CVE-2021-46955

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

i2c: xiic: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in xiic_xfer and xiic_i2c_remove.

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36778)

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in lpi2c_imx_master_enable.

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36782)

In the Linux kernel, the following vulnerability has been resolved:

HID: usbhid: fix info leak in hid_submit_ctrl

In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes.

To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl().(CVE-2021-46906)

In the Linux kernel, the following vulnerability has been resolved:

ARM: footbridge: fix PCI interrupt mapping

Since commit 30fdfb929e82 ("PCI: Add a call to pci_assign_irq() in pci_device_probe()"), the PCI code will call the IRQ mapping function whenever a PCI driver is probed. If these are marked as __init, this causes an oops if a PCI driver is loaded or bound after the kernel has initialised.(CVE-2021-46909)

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: core: Do core softreset when switch mode

According to the programming guide, to switch mode for DRD controller, the driver needs to do the following.

To switch from device to host:

1. Reset controller with GCTL.CoreSoftReset
2. Set GCTL.PrtCapDir(host mode)
3. Reset the host with USBCMD.HCRESET
4. Then follow up with the initializing host registers sequence

To switch from host to device:

1. Reset controller with GCTL.CoreSoftReset
2. Set GCTL.PrtCapDir(device mode)
3. Reset the device with DCTL.CSftRst
4. Then follow up with the initializing registers sequence

Currently we're missing step 1) to do GCTL.CoreSoftReset and step 3) of switching from host to device. John Stult reported a lockup issue seen with HiKey960 platform without these steps[1]. Similar issue is observed with Ferry's testing platform[2].

So, apply the required steps along with some fixes to Yu Chen's and John Stultz's version. The main fixes to their versions are the missing wait for clocks synchronization before clearing GCTL.CoreSoftReset and only apply DCTL.CSftRst when switching from host to device.

[1] https://lore.kernel.org/linux-usb/[email protected]/ [2] https://lore.kernel.org/linux-usb/[email protected]/(CVE-2021-46941)

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: fix stack OOB read while fragmenting IPv4 packets

running openvswitch on kernels built with KASAN, it's possible to see the following splat while testing fragmentation of IPv4 packets:

BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888112fc713c by task handler2/1367

CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

i2c: xiic: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in xiic_xfer and xiic_i2c_remove.

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36778)

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in lpi2c_imx_master_enable.

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36782)

In the Linux kernel, the following vulnerability has been resolved:

HID: usbhid: fix info leak in hid_submit_ctrl

In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes.

To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl().(CVE-2021-46906)

In the Linux kernel, the following vulnerability has been resolved:

ARM: footbridge: fix PCI interrupt mapping

Since commit 30fdfb929e82 ("PCI: Add a call to pci_assign_irq() in pci_device_probe()"), the PCI code will call the IRQ mapping function whenever a PCI driver is probed. If these are marked as __init, this causes an oops if a PCI driver is loaded or bound after the kernel has initialised.(CVE-2021-46909)

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: core: Do core softreset when switch mode

According to the programming guide, to switch mode for DRD controller, the driver needs to do the following.

To switch from device to host:

1. Reset controller with GCTL.CoreSoftReset
2. Set GCTL.PrtCapDir(host mode)
3. Reset the host with USBCMD.HCRESET
4. Then follow up with the initializing host registers sequence

To switch from host to device:

1. Reset controller with GCTL.CoreSoftReset
2. Set GCTL.PrtCapDir(device mode)
3. Reset the device with DCTL.CSftRst
4. Then follow up with the initializing registers sequence

Currently we're missing step 1) to do GCTL.CoreSoftReset and step 3) of switching from host to device. John Stult reported a lockup issue seen with HiKey960 platform without these steps[1]. Similar issue is observed with Ferry's testing platform[2].

So, apply the required steps along with some fixes to Yu Chen's and John Stultz's version. The main fixes to their versions are the missing wait for clocks synchronization before clearing GCTL.CoreSoftReset and only apply DCTL.CSftRst when switching from host to device.

