CVE-2021-46934

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

media: dvbdev: Fix memory leak in dvb_media_device_free()

dvb_media_device_free() is leaking memory. Free dvbdev->adapter->conn before setting it to NULL, as documented in include/media/media-device.h: "The media_entity instance itself must be freed explicitly by the driver if required."(CVE-2020-36777)

In the Linux kernel, the following vulnerability has been resolved:

i2c: sprd: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in sprd_i2c_master_xfer() and sprd_i2c_remove().

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36780)

In the Linux kernel, the following vulnerability has been resolved:

i2c: cadence: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in functions cdns_i2c_master_xfer and cdns_reg_slave.

However, pm_runtime_get_sync will increment pm usage counter even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36784)

In the Linux kernel, the following vulnerability has been resolved:

net: hso: fix null-ptr-deref during tty device unregistration

Multiple ttys try to claim the same the minor number causing a double unregistration of the same device. The first unregistration succeeds but the next one results in a null-ptr-deref.

The get_free_serial_index() function returns an available minor number but doesn't assign it immediately. The assignment is done by the caller later. But before this assignment, calls to get_free_serial_index() would return the same minor number.

Fix this by modifying get_free_serial_index to assign the minor number immediately after one is found to be and rename it to obtain_minor() to better reflect what it does. Similary, rename set_serial_by_index() to release_minor() and modify it to free up the minor number of the given hso_serial. Every obtain_minor() should have corresponding release_minor() call.(CVE-2021-46904)

In the Linux kernel, the following vulnerability has been resolved:

NFC: st21nfca: Fix memory leak in device probe and remove

'phy->pending_skb' is alloced when device probe, but forgot to free in the error handling path and remove path, this cause memory leak as follows:

unreferenced object 0xffff88800bc06800 (size 512): comm "8", pid 11775, jiffies 4295159829 (age 9.032s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000d66c09ce>] __kmalloc_node_track_caller+0x1ed/0x450 [<00000000c93382b3>] kmalloc_reserve+0x37/0xd0 [<000000005fea522c>] __alloc_skb+0x124/0x380 [<0000000019f29f9a>] st21nfca_hci_i2c_probe+0x170/0x8f2

Fix it by freeing 'pending_skb' in error and remove.(CVE-2021-46924)

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: intel-sdw-acpi: harden detection of controller

The existing code currently sets a pointer to an ACPI handle before checking that it's actually a SoundWire controller. This can lead to issues where the graph walk continues and eventually fails, but the pointer was set already.

This patch changes the logic so that the information provided to the caller is set when a controller is found.(CVE-2021-46926)

In the Linux kernel, the following vulnerability has been resolved:

parisc: Clear stale IIR value on instruction access rights…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

media: dvbdev: Fix memory leak in dvb_media_device_free()

dvb_media_device_free() is leaking memory. Free dvbdev->adapter->conn before setting it to NULL, as documented in include/media/media-device.h: "The media_entity instance itself must be freed explicitly by the driver if required."(CVE-2020-36777)

In the Linux kernel, the following vulnerability has been resolved:

i2c: sprd: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in sprd_i2c_master_xfer() and sprd_i2c_remove().

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36780)

In the Linux kernel, the following vulnerability has been resolved:

i2c: cadence: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in functions cdns_i2c_master_xfer and cdns_reg_slave.

However, pm_runtime_get_sync will increment pm usage counter even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36784)

In the Linux kernel, the following vulnerability has been resolved:

net: hso: fix null-ptr-deref during tty device unregistration

Multiple ttys try to claim the same the minor number causing a double unregistration of the same device. The first unregistration succeeds but the next one results in a null-ptr-deref.

The get_free_serial_index() function returns an available minor number but doesn't assign it immediately. The assignment is done by the caller later. But before this assignment, calls to get_free_serial_index() would return the same minor number.

