CVE-2021-46932

In the Linux kernel, the following vulnerability has been resolved: Input: appletouch - initialize work before device registration Syzbot has reported warning in __flush_work(). This warning is caused by work->func == NULL, which means missing work initialization. This may happen, since input_dev->close() calls cancel_work_sync(&dev->work), but dev->work initalization happens after input_register_device() call. So this patch moves dev->work initialization before registering input device

• CVE-url: https://ubuntu.com/security/CVE-2024-23307
  • md/raid5: fix atomicity violation in raid5_cache_count
• CVE-url: https://ubuntu.com/security/CVE-2021-46932
  • Input: appletouch - initialize work before device registration
• CVE-url: https://ubuntu.com/security/CVE-2021-46936
  • net: fix use-after-free in tw_timer_handler
• Bionic update: upstream stable patchset 2021-06-01 (LP: #1930472) // CVE- url: https://ubuntu.com/security/CVE-2021-46939
  • tracing: Restructure trace_clock_global() to never block
• CVE-url: https://ubuntu.com/security/CVE-2021-46933
  • usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
• Bionic update: upstream stable patchset 2022-01-27 (LP: #1959335) // CVE- url: https://ubuntu.com/security/CVE-2021-46924
  • NFC: st21nfca: Fix memory leak in device probe and remove
• CVE-url: https://ubuntu.com/security/CVE-2023-52469
  • drivers/amd/pm: fix a use-after-free in kv_parse_power_table
• CVE-url: https://ubuntu.com/security/CVE-2024-26633
  • ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
• CVE-url: https://ubuntu.com/security/CVE-2023-52340
  • net: add a route cache full diagnostic message
  • net/dst: use a smaller percpu_counter batch for dst entries accounting
  • ipv6: remove max_size check inline with ipv4
• CVE-url: https://ubuntu.com/security/CVE-2023-52436
  • f2fs: explicitly null-terminate the xattr list
• CVE-url: https://ubuntu.com/security/CVE-2023-52470
  • drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
• CVE-url: https://ubuntu.com/security/CVE-2022-45884
  • media: dvbdev: convert DVB device types into an enum
  • media: dvbdev: remove double-unlock
  • media: media/dvb: Use kmemdup rather than duplicating its implementation
  • media: dvbdev: Fix memleak in dvb_register_device
  • media: dvbdev: fix error logic at dvb_register_device()
  • media: dvb-core: Fix use-after-free due to race at dvb_register_device()

• CVE-url: https://ubuntu.com/security/CVE-2024-23307
  • md/raid5: fix atomicity violation in raid5_cache_count
• CVE-url: https://ubuntu.com/security/CVE-2021-46932
  • Input: appletouch - initialize work before device registration
• CVE-url: https://ubuntu.com/security/CVE-2021-46936
  • net: fix use-after-free in tw_timer_handler
• Bionic update: upstream stable patchset 2021-06-01 (LP: #1930472) // CVE- url: https://ubuntu.com/security/CVE-2021-46939
  • tracing: Restructure trace_clock_global() to never block
• CVE-url: https://ubuntu.com/security/CVE-2021-46933
  • usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
• Bionic update: upstream stable patchset 2022-01-27 (LP: #1959335) // CVE- url: https://ubuntu.com/security/CVE-2021-46924
  • NFC: st21nfca: Fix memory leak in device probe and remove
• CVE-url: https://ubuntu.com/security/CVE-2023-52469
  • drivers/amd/pm: fix a use-after-free in kv_parse_power_table
• CVE-url: https://ubuntu.com/security/CVE-2024-26633
  • ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
• CVE-url: https://ubuntu.com/security/CVE-2023-52340
  • net: add a route cache full diagnostic message
  • net/dst: use a smaller percpu_counter batch for dst entries accounting
  • ipv6: remove max_size check inline with ipv4
• CVE-url: https://ubuntu.com/security/CVE-2023-52436
  • f2fs: explicitly null-terminate the xattr list
• CVE-url: https://ubuntu.com/security/CVE-2023-52470
  • drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
• CVE-url: https://ubuntu.com/security/CVE-2022-45884
  • media: dvbdev: convert DVB device types into an enum
  • media: dvbdev: remove double-unlock
  • media: media/dvb: Use kmemdup rather than duplicating its implementation
  • media: dvbdev: Fix memleak in dvb_register_device
  • media: dvbdev: fix error logic at dvb_register_device()
  • media: dvb-core: Fix use-after-free due to race at dvb_register_device()

• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• wifi: mac80211: fix MBSSID parsing use-after-free {CVE-2022-42719}
• mac80211: always allocate struct ieee802_11_elems {CVE-2022-42719}
• netfilter: nf_tables: initialize registers in nft_do_chain() {CVE-2022-1016}
• xprtrdma: fix incorrect header size calculations {CVE-2022-0812}
• net: usb: fix memory leak in smsc75xx_bind {CVE-2021-47171}
• i2c: i801: Don't generate an interrupt on bus reset {CVE-2021-47153}
• pid: take a reference when initializing cad_pid {CVE-2021-47118}
• Input: appletouch - initialize work before device registration {CVE-2021-46932}
• HID: usbhid: fix info leak in hid_submit_ctrl {CVE-2021-46906}
• quota: check block number when reading the block in quota file {CVE-2021-45868}
• mwifiex: Fix skb_over_panic in mwifiex_usb_recv() {CVE-2021-43976}
• atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait {CVE-2021-43975}
• isdn: cpai: check ctr->cnr to avoid array index out of bound {CVE-2021-43389}
• usb: hso: fix error handling code of hso_create_net_device {CVE-2021-37159}
• can: bcm: fix infoleak in struct bcm_msg_head {CVE-2021-34693}
• dm ioctl: fix out of bounds array access when no devices {CVE-2021-31916}
• KVM: x86: hyper-v: Fix Hyper-V context null-ptr-deref {CVE-2021-30178}
• perf/x86/intel: Fix a crash caused by zero PEBS status {CVE-2021-28971}
• btrfs: fix race when cloning extent buffer during rewind of an old root {CVE-2021-28964}
• ovl: fix missing negative dentry check in ovl_rename() {CVE-2021-20321}
• drm/ttm/nouveau: don't call tt destroy callback on alloc failure. {CVE-2021-20292}
• bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() {CVE-2021-4159}
• btrfs: unlock newly allocated extent buffer after error {CVE-2021-4149}
• tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. {CVE-2021-3679}
• net: mac802154: Fix general protection fault {CVE-2021-3659}
• nfsd4: readdirplus shouldn't return parent of export {CVE-2021-3178}
• Bluetooth: SMP: Fail if remote and local public keys are identical {CVE-2021-0129}
• drm/nouveau: clean up all clients on device removal {CVE-2020-27820}
• drm/nouveau: Add a dedicated mutex for the clients list {CVE-2020-27820}
• drm/nouveau: use drm_dev_unplug() during device removal {CVE-2020-27820}
• Bluetooth: SMP: Fail if remote and local public keys are identical {CVE-2020-26555}
• vsock: Fix memory leak in vsock_connect() {CVE-2022-3629}
• RDMA/core: Don't infoleak GRH fields {CVE-2021-3923}
• xen/netfront: force data bouncing when backend is untrusted {CVE-2022-33741}
• net: Rename and export copy_skb_header
• floppy: use a statically allocated error counter {CVE-2022-1652}
• fuse: fix pipe buffer lifetime for direct_io {CVE-2022-1011}
• aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts {CVE-2024-26898}
• smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
• media: pvrusb2: fix use after free on context disconnection {CVE-2023-52445}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• xfs: verify buffer contents when we skip log replay {CVE-2023-2124}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-1989}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• net/sched: cls_tcindex: downgrade to imperfect hash {CVE-2023-1829}
• xen/netfront: fix leaking data in shared pages {CVE-2022-33740}
• can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path {CVE-2022-28390}
• xen/blkfront: fix leaking data in shared pages {CVE-2022-26365}
• mISDN: fix use-after-free bugs in l1oip timer…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-6270: Fixed a use-after-free bug in aoecmd_cfg_pkts (bsc#1218562).
• CVE-2023-52559: Fixed a bug by avoiding memory allocation in iommu_suspend (bsc#1220933).
• CVE-2023-52462: Fixed a security check for attempt to corrupt spilled pointer (bsc#1220325).
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register (bsc#1220433).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2024-26591: Fixed re-attachment branch in bpf_tracing_prog_attach (bsc#1220254).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2024-23850: Fixed double free of anonymous device after snapshot creation failure (bsc#1219126).
• CVE-2023-52452: Fixed Fix accesses to uninit stack slots (bsc#1220257).
• CVE-2023-52457: Fixed skipped resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350).
• CVE-2023-52456: Fixed tx statemachine deadlock (bsc#1220364).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2021-46923: Fixed reference leakage in fs/mount_setattr (bsc#1220457).
• CVE-2024-26598: Fixed potential UAF in LPI translation cache (bsc#1220326).
• CVE-2024-26603: Fixed infinite loop via #PF handling (bsc#1220335).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2023-5197: Fixed se-after-free due to addition and removal of rules from chain bindings within the same transaction (bsc#1218216).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
• CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).