[1] https://lore.kernel.org/linux-usb/[email protected]/ [2] https://lore.kernel.org/linux-usb/[email protected]/(CVE-2021-46941)

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: fix stack OOB read while fragmenting IPv4 packets

running openvswitch on kernels built with KASAN, it's possible to see the following splat while testing fragmentation of IPv4 packets:

BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888112fc713c by task handler2/1367

CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+…

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix stack OOB read while fragmenting IPv4 packets running openvswitch on kernels built with KASAN, it's possible to see the following splat while testing fragmentation of IPv4 packets: BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888112fc713c by task handler2/1367 CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+ #418 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 Call Trace: dump_stack+0x92/0xc1 print_address_description.constprop.7+0x1a/0x150 kasan_report.cold.13+0x7f/0x111 ip_do_fragment+0x1b03/0x1f60 ovs_fragment+0x5bf/0x840 [openvswitch] do_execute_actions+0x1bd5/0x2400 [openvswitch] ovs_execute_actions+0xc8/0x3d0 [openvswitch] ovs_packet_cmd_execute+0xa39/0x1150 [openvswitch] genl_family_rcv_msg_doit.isra.15+0x227/0x2d0 genl_rcv_msg+0x287/0x490 netlink_rcv_skb+0x120/0x380 genl_rcv+0x24/0x40 netlink_unicast+0x439/0x630 netlink_sendmsg+0x719/0xbf0 sock_sendmsg+0xe2/0x110 ____sys_sendmsg+0x5ba/0x890 ___sys_sendmsg+0xe9/0x160 __sys_sendmsg+0xd3/0x170 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f957079db07 Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 eb ec ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 24 ed ff ff 48 RSP: 002b:00007f956ce35a50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007f957079db07 RDX: 0000000000000000 RSI: 00007f956ce35ae0 RDI: 0000000000000019 RBP: 00007f956ce35ae0 R08: 0000000000000000 R09: 00007f9558006730 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00007f956ce37308 R14: 00007f956ce35f80 R15: 00007f956ce35ae0 The buggy address belongs to the page: page:00000000af2a1d93 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112fc7 flags: 0x17ffffc0000000() raw: 0017ffffc0000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected addr ffff888112fc713c is located in stack of task handler2/1367 at offset 180 in frame: ovs_fragment+0x0/0x840 [openvswitch] this frame has 2 objects: [32, 144) 'ovs_dst' [192, 424) 'ovs_rt' Memory state around the buggy address: ffff888112fc7000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888112fc7080: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 >ffff888112fc7100: 00 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 ^ ffff888112fc7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888112fc7200: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00 for IPv4 packets, ovs_fragment() uses a temporary struct dst_entry. Then, in the following call graph: ip_do_fragment() ip_skb_dst_mtu() ip_dst_mtu_maybe_forward() ip_mtu_locked() the pointer to struct dst_entry is used as pointer to struct rtable: this turns the access to struct members like rt_mtu_locked into an OOB read in the stack. Fix this changing the temporary variable used for IPv4 packets in ovs_fragment(), similarly to what is done for IPv6 few lines below.

• Jammy update: v5.15.81 upstream stable release (LP: #2003130) // CVE-url: https://ubuntu.com/security/CVE-2023-1382
  • tipc: set con sock in tipc_conn_alloc
  • tipc: add an extra conn_get in tipc_conn_alloc
• CVE-url: https://ubuntu.com/security/CVE-2023-1998
  • x86/speculation: Allow enabling STIBP with legacy IBRS
• CVE-url: https://ubuntu.com/security/CVE-2021-47193
  • scsi: pm80xx: Tie the interrupt name to the module instance
  • scsi: pm80xx: Deal with kexec reboots
  • scsi: pm80xx: Increase number of supported queues
  • scsi: pm80xx: Remove DMA memory allocation for ccb and device structures
  • scsi: pm80xx: Increase the number of outstanding I/O supported to 1024
  • scsi: pm80xx: Fix memory leak during rmmod
• CVE-url: https://ubuntu.com/security/CVE-2021-47198
  • scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine
  • scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine
• Bionic update: upstream stable patchset 2021-12-13 (LP: #1954703) // CVE- url: https://ubuntu.com/security/CVE-2021-47194
  • cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
• CVE-url: https://ubuntu.com/security/CVE-2023-52458
  • block: add check that partition length needs to be aligned with block size
• CVE-url: https://ubuntu.com/security/CVE-2023-52600
  • jfs: fix uaf in jfs_evict_inode
• Bionic update: upstream stable patchset 2021-06-01 (LP: #1930472) // CVE- url: https://ubuntu.com/security/CVE-2021-46955
  • openvswitch: fix stack OOB read while fragmenting IPv4 packets
• Bionic update: upstream stable patchset 2021-06-01 (LP: #1930472) // CVE- url: https://ubuntu.com/security/CVE-2021-46966
  • ACPI: custom_method: fix potential use-after-free issue
• Bionic update: upstream stable patchset 2022-09-23 (LP: #1990698) // CVE- url: https://ubuntu.com/security/CVE-2019-25162
  • i2c: Fix a potential use after free
• CVE-url: https://ubuntu.com/security/CVE-2023-24023
  • Bluetooth: Add debug setting for changing minimum encryption key size
  • Bluetooth: Add more enc key size check
• CVE-url: https://ubuntu.com/security/CVE-2023-52603
  • UBSAN: array-index-out-of-bounds in dtSplitRoot
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-46906
  • HID: usbhid: fix info leak in hid_submit_ctrl
• Bionic update: upstream stable patchset 2021-05-25 (LP: #1929603) // CVE- url: https://ubuntu.com/security/CVE-2021-46905
  • net: hso: fix NULL-deref on disconnect regression
• Bionic update: upstream stable patchset 2021-04-30 (LP: #1926808) // CVE- url: https://ubuntu.com/security/CVE-2021-46904
  • net: hso: fix null-ptr-deref during tty device unregistration
• CVE-url: https://ubuntu.com/security/CVE-2024-26600
  • phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP

• Jammy update: v5.15.81 upstream stable release (LP: #2003130) // CVE-url: https://ubuntu.com/security/CVE-2023-1382
  • tipc: set con sock in tipc_conn_alloc
  • tipc: add an extra conn_get in tipc_conn_alloc
• CVE-url: https://ubuntu.com/security/CVE-2023-1998
  • x86/speculation: Allow enabling STIBP with legacy IBRS
• CVE-url: https://ubuntu.com/security/CVE-2021-47193
  • scsi: pm80xx: Tie the interrupt name to the module instance
  • scsi: pm80xx: Deal with kexec reboots
  • scsi: pm80xx: Increase number of supported queues
  • scsi: pm80xx: Remove DMA memory allocation for ccb and device structures
  • scsi: pm80xx: Increase the number of outstanding I/O supported to 1024
  • scsi: pm80xx: Fix memory leak during rmmod
• CVE-url: https://ubuntu.com/security/CVE-2021-47198
  • scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine
  • scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine
• Bionic update: upstream stable patchset 2021-12-13 (LP: #1954703) // CVE- url: https://ubuntu.com/security/CVE-2021-47194
  • cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
• CVE-url: https://ubuntu.com/security/CVE-2023-52458
  • block: add check that partition length needs to be aligned with block size
• CVE-url: https://ubuntu.com/security/CVE-2023-52600
  • jfs: fix uaf in jfs_evict_inode
• Bionic update: upstream stable patchset 2021-06-01 (LP: #1930472) // CVE- url: https://ubuntu.com/security/CVE-2021-46955
  • openvswitch: fix stack OOB read while fragmenting IPv4 packets
• Bionic update: upstream stable patchset 2021-06-01 (LP: #1930472) // CVE- url: https://ubuntu.com/security/CVE-2021-46966
  • ACPI: custom_method: fix potential use-after-free issue
• Bionic update: upstream stable patchset 2022-09-23 (LP: #1990698) // CVE- url: https://ubuntu.com/security/CVE-2019-25162
  • i2c: Fix a potential use after free
• CVE-url: https://ubuntu.com/security/CVE-2023-24023
  • Bluetooth: Add debug setting for changing minimum encryption key size
  • Bluetooth: Add more enc key size check
• CVE-url: https://ubuntu.com/security/CVE-2023-52603
  • UBSAN: array-index-out-of-bounds in dtSplitRoot
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-46906
  • HID: usbhid: fix info leak in hid_submit_ctrl
• Bionic update: upstream stable patchset 2021-05-25 (LP: #1929603) // CVE- url: https://ubuntu.com/security/CVE-2021-46905
  • net: hso: fix NULL-deref on disconnect regression
• Bionic update: upstream stable patchset 2021-04-30 (LP: #1926808) // CVE- url: https://ubuntu.com/security/CVE-2021-46904
  • net: hso: fix null-ptr-deref during tty device unregistration
• CVE-url: https://ubuntu.com/security/CVE-2024-26600
  • phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
• CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
• CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
• CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).
• CVE-2022-48631: Fixed a bug in ext4, when parsing extents where eh_entries == 0 and eh_depth > 0 (bsc#1223475).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223513).
• CVE-2024-26906: Disallowed vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26816: Fixed relocations in .notes section when building with CONFIG_XEN_PV=y by ignoring them (bsc#1222624).
• CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221299).
• CVE-2024-26689: Fixed a use-after-free in encode_cap_msg() (bsc#1222503).
• CVE-2021-47041: Don't set sk_user_data without write_lock (bsc#1220755).
• CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
• CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449).