Fix this by modifying get_free_serial_index to assign the minor number immediately after one is found to be and rename it to obtain_minor() to better reflect what it does. Similary, rename set_serial_by_index() to release_minor() and modify it to free up the minor number of the given hso_serial. Every obtain_minor() should have corresponding release_minor() call.(CVE-2021-46904)

In the Linux kernel, the following vulnerability has been resolved:

NFC: st21nfca: Fix memory leak in device probe and remove

'phy->pending_skb' is alloced when device probe, but forgot to free in the error handling path and remove path, this cause memory leak as follows:

unreferenced object 0xffff88800bc06800 (size 512): comm "8", pid 11775, jiffies 4295159829 (age 9.032s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000d66c09ce>] __kmalloc_node_track_caller+0x1ed/0x450 [<00000000c93382b3>] kmalloc_reserve+0x37/0xd0 [<000000005fea522c>] __alloc_skb+0x124/0x380 [<0000000019f29f9a>] st21nfca_hci_i2c_probe+0x170/0x8f2

Fix it by freeing 'pending_skb' in error and remove.(CVE-2021-46924)

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: intel-sdw-acpi: harden detection of controller

The existing code currently sets a pointer to an ACPI handle before checking that it's actually a SoundWire controller. This can lead to issues where the graph walk continues and eventually fails, but the pointer was set already.

This patch changes the logic so that the information provided to the caller is set when a controller is found.(CVE-2021-46926)

In the Linux kernel, the following vulnerability has been resolved:

parisc: Clear stale IIR value on instruction access rights…

In the Linux kernel, the following vulnerability has been resolved: i2c: validate user data in compat ioctl Wrong user data may cause warning in i2c_transfer(), ex: zero msgs. Userspace should not be able to trigger warnings, so this patch adds validation checks for user data in compact ioctl to prevent reported warnings