The following non-security bugs were fixed:

• ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events (git-fixes).
• ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A (git-fixes).
• ACPI: extlog: fix NULL pointer dereference check (git-fixes).
• ACPI: resource: Add ASUS model S5402ZA to quirks (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA (git-fixes).
• ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA (git-fixes).
• ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3 (git-fixes).
• ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and iMac12,2 (git-fixes).
• ACPI: video: Add backlight=native DMI quirk for…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item (bsc#1220918).
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2021-47005: Fixed a NULL pointer dereference for ->get_features() (bsc#1220660).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2021-47012: Fixed a use after free in siw_alloc_mr (bsc#1220627).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2021-46989: Fixed a bug by preventing corruption in shrinking truncate in hfsplus (bsc#1220737).
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2024-0340: Fixed information disclosure in vhost/vhost.c:vhost_new_msg() (bsc#1218689).
• CVE-2023-51042: Fixed use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (bsc#1219128).
• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item (bsc#1220918).
• CVE-2023-52482: Fixex a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2021-47083: Fixed a…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2021-46923: Fixed reference leakage in fs/mount_setattr (bsc#1220457).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-5197: Fixed se-after-free due to addition and removal of rules from chain bindings within the same transaction (bsc#1218216).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2023-52452: Fixed Fix accesses to uninit stack slots (bsc#1220257).
• CVE-2023-52456: Fixed tx statemachine deadlock (bsc#1220364).
• CVE-2023-52457: Fixed skipped resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2024-23850: Fixed double free of anonymous device after snapshot creation failure (bsc#1219126).
• CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).
• CVE-2024-25744: Fixed Security issue with int 80 interrupt vector (bsc#1217927).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2024-26591: Fixed re-attachment branch in bpf_tracing_prog_attach (bsc#1220254).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2024-26598: Fixed potential UAF in LPI translation cache (bsc#1220326).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26603: Fixed infinite loop via #PF handling (bsc#1220335).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).

The following non-security bugs were fixed:

