last_dentry returns error (bsc#1237973).
CVE-2022-49109: ceph: fix inode reference leakage in ceph_get_snapdir() (bsc#1237836).
CVE-2022-49119: scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() (bsc#1237925).
CVE-2022-49120: scsi: pm8001: Fix task leak in pm8001_send_abort_all() (bsc#1237969).
CVE-2022-49209: bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full (bsc#1238252).
CVE-2022-49220: dax: make sure inodes are flushed before destroy cache (bsc#1237936).
CVE-2022-49275: can: m_can: m_can_tx_handler(): fix use after free of skb (bsc#1238719).
CVE-2022-49286: tpm: use try_get_ops() in tpm-space.c (bsc#1238647).
CVE-2022-49292: ALSA: oss: Fix PCM OSS buffer allocation overflow (bsc#1238625).
CVE-2022-49308: extcon: Modify extcon device to be created after driver data is set (bsc#1238654).
CVE-2022-49331: nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling (bsc#1237813).
CVE-2022-49344: af_unix: Fix a data-race in unix_dgram_peer_wake_me() (bsc#1237988).
CVE-2022-49367: net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register (bsc#1238447).
CVE-2022-49370: firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (bsc#1238467).
CVE-2022-49372: tcp: tcp_rtx_synack() can be called from process context (bsc#1238251).
CVE-2022-49388: ubi: ubi_create_volume: Fix use-after-free when volume creation failed (bsc#1237934).
CVE-2022-49395: um: Fix out-of-bounds read in LDT setup (bsc#1237953).
CVE-2022-49397: phy: qcom-qmp: fix struct clk leak on probe errors (bsc#1237823).
CVE-2022-49404: RDMA/hfi1: Fix potential integer multiplication overflow errors (bsc#1238430).
CVE-2022-49416: wifi: mac80211: fix use-after-free in chanctx code (bsc#1238293).
CVE-2022-49433: RDMA/hfi1: Prevent use of lock before it is initialized (bsc#1238268).
CVE-2022-49472: net: phy: micrel: Allow probing without .driver_data (bsc#1238951).
CVE-2022-49488: drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock (bsc#1238600).
CVE-2022-49495: drm/msm/hdmi: check return value after calling platform_get_resource_byname() (bsc#1237932).
CVE-2022-49497: net: remove two BUG() from skb_checksum_help() (bsc#1238946).
CVE-2022-49505: NFC: NULL out the dev->rfkill to prevent UAF (bsc#1238615).
CVE-2022-49516: ice: always check VF VSI pointer values (bsc#1238953).
CVE-2022-49519: ath10k: skip ath10k_halt during suspend for driver state RESTARTING (bsc#1238943).
CVE-2022-49524: media: pci: cx23885: Fix the error handling in cx23885_initdev() (bsc#1238949).
CVE-2022-49530: drm/amd/pm: fix double free in si_parse_power_table() (bsc#1238944).
CVE-2022-49538: ALSA: jack: Fix mutex call in snd_jack_report() (bsc#1238843).
CVE-2022-49544: ipw2x00: Fix potential NULL dereference in libipw_xmit() (bsc#1238721).
CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238729). -…

Record: SUSE-SU-2025:1293-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20163-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
CVE-2024-42102: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (bsc#1233132).
CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
CVE-2024-46841: btrfs:…

Record: SUSE-SU-2025:20163-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20164-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
CVE-2024-42102: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (bsc#1233132).
CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
CVE-2024-46841: btrfs: do…

Record: SUSE-SU-2025:20164-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20246-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
CVE-2024-42102: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (bsc#1233132).
CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
CVE-2024-46841: btrfs:…

Record: SUSE-SU-2025:20246-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20247-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
CVE-2024-42102: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (bsc#1233132).
CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
CVE-2024-46841: btrfs: do…

Record: SUSE-SU-2025:20247-1
Updated: 2026-11-02

OSVUSN-7288-1 No score

linux, linux-lowlatency vulnerabilities

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)