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240)
• kernel: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2024-0340)
• kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)
• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)
• kernel: pvrusb2: fix use after free on context disconnection (CVE-2023-52445)
• kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer that cause loop forever (CVE-2024-26603)
• kernel: use after free in i2c (CVE-2019-25162)
• kernel: i2c: validate user data in compat ioctl (CVE-2021-46934)
• kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() (CVE-2020-36777)
• kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors (CVE-2023-52477)
• kernel: mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)
• kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615)
• kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627)
• kernel: Integer Overflow in raid5_cache_count (CVE-2024-23307)
• kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() (CVE-2023-52565)
• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)
• kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (CVE-2023-52528)
• kernel: platform/x86: think-lmi: Fix reference leak (CVE-2023-52520)
• kernel: RDMA/siw: Fix connection failure handling (CVE-2023-52513)
• kernel: pid: take a reference when initializing cad_pid (CVE-2021-47118)
• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)
• kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643)
• kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642)
• kernel: i2c: i801: Don't generate an interrupt on bus reset (CVE-2021-47153)
• kernel: xhci: handle isoc Babble and Buffer Overrun events properly (CVE-2024-26659)
• kernel: hwmon: (coretemp) Fix out-of-bounds memory access (CVE-2024-26664)
• kernel: wifi: mac80211: fix race condition on enabling fast-xmit (CVE-2024-26779)
• kernel: RDMA/srpt: Support specifying the srpt_service_guid parameter (CVE-2024-26744)
• kernel: RDMA/qedr: Fix qedr_create_user_qp error flow (CVE-2024-26743)
• kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (CVE-2021-47185)
• kernel: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (CVE-2024-26901)
• kernel: RDMA/srpt: Do not register event handler until srpt device is fully setup (CVE-2024-26872)
• kernel: usb: ulpi: Fix debugfs directory leak (CVE-2024-26919)
• kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma (CVE-2024-26964)
• kernel: USB: core: Fix deadlock in usb_deauthorize_interface() (CVE-2024-26934)
• kernel: USB: core: Fix deadlock in port "disable" sysfs attribute (CVE-2024-26933)
• kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993)
• kernel: fat: fix uninitialized field in nostale filehandles (CVE-2024-26973)
• kernel: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (CVE-2024-27059)
• kernel: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (CVE-2021-47013)
• kernel: net: usb: fix memory leak in smsc75xx_bind (CVE-2021-47171)
• kernel: powerpc/pseries: Fix potential memleak in papr_get_attr() (CVE-2022-48669)
• kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439)
• kernel: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (CVE-2023-52594)
• kernel: wifi: rt2x00: restart beacon queue when hardware reset (CVE-2023-52595)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240)
• kernel: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2024-0340)
• kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)
• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)
• kernel: pvrusb2: fix use after free on context disconnection (CVE-2023-52445)
• kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer that cause loop forever (CVE-2024-26603)
• kernel: use after free in i2c (CVE-2019-25162)
• kernel: i2c: validate user data in compat ioctl (CVE-2021-46934)
• kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() (CVE-2020-36777)
• kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors (CVE-2023-52477)
• kernel: mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)
• kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615)
• kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627)
• kernel: Integer Overflow in raid5_cache_count (CVE-2024-23307)
• kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() (CVE-2023-52565)
• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)
• kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (CVE-2023-52528)
• kernel: platform/x86: think-lmi: Fix reference leak (CVE-2023-52520)
• kernel: RDMA/siw: Fix connection failure handling (CVE-2023-52513)
• kernel: pid: take a reference when initializing cad_pid (CVE-2021-47118)
• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)
• kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643)
• kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642)
• kernel: i2c: i801: Don't generate an interrupt on bus reset (CVE-2021-47153)
• kernel: xhci: handle isoc Babble and Buffer Overrun events properly (CVE-2024-26659)
• kernel: hwmon: (coretemp) Fix out-of-bounds memory access (CVE-2024-26664)
• kernel: wifi: mac80211: fix race condition on enabling fast-xmit (CVE-2024-26779)
• kernel: RDMA/srpt: Support specifying the srpt_service_guid parameter (CVE-2024-26744)
• kernel: RDMA/qedr: Fix qedr_create_user_qp error flow (CVE-2024-26743)
• kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (CVE-2021-47185)
• kernel: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (CVE-2024-26901)
• kernel: RDMA/srpt: Do not register event handler until srpt device is fully setup (CVE-2024-26872)
• kernel: usb: ulpi: Fix debugfs directory leak (CVE-2024-26919)
• kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma (CVE-2024-26964)
• kernel: USB: core: Fix deadlock in usb_deauthorize_interface() (CVE-2024-26934)
• kernel: USB: core: Fix deadlock in port "disable" sysfs attribute (CVE-2024-26933)
• kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993)
• kernel: fat: fix uninitialized field in nostale filehandles (CVE-2024-26973)
• kernel: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (CVE-2024-27059)

Bug Fix(es):

• kernel-rt: update RT source tree to the latest AlmaLinux-8.10.z kernel (JIRA:AlmaLinux-34640)
• kernel-rt: epoll_wait not reporting catching all events to application (JIRA:AlmaLinux-23022)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240)

• kernel: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2024-0340)

• kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)

• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)

• kernel: pvrusb2: fix use after free on context disconnection (CVE-2023-52445)

• kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer that cause loop forever (CVE-2024-26603)

• kernel: use after free in i2c (CVE-2019-25162)

• kernel: i2c: validate user data in compat ioctl (CVE-2021-46934)

• kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() (CVE-2020-36777)

• kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors (CVE-2023-52477)

• kernel: mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)

• kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615)

• kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627)

• kernel: Integer Overflow in raid5_cache_count (CVE-2024-23307)

• kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() (CVE-2023-52565)

• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)

• kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (CVE-2023-52528)

• kernel: platform/x86: think-lmi: Fix reference leak (CVE-2023-52520)

• kernel: RDMA/siw: Fix connection failure handling (CVE-2023-52513)