• acpi: apei: set memory failure flags as mf_action_required on synchronous events (git-fixes).
• acpi: button: add lid disable dmi quirk for nextbook ares 8a (git-fixes).
• acpi: extlog: fix null pointer dereference check (git-fixes).
• acpi: resource: add asus model s5402za to quirks (git-fixes).
• acpi: resource: skip irq override on asus expertbook b1502cba (git-fixes).
• acpi: resource: skip irq override on asus expertbook b2402cba (git-fixes).
• acpi: video: add backlight=native dmi quirk for apple imac11,3 (git-fixes).
• acpi: video: add…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52559: Fixed a bug by avoiding memory allocation in iommu_suspend (bsc#1220933).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register (bsc#1220433).
• CVE-2024-26591: Fixed re-attachment branch in bpf_tracing_prog_attach (bsc#1220254).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2023-52484: Fixed a soft lockup triggered by arm_smmu_mm_invalidate_range (bsc#1220797).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2024-23850: Fixed double free of anonymous device after snapshot creation failure (bsc#1219126).
• CVE-2023-52452: Fixed Fix accesses to uninit stack slots (bsc#1220257).
• CVE-2023-52457: Fixed skipped resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350).
• CVE-2023-52456: Fixed tx statemachine deadlock (bsc#1220364).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2021-46923: Fixed reference leakage in fs/mount_setattr (bsc#1220457).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2024-26598: Fixed potential UAF in LPI translation cache (bsc#1220326).
• CVE-2024-26603: Fixed infinite loop via #PF handling (bsc#1220335).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2023-5197: Fixed se-after-free due to addition and removal of rules from chain bindings within the same transaction (bsc#1218216).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
• CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).

The following non-security bugs were fixed:

• bpf: Fix verification of indirect var-off stack access (git-fixes).
• bpf: Guard stack limits against 32bit overflow (git-fixes).
• KVM: VMX: Move VERW closer to VMentry for MDS mitigation (git-fixes).
• KVM: VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (git-fixes).
• NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633).
• nvme: move nvme_stop_keep_alive() back to original position (bsc#1211515).
• nvme: remove nvme_alloc_request and nvme_alloc_request_qid (bsc#1214064).
• nvme: start keep-alive after…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52559: Fixed a bug by avoiding memory allocation in iommu_suspend (bsc#1220933).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register (bsc#1220433).
• CVE-2024-26591: Fixed re-attachment branch in bpf_tracing_prog_attach (bsc#1220254).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2023-52484: Fixed a soft lockup triggered by arm_smmu_mm_invalidate_range (bsc#1220797).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2024-23850: Fixed double free of anonymous device after snapshot creation failure (bsc#1219126).
• CVE-2023-52452: Fixed Fix accesses to uninit stack slots (bsc#1220257).
• CVE-2023-52457: Fixed skipped resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350).
• CVE-2023-52456: Fixed tx statemachine deadlock (bsc#1220364).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2021-46923: Fixed reference leakage in fs/mount_setattr (bsc#1220457).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2024-26598: Fixed potential UAF in LPI translation cache (bsc#1220326).
• CVE-2024-26603: Fixed infinite loop via #PF handling (bsc#1220335).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2023-5197: Fixed se-after-free due to addition and removal of rules from chain bindings within the same transaction (bsc#1218216).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
• CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).

The following non-security bugs were fixed:

• bpf: Fix verification of indirect var-off stack access (git-fixes).
• bpf: Guard stack limits against 32bit overflow (git-fixes).
• KVM: VMX: Move VERW closer to VMentry for MDS mitigation (git-fixes).
• KVM: VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (git-fixes).
• NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633).
• nvme: move nvme_stop_keep_alive() back to original position (bsc#1211515).
• nvme: remove nvme_alloc_request and nvme_alloc_request_qid (bsc#1214064).
• nvme: start keep-alive after…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2021-46923: Fixed reference leakage in fs/mount_setattr (bsc#1220457).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-5197: Fixed se-after-free due to addition and removal of rules from chain bindings within the same transaction (bsc#1218216).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2023-52452: Fixed Fix accesses to uninit stack slots (bsc#1220257).
• CVE-2023-52456: Fixed tx statemachine deadlock (bsc#1220364).
• CVE-2023-52457: Fixed skipped resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2024-23850: Fixed double free of anonymous device after snapshot creation failure (bsc#1219126).
• CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).
• CVE-2024-25744: Fixed Security issue with int 80 interrupt vector (bsc#1217927).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2024-26591: Fixed re-attachment branch in bpf_tracing_prog_attach (bsc#1220254).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2024-26598: Fixed potential UAF in LPI translation cache (bsc#1220326).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26603: Fixed infinite loop via #PF handling (bsc#1220335).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).