The following non-security bugs were fixed:

• dm rq: do not queue request to blk-mq during DM suspend (bsc#1221113).
• dm: rearrange core declarations for extended use from dm-zone.c (bsc#1221113).
• net/tls: Remove the context from the list in tls_device_down (bsc#1221545).
• tls: Fix context leak on tls_device_down (bsc#1221545).

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).
• CVE-2020-36312: Fixed an issue in virt/kvm/kvm_main.c that had a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure (bsc#1184509).
• CVE-2021-23134: Fixed a use-after-free issue in nfc sockets (bsc#1186060).
• CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).
• CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).
• CVE-2021-46909: Fixed a PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46938: Fixed a double free of blk_mq_tag_set in dev remove after table load fails in dm rq (bsc#1220554).
• CVE-2021-46939: Fixed a denial of service in trace_clock_global() in tracing (bsc#1220580).
• CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).
• CVE-2021-46950: Fixed a data corruption bug in raid1 arrays using bitmaps in md/raid1 (bsc#1220662).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).
• CVE-2021-46958: Fixed a race between transaction aborts and fsyncs leading to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46960: Fixed a warning on smb2_get_enc_key in cifs (bsc#1220528).
• CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand() (bsc#1220536).
• CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).
• CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).
• CVE-2021-46981: Fixed a NULL pointer in flush_workqueue in nbd (bsc#1220611).
• CVE-2021-46988: Fixed release page in error path to avoid BUG_ON (bsc#1220706).
• CVE-2021-46990: Fixed a denial of service when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46998: Fixed an use after free bug in enic_hard_start_xmit in ethernet/enic (bsc#1220625).
• CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).
• CVE-2021-47015: Fixed a RX consumer index logic in the error path in bnxt_rx_pkt() in bnxt_en (bsc#1220794).
• CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).
• CVE-2021-47034: Fixed a kernel memory fault for pte update on radix in powerpc/64s (bsc#1220687).
• CVE-2021-47045: Fixed a null pointer dereference in lpfc_prep_els_iocb() in scsi lpfc (bsc#1220640).
• CVE-2021-47049: Fixed an after free in __vmbus_open() in hv vmbus (bsc#1220692).
• CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).
• CVE-2021-47056: Fixed a user-memory-access error on vf2pf_lock in crypto (bsc#1220769).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2021-47063: Fixed a potential use-after-free during bridge detach in drm bridge/panel (bsc#1220777).
• CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).
• CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).
• CVE-2021-47071: Fixed a memory leak in error handling paths in hv_uio_cleanup() in uio_hv_generic (bsc#1220846).
• CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221532).
• CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221541).
• CVE-2021-47113: Abort…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
• CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
• CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
• CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).
• CVE-2022-48631: Fixed a bug in ext4, when parsing extents where eh_entries == 0 and eh_depth > 0 (bsc#1223475).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223513).
• CVE-2024-26906: Disallowed vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26816: Fixed relocations in .notes section when building with CONFIG_XEN_PV=y by ignoring them (bsc#1222624).
• CVE-2021-47207: Fixed a null pointer dereference on pointer block in gus (bsc#1222790).
• CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221299).
• CVE-2024-26689: Fixed a use-after-free in encode_cap_msg() (bsc#1222503).
• CVE-2021-47041: Don't set sk_user_data without write_lock (bsc#1220755).
• CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
• CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449).

The following non-security bugs were fixed:

• dm rq: do not queue request to blk-mq during DM suspend (bsc#1221113).
• dm: rearrange core declarations for extended use from dm-zone.c (bsc#1221113).
• net/tls: Remove the context from the list in tls_device_down (bsc#1221545).
• tls: Fix context leak on tls_device_down (bsc#1221545).

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
• CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
• CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
• CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).
• CVE-2022-48631: Fixed a bug in ext4, when parsing extents where eh_entries == 0 and eh_depth > 0 (bsc#1223475).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223513).
• CVE-2024-26816: Fixed relocations in .notes section when building with CONFIG_XEN_PV=y by ignoring them (bsc#1222624).
• CVE-2024-26906: Disallowed vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26689: Fixed a use-after-free in encode_cap_msg() (bsc#1222503).
• CVE-2021-47041: Don't set sk_user_data without write_lock (bsc#1220755).
• CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
• CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449).