• kernel: pid: take a reference when initializing cad_pid (CVE-2021-47118)

• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)

• kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643)

• kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642)

• kernel: i2c: i801: Don't generate an interrupt on bus reset (CVE-2021-47153)

• kernel: xhci: handle isoc Babble and Buffer Overrun events properly (CVE-2024-26659)

• kernel: hwmon: (coretemp) Fix out-of-bounds memory access (CVE-2024-26664)

• kernel: wifi: mac80211: fix race condition on enabling fast-xmit (CVE-2024-26779)

• kernel: RDMA/srpt: Support specifying the srpt_service_guid parameter (CVE-2024-26744)

• kernel: RDMA/qedr: Fix qedr_create_user_qp error flow (CVE-2024-26743)

• kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (CVE-2021-47185)

• kernel: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (CVE-2024-26901)

• kernel: RDMA/srpt: Do not register event handler until srpt device is fully setup (CVE-2024-26872)

• kernel: usb: ulpi: Fix debugfs directory leak (CVE-2024-26919)

• kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma (CVE-2024-26964)

• kernel: USB: core: Fix deadlock in usb_deauthorize_interface() (CVE-2024-26934)

• kernel: USB: core: Fix deadlock in port "disable" sysfs attribute (CVE-2024-26933)

• kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993)

• kernel: fat: fix uninitialized field in nostale filehandles (CVE-2024-26973)

• kernel: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (CVE-2024-27059)

• kernel: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (CVE-2021-47013)

• kernel: net: usb: fix memory leak in smsc75xx_bind (CVE-2021-47171)

• kernel: powerpc/pseries: Fix potential memleak in papr_get_attr() (CVE-2022-48669)

• kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439)

• kernel: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (CVE-2023-52594)

• kernel: wifi: rt2x00: restart beacon queue when hardware reset (CVE-2023-52595)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240)

• kernel: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2024-0340)

• kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)

• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)

• kernel: pvrusb2: fix use after free on context disconnection (CVE-2023-52445)

• kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer that cause loop forever (CVE-2024-26603)

• kernel: use after free in i2c (CVE-2019-25162)

• kernel: i2c: validate user data in compat ioctl (CVE-2021-46934)

• kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() (CVE-2020-36777)

• kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors (CVE-2023-52477)

• kernel: mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)

• kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615)

• kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627)

• kernel: Integer Overflow in raid5_cache_count (CVE-2024-23307)

• kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() (CVE-2023-52565)

• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)

• kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (CVE-2023-52528)

• kernel: platform/x86: think-lmi: Fix reference leak (CVE-2023-52520)

• kernel: RDMA/siw: Fix connection failure handling (CVE-2023-52513)

• kernel: pid: take a reference when initializing cad_pid (CVE-2021-47118)

• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)

• kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643)

• kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642)

• kernel: i2c: i801: Don't generate an interrupt on bus reset (CVE-2021-47153)

• kernel: xhci: handle isoc Babble and Buffer Overrun events properly (CVE-2024-26659)

• kernel: hwmon: (coretemp) Fix out-of-bounds memory access (CVE-2024-26664)

• kernel: wifi: mac80211: fix race condition on enabling fast-xmit (CVE-2024-26779)

• kernel: RDMA/srpt: Support specifying the srpt_service_guid parameter (CVE-2024-26744)

• kernel: RDMA/qedr: Fix qedr_create_user_qp error flow (CVE-2024-26743)

• kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (CVE-2021-47185)

• kernel: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (CVE-2024-26901)

• kernel: RDMA/srpt: Do not register event handler until srpt device is fully setup (CVE-2024-26872)

• kernel: usb: ulpi: Fix debugfs directory leak (CVE-2024-26919)

• kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma (CVE-2024-26964)

• kernel: USB: core: Fix deadlock in usb_deauthorize_interface() (CVE-2024-26934)