The following non-security bugs were fixed:

• acpi: apei: set memory failure flags as mf_action_required on synchronous events (git-fixes).
• acpi: button: add lid disable dmi quirk for nextbook ares 8a (git-fixes).
• acpi: extlog: fix null pointer dereference check (git-fixes).
• acpi: resource: add asus model s5402za to quirks (git-fixes).
• acpi: resource: skip irq override on asus expertbook b1502cba (git-fixes).
• acpi: resource: skip irq override on asus expertbook b2402cba (git-fixes).
• acpi: video: add backlight=native dmi quirk for apple imac11,3 (git-fixes).
• acpi: video: add…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2021-47077: Fixed a NULL pointer dereference when in shost_data (bsc#1220861).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get and nfc_llcp_sock_get_sn (bsc#1220831).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval (bsc#1218915).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control (bsc#1220825).
• CVE-2021-46921: Fixed ordering in queued_write_lock_slowpath (bsc#1220468).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46953: Fixed a corruption in interrupt mappings on watchdow probe failure (bsc#1220599).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2021-47054: Fixed a bug to put child node before return (bsc#1220767).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46906: Fixed an info leak in hid_submit_ctrl (bsc#1220421).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2020-36777: Fixed a memory leak in dvb_media_device_free (bsc#1220526).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge (CVE-2023-46343).
• CVE-2021-46992: Fixed a bug to avoid overflows in nft_hash_buckets (bsc#1220638).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2021-46991: Fixed a use-after-free in i40e_client_subtask (bsc#1220575).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2024-26600: Fixed NULL pointer dereference for SRP in phy-omap-usb2 (bsc#1220340).

The following non-security bugs were fixed:

• ASN.1: Fix check for strdup() success (git-fixes).
• audit: fix possible soft lockup in __audit_inode_child() (git-fixes).
• Bluetooth: hci_bcsp: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).
• Bluetooth: hci_h5: do…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item (bsc#1220918).
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2021-47005: Fixed a NULL pointer dereference for ->get_features() (bsc#1220660).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2021-47012: Fixed a use after free in siw_alloc_mr (bsc#1220627).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2021-46989: Fixed a bug by preventing corruption in shrinking truncate in hfsplus (bsc#1220737).
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595:…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26600: Fixed NULL pointer dereference for SRP (bsc#1220340).
• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2021-47077: Fixed a NULL pointer dereference when in shost_data (bsc#1220861).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2021-33200: Fixed a leakage of uninitialized bpf stack under speculation. (bsc#1186484)
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2021-46921: Fixed ordering in queued_write_lock_slowpath (bsc#1220468).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46953: Fixed a corruption in interrupt mappings on watchdow probe failure (bsc#1220599).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2021-47054: Fixed a bug to put child node before return (bsc#1220767).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46906: Fixed an info leak in hid_submit_ctrl (bsc#1220421).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2020-36777: Fixed a memory leak in dvb_media_device_free (bsc#1220526).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2021-46992: Fixed a bug to avoid overflows in nft_hash_buckets (bsc#1220638).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2021-46991: Fixed a use-after-free in i40e_client_subtask (bsc#1220575).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).

The following non-security bugs were fixed:

• ASN.1: Fix check for strdup() success (git-fixes).
• audit: fix possible soft lockup in __audit_inode_child() (git-fixes).
• Bluetooth:…

The SUSE Linux Enterprise SLE12SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36777: Fixed a memory leak in dvb_media_device_free() (bsc#1220526).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2021-46906: Fixed an info leak in hid_submit_ctrl (bsc#1220421).
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46921: Fixed ordering in queued_write_lock_slowpath (bsc#1220468).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2021-46953: Fixed a corruption in interrupt mappings on watchdow probe failure (bsc#1220599).
• CVE-2021-46991: Fixed a use-after-free in i40e_client_subtask (bsc#1220575).
• CVE-2021-46992: Fixed a bug to avoid overflows in nft_hash_buckets (bsc#1220638).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2021-47054: Fixed a bug to put child node before return (bsc#1220767).
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2021-47077: Fixed a NULL pointer dereference when in shost_data (bsc#1220861).
• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2024-26600: Fixed NULL pointer dereference for SRP in phy-omap-usb2 (bsc#1220340).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).