The following non-security bugs were fixed:

• net/tls: Remove the context from the list in tls_device_down (bsc#1221545).
• tls: Fix context leak on tls_device_down (bsc#1221545).

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948).
• CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2022-48697: Fix a use-after-free (bsc#1223922).
• CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).
• CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222).
• CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
• CVE-2021-47548: Fixed a possible array out-of-bounds (bsc#1225506)
• CVE-2024-36029: Pervent access to suspended controller (bsc#1225708)
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
• CVE-2021-47352: Add validation for used length (bsc#1225124).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).
• CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2021-47423: Fix file release memory leak (bsc#1225366).
• CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
• CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
• CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)
• CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
• CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960).
• CVE-2024-35791: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (bsc#1224725).
• CVE-2021-47401: Fix stack information leak (bsc#1225242).
• CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).
• CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).
• CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
• CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
• CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).
• CVE-2023-52864: Fix opening of char device (bsc#1225132).
• CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).
• CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).
• CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)
• CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).
• CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).
• CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)
• CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).
• CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)
• CVE-2021-47249: Fix memory leak in rds_recvmsg (bsc#1224880)
• CVE-2021-47397: Break out if skb_header_pointer returns NULL in…

This update for the Linux Kernel 5.3.18-150200_24_157 fixes several issues.

The following security issues were fixed:

• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2023-52628: Fixed 4-byte stack OOB write in nftables (bsc#1222118).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).

This update for the Linux Kernel 5.3.18-150200_24_172 fixes several issues.

The following security issues were fixed:

• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsystem when adding a new event (bsc#1218259).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).

This update for the Linux Kernel 5.3.18-150200_24_183 fixes several issues.

The following security issues were fixed:

• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150200_24_188 fixes several issues.

The following security issues were fixed:

• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150200_24_166 fixes several issues.

The following security issues were fixed:

• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).

This update for the Linux Kernel 5.3.18-150300_59_124 fixes several issues.

The following security issues were fixed:

• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2023-52628: Fixed 4-byte stack OOB write in nftables (bsc#1222118).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).

This update for the Linux Kernel 4.12.14-122_201 fixes several issues.

The following security issues were fixed:

• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150300_59_158 fixes several issues.

The following security issues were fixed:

• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221302).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150300_59_138 fixes several issues.

The following security issues were fixed:

• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).

This update for the Linux Kernel 5.3.18-150300_59_144 fixes several issues.

The following security issues were fixed:

• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsystem when adding a new event (bsc#1218259).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).

This update for the Linux Kernel 4.12.14-122_216 fixes several issues.

The following security issues were fixed:

• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150300_59_153 fixes several issues.

The following security issues were fixed:

• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221302).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).
• CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
• CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
• CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
• CVE-2021-47206: Check return value after calling platform_get_resource() (bsc#1222894).
• CVE-2021-47238: Fixed memory leak in ip_mc_add1_src (bsc#1224847)
• CVE-2021-47245: Fixed out of bounds when parsing TCP options (bsc#1224838)
• CVE-2021-47246: Fixed page reclaim for dead peer hairpin (CVE-2021-47246 bsc#1224831).
• CVE-2021-47249: Fixed memory leak in rds_recvmsg (bsc#1224880)
• CVE-2021-47250: Fixed memory leak in netlbl_cipsov4_add_std (bsc#1224827)
• CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
• CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960).
• CVE-2021-47281: Fixed race of snd_seq_timer_open() (bsc#1224983).
• CVE-2021-47334: Fixed two use after free in ibmasm_init_one (bsc#1225112).
• CVE-2021-47352: Add validation for used length (bsc#1225124).
• CVE-2021-47355: Fixed possible use-after-free in nicstar_cleanup() (bsc#1225141).
• CVE-2021-47357: Fixed possible use-after-free in ia_module_exit() (bsc#1225144).
• CVE-2021-47361: Fixed error handling in mcb_alloc_bus() (bsc#1225151).
• CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb (bsc#1225082)
• CVE-2021-47401: Fixed stack information leak (bsc#1225242).
• CVE-2021-47423: Fixed file release memory leak (bsc#1225366).
• CVE-2021-47431: Fixed gart.bo pin_count leak (bsc#1225390).
• CVE-2021-47469: Add SPI fix commit to be ignored (bsc#1225347)
• CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit() (bsc#1224907).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48672: Fixed off-by-one error in unflatten_dt_nodes() (CVE-2022-48672 bsc#1223931).
• CVE-2022-48686: Fixed UAF when detecting digest errors (bsc#1223948).
• CVE-2022-48697: Fixed a use-after-free (bsc#1223922).
• CVE-2022-48702: Fixed out of bounds access in snd_emu10k1_pcm_channel_alloc() (bsc#1223923).
• CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)
• CVE-2022-48708: Fixed potential NULL dereference (bsc#1224942).
• CVE-2022-48710: Fixed a possible null pointer dereference (bsc#1225230).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52691: Fixed a double-free in si_dpm_init (bsc#1224607).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2023-52730: Fixed possible resource leaks in some error paths (bsc#1224956).
• CVE-2023-52732: Blocklist the kclient when…