• kernel: USB: core: Fix deadlock in port "disable" sysfs attribute (CVE-2024-26933)

• kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993)

• kernel: fat: fix uninitialized field in nostale filehandles (CVE-2024-26973)

• kernel: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (CVE-2024-27059)

Bug Fix(es):

• kernel-rt: update RT source tree to the latest Rocky Linux-8.10.z kernel (JIRA:Rocky Linux-34640)

• kernel-rt: epoll_wait not reporting catching all events to application (JIRA:Rocky Linux-23022)

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-6270: Fixed a use-after-free bug in aoecmd_cfg_pkts (bsc#1218562).
• CVE-2023-52559: Fixed a bug by avoiding memory allocation in iommu_suspend (bsc#1220933).
• CVE-2023-52462: Fixed a security check for attempt to corrupt spilled pointer (bsc#1220325).
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register (bsc#1220433).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2024-26591: Fixed re-attachment branch in bpf_tracing_prog_attach (bsc#1220254).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2024-23850: Fixed double free of anonymous device after snapshot creation failure (bsc#1219126).
• CVE-2023-52452: Fixed Fix accesses to uninit stack slots (bsc#1220257).
• CVE-2023-52457: Fixed skipped resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350).
• CVE-2023-52456: Fixed tx statemachine deadlock (bsc#1220364).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2021-46923: Fixed reference leakage in fs/mount_setattr (bsc#1220457).
• CVE-2024-26598: Fixed potential UAF in LPI translation cache (bsc#1220326).
• CVE-2024-26603: Fixed infinite loop via #PF handling (bsc#1220335).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2023-5197: Fixed se-after-free due to addition and removal of rules from chain bindings within the same transaction (bsc#1218216).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
• CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).

The following non-security bugs were fixed:

• ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events (git-fixes).
• ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A (git-fixes).
• ACPI: extlog: fix NULL pointer dereference check (git-fixes).
• ACPI: resource: Add ASUS model S5402ZA to quirks (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA (git-fixes).
• ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA (git-fixes).
• ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3 (git-fixes).
• ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and iMac12,2 (git-fixes).
• ACPI: video: Add backlight=native DMI quirk for…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item (bsc#1220918).
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2021-47005: Fixed a NULL pointer dereference for ->get_features() (bsc#1220660).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2021-47012: Fixed a use after free in siw_alloc_mr (bsc#1220627).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2021-46989: Fixed a bug by preventing corruption in shrinking truncate in hfsplus (bsc#1220737).
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2024-0340: Fixed information disclosure in vhost/vhost.c:vhost_new_msg() (bsc#1218689).
• CVE-2023-51042: Fixed use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (bsc#1219128).
• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item (bsc#1220918).
• CVE-2023-52482: Fixex a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2021-47083: Fixed a…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52559: Fixed a bug by avoiding memory allocation in iommu_suspend (bsc#1220933).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register (bsc#1220433).
• CVE-2024-26591: Fixed re-attachment branch in bpf_tracing_prog_attach (bsc#1220254).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2023-52484: Fixed a soft lockup triggered by arm_smmu_mm_invalidate_range (bsc#1220797).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2024-23850: Fixed double free of anonymous device after snapshot creation failure (bsc#1219126).
• CVE-2023-52452: Fixed Fix accesses to uninit stack slots (bsc#1220257).
• CVE-2023-52457: Fixed skipped resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350).
• CVE-2023-52456: Fixed tx statemachine deadlock (bsc#1220364).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2021-46923: Fixed reference leakage in fs/mount_setattr (bsc#1220457).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2024-26598: Fixed potential UAF in LPI translation cache (bsc#1220326).
• CVE-2024-26603: Fixed infinite loop via #PF handling (bsc#1220335).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2023-5197: Fixed se-after-free due to addition and removal of rules from chain bindings within the same transaction (bsc#1218216).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
• CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).