The following non-security bugs were fixed:

• [media] coda:…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2021-46923: Fixed reference leakage in fs/mount_setattr (bsc#1220457).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-5197: Fixed se-after-free due to addition and removal of rules from chain bindings within the same transaction (bsc#1218216).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2023-52452: Fixed Fix accesses to uninit stack slots (bsc#1220257).
• CVE-2023-52456: Fixed tx statemachine deadlock (bsc#1220364).
• CVE-2023-52457: Fixed skipped resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register (bsc#1220433).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52484: Fixed a soft lockup triggered by arm_smmu_mm_invalidate_range (bsc#1220797).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2023-52559: Fixed a bug by avoiding memory allocation in iommu_suspend (bsc#1220933).
• CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2024-23850: Fixed double free of anonymous device after snapshot creation failure (bsc#1219126).
• CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2024-26591: Fixed re-attachment branch in bpf_tracing_prog_attach (bsc#1220254).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2024-26598: Fixed potential UAF in LPI translation cache (bsc#1220326).
• CVE-2024-26602: Fixed overall slowdowns with…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).
• CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).
• CVE-2022-48619: Fixed a denial-of-service issue in drivers/input/input.c (bsc#1218220).
• CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).
• CVE-2023-52340: Fixed a denial of service related to ICMPv6 'Packet Too Big' packets (bsc#1219295).
• CVE-2021-46932: Initialized work before appletouch device registration (bsc#1220444).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed a use-after-free in powermate_config_complete() (bsc#1220649).
• CVE-2023-52445: Fixed a use-after-free on context disconnection in pvrusb2 (bsc#1220241).
• CVE-2023-52429: Limited the number of targets and parameter size area for device mapper (bsc#1219146).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl() related to a vcc_recvmsg race condition (bsc#1218730).
• CVE-2023-51782: Fixed a use-after-free in rose_ioctl() related to a rose_accept race condition (bsc#1218757).
• CVE-2023-31083: Fixed a NULL pointer dereference in hci_uart_tty_ioctl() (bsc#1210780).

The following non-security bugs were fixed:

• KVM: VMX: Move VERW closer to VMentry for MDS mitigation (git-fixes).
• KVM: VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (git-fixes).
• tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (bsc#1222619).
• x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix (git-fixes).
• x86/bugs: Add asm helpers for executing VERW (bsc#1213456).
• x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key (git-fixes).
• x86/entry_32: Add VERW just before userspace transition (git-fixes).
• x86/entry_64: Add VERW just before userspace transition (git-fixes).

It was discovered that the device input subsystem in the Linux kernel did not properly handle the case when an event code falls outside of a bitmap. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-48619)

黄思聪 discovered that the NFC Controller Interface (NCI) implementation in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-46343)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• GPU drivers;
• HID subsystem;
• I2C subsystem;
• Input Device Drivers (Mouse);
• MTD block device drivers;
• Network drivers;
• TTY drivers;
• USB subsystem;
• File systems infrastructure;
• F2FS file system;
• SMB network file system;
• BPF subsystem;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• IPv4 networking;
• IPv6 networking;
• Netfilter;
• Unix domain sockets;
• Wireless networking; (CVE-2024-26901, CVE-2021-46932, CVE-2024-26857, CVE-2024-26882, CVE-2024-26934, CVE-2023-52449, CVE-2024-35982, CVE-2021-46933, CVE-2023-52620, CVE-2023-52444, CVE-2024-26923, CVE-2023-52469, CVE-2024-26886, CVE-2024-36902, CVE-2023-52436, CVE-2024-36016, CVE-2024-26884, CVE-2021-46960, CVE-2021-47194, CVE-2023-52752, CVE-2024-27020, CVE-2024-26840, CVE-2024-35997, CVE-2024-35984, CVE-2024-35978)