This update for the Linux Kernel 4.12.14-122_186 fixes several issues.

The following security issues were fixed:

• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsystem when adding a new event (bsc#1218259).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).

This update for the Linux Kernel 5.3.18-150200_24_183 fixes several issues.

The following security issues were fixed:

• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150200_24_188 fixes several issues.

The following security issues were fixed:

• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150300_59_158 fixes several issues.

The following security issues were fixed:

• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221302).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150300_59_153 fixes several issues.

The following security issues were fixed:

• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221302).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 4.12.14-122_201 fixes several issues.

The following security issues were fixed:

• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223681).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 4.12.14-122_216 fixes several issues.

The following security issues were fixed:

• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150200_24_183 fixes several issues.

The following security issues were fixed:

• CVE-2024-27398: Fixed use-after-free bug caused by sco_sock_timeout() (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150300_59_153 fixes several issues.

The following security issues were fixed:

• CVE-2024-27398: Fixed use-after-free bug caused by sco_sock_timeout() (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221302).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150200_24_188 fixes several issues.

The following security issues were fixed:

• CVE-2024-27398: Fixed use-after-free bug caused by sco_sock_timeout() (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150300_59_158 fixes several issues.

The following security issues were fixed:

• CVE-2024-27398: Fixed use-after-free bug caused by sco_sock_timeout() (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221302).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 4.12.14-122_201 fixes several issues.

The following security issues were fixed:

• CVE-2024-27398: Fixed use-after-free bug caused by sco_sock_timeout() (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223681).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 4.12.14-122_216 fixes several issues.

The following security issues were fixed:

• CVE-2024-27398: Fixed use-after-free bug caused by sco_sock_timeout() (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 4.12.14-122_216 fixes several issues.

The following security issues were fixed:

• CVE-2021-47378: Fixed use-after-free by destroying cm id before destroying qp (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150300_59_153 fixes several issues.

The following security issues were fixed:

• CVE-2021-47402: Fixed use-after-free in fl_walk() (bsc#1225301)
• CVE-2021-47378: Fixed use-after-free by destroying cm id before destroying qp (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221302).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 4.12.14-122_201 fixes several issues.

The following security issues were fixed:

• CVE-2021-47378: Fixed use-after-free by destroying cm id before destroying qp (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223681).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150200_24_183 fixes several issues.

The following security issues were fixed:

• CVE-2021-47402: Fixed use-after-free in fl_walk() (bsc#1225301)
• CVE-2021-47378: Fixed use-after-free by destroying cm id before destroying qp (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150200_24_188 fixes several issues.

The following security issues were fixed:

• CVE-2021-47402: Fixed use-after-free in fl_walk() (bsc#1225301)
• CVE-2021-47378: Fixed use-after-free by destroying cm id before destroying qp (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150300_59_158 fixes several issues.

The following security issues were fixed:

• CVE-2021-47402: Fixed use-after-free in fl_walk() (bsc#1225301)
• CVE-2021-47378: Fixed use-after-free by destroying cm id before destroying qp (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221302).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150200_24_183 fixes several issues.

The following security issues were fixed:

• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1225312).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1227651).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325).
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150200_24_188 fixes several issues.

The following security issues were fixed:

• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1225312).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1227651).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325).
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150300_59_153 fixes several issues.

The following security issues were fixed:

• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1225312).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1227651).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325).
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221302).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150300_59_158 fixes several issues.

The following security issues were fixed:

• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1225312).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1227651).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325).
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221302).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 4.12.14-122_201 fixes several issues.

The following security issues were fixed:

• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223681).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 4.12.14-122_216 fixes several issues.

The following security issues were fixed:

• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).