The following non-security bugs were fixed:

• bpf: Fix verification of indirect var-off stack access (git-fixes).
• bpf: Guard stack limits against 32bit overflow (git-fixes).
• KVM: VMX: Move VERW closer to VMentry for MDS mitigation (git-fixes).
• KVM: VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (git-fixes).
• NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633).
• nvme: move nvme_stop_keep_alive() back to original position (bsc#1211515).
• nvme: remove nvme_alloc_request and nvme_alloc_request_qid (bsc#1214064).
• nvme: start keep-alive after…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52559: Fixed a bug by avoiding memory allocation in iommu_suspend (bsc#1220933).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register (bsc#1220433).
• CVE-2024-26591: Fixed re-attachment branch in bpf_tracing_prog_attach (bsc#1220254).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2023-52484: Fixed a soft lockup triggered by arm_smmu_mm_invalidate_range (bsc#1220797).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2024-23850: Fixed double free of anonymous device after snapshot creation failure (bsc#1219126).
• CVE-2023-52452: Fixed Fix accesses to uninit stack slots (bsc#1220257).
• CVE-2023-52457: Fixed skipped resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350).
• CVE-2023-52456: Fixed tx statemachine deadlock (bsc#1220364).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2021-46923: Fixed reference leakage in fs/mount_setattr (bsc#1220457).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2024-26598: Fixed potential UAF in LPI translation cache (bsc#1220326).
• CVE-2024-26603: Fixed infinite loop via #PF handling (bsc#1220335).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2023-5197: Fixed se-after-free due to addition and removal of rules from chain bindings within the same transaction (bsc#1218216).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
• CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).

The following non-security bugs were fixed:

• bpf: Fix verification of indirect var-off stack access (git-fixes).
• bpf: Guard stack limits against 32bit overflow (git-fixes).
• KVM: VMX: Move VERW closer to VMentry for MDS mitigation (git-fixes).
• KVM: VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (git-fixes).
• NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633).
• nvme: move nvme_stop_keep_alive() back to original position (bsc#1211515).
• nvme: remove nvme_alloc_request and nvme_alloc_request_qid (bsc#1214064).
• nvme: start keep-alive after…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item (bsc#1220918).
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2021-47005: Fixed a NULL pointer dereference for ->get_features() (bsc#1220660).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2021-47012: Fixed a use after free in siw_alloc_mr (bsc#1220627).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2021-46989: Fixed a bug by preventing corruption in shrinking truncate in hfsplus (bsc#1220737).
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595:…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2021-46923: Fixed reference leakage in fs/mount_setattr (bsc#1220457).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-5197: Fixed se-after-free due to addition and removal of rules from chain bindings within the same transaction (bsc#1218216).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2023-52452: Fixed Fix accesses to uninit stack slots (bsc#1220257).
• CVE-2023-52456: Fixed tx statemachine deadlock (bsc#1220364).
• CVE-2023-52457: Fixed skipped resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register (bsc#1220433).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52484: Fixed a soft lockup triggered by arm_smmu_mm_invalidate_range (bsc#1220797).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2023-52559: Fixed a bug by avoiding memory allocation in iommu_suspend (bsc#1220933).
• CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2024-23850: Fixed double free of anonymous device after snapshot creation failure (bsc#1219126).
• CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2024-26591: Fixed re-attachment branch in bpf_tracing_prog_attach (bsc#1220254).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2024-26598: Fixed potential UAF in LPI translation cache (bsc#1220326).
• CVE-2024-26602: Fixed overall slowdowns with…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

NOTE: This update has been retracted due to a bug in the BHI CPU sidechannel mitigation, which led to incorrect selection of other CPU mitigations.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2022-48628: Fixed possible lock in ceph (bsc#1220848).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52462: Fixed check for attempt to corrupt spilled pointer…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2022-48628: Fixed possible lock in ceph (bsc#1220848).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52462: Fixed check for attempt to corrupt spilled pointer (bsc#1220325).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register…