CVE-2021-47288

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

can: mcba_usb: fix memory leak in mcba_usb

Syzbot reported memory leak in SocketCAN driver for Microchip CAN BUS Analyzer Tool. The problem was in unfreed usb_coherent.

In mcba_usb_start() 20 coherent buffers are allocated and there is nothing, that frees them:

1. In callback function the urb is resubmitted and that's all
2. In disconnect function urbs are simply killed, but URB_FREE_BUFFER is not set (see mcba_usb_start) and this flag cannot be used with coherent buffers.

Fail log: | [ 1354.053291][ T8413] mcba_usb 1-1:0.0 can0: device disconnected | [ 1367.059384][ T8420] kmemleak: 20 new suspected memory leaks (see /sys/kernel/debug/kmem)

So, all allocated buffers should be freed with usb_free_coherent() explicitly

NOTE: The same pattern for allocating and freeing coherent buffers is used in drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c(CVE-2021-47231)

In the Linux kernel, the following vulnerability has been resolved:

can: j1939: fix Use-after-Free, hold skb ref while in use

This patch fixes a Use-after-Free found by the syzbot.

The problem is that a skb is taken from the per-session skb queue, without incrementing the ref count. This leads to a Use-after-Free if the skb is taken concurrently from the session queue due to a CTS.(CVE-2021-47232)

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: Avoid WARN_ON timing related checks

The soft/batadv interface for a queued OGM can be changed during the time the OGM was queued for transmission and when the OGM is actually transmitted by the worker.

But WARN_ON must be used to denote kernel bugs and not to print simple warnings. A warning can simply be printed using pr_warn.(CVE-2021-47252)

In the Linux kernel, the following vulnerability has been resolved:

media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()

Fix an 11-year old bug in ngene_command_config_free_buf() while addressing the following warnings caught with -Warray-bounds:

arch/alpha/include/asm/string.h:22:16: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds] arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds]

The problem is that the original code is trying to copy 6 bytes of data into a one-byte size member config of the wrong structue FW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a legitimate compiler warning because memcpy() overruns the length of &com.cmd.ConfigureBuffers.config. It seems that the right structure is FW_CONFIGURE_FREE_BUFFERS, instead, because it contains 6 more members apart from the header hdr. Also, the name of the function ngene_command_config_free_buf() suggests that the actual intention is to ConfigureFreeBuffers, instead of ConfigureBuffers (which takes place in the function ngene_command_config_buf(), above).

Fix this by enclosing those 6 members of struct FW_CONFIGURE_FREE_BUFFERS into new struct config, and use &com.cmd.ConfigureFreeBuffers.config as the destination address, instead of &com.cmd.ConfigureBuffers.config, when calling memcpy().

This also helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().(CVE-2021-47288)

In the Linux kernel, the following vulnerability has been resolved:

coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()

commit 6f755e85c332 ("coresight: Add helper for…

In the Linux kernel, the following vulnerability has been resolved: media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() Fix an 11-year old bug in ngene_command_config_free_buf() while addressing the following warnings caught with -Warray-bounds: arch/alpha/include/asm/string.h:22:16: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds] arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds] The problem is that the original code is trying to copy 6 bytes of data into a one-byte size member config of the wrong structue FW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a legitimate compiler warning because memcpy() overruns the length of &com.cmd.ConfigureBuffers.config. It seems that the right structure is FW_CONFIGURE_FREE_BUFFERS, instead, because it contains 6 more members apart from the header hdr. Also, the name of the function ngene_command_config_free_buf() suggests that the actual intention is to ConfigureFreeBuffers, instead of ConfigureBuffers (which takes place in the function ngene_command_config_buf(), above). Fix this by enclosing those 6 members of struct FW_CONFIGURE_FREE_BUFFERS into new struct config, and use &com.cmd.ConfigureFreeBuffers.config as the destination address, instead of &com.cmd.ConfigureBuffers.config, when calling memcpy(). This also helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().

• CVE-url: https://ubuntu.com/security/CVE-2024-38553/CVE-2024-38597
  • netpoll: make ndo_poll_controller() optional
  • bonding: use netpoll_poll_dev() helper
  • netpoll: do not test NAPI_STATE_SCHED in poll_one_napi()
• CVE-url: https://ubuntu.com/security/CVE-2024-38597
  • eth: sungem: remove .ndo_poll_controller to avoid deadlocks
• CVE-url: https://ubuntu.com/security/CVE-2024-38553
  • net: fec: remove .ndo_poll_controller to avoid deadlocks
• CVE-url: https://ubuntu.com/security/CVE-2024-41066
  • ibmvnic: Add tx check to prevent skb leak
• CVE-url: https://ubuntu.com/security/CVE-2024-40982
  • ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
• CVE-url: https://ubuntu.com/security/CVE-2024-50154
  • tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
• CVE-url: https://ubuntu.com/security/CVE-2024-56595
  • jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
• CVE-url: https://ubuntu.com/security/CVE-2024-57896
  • btrfs: fix hang during unmount when stopping a space reclaim worker
  • btrfs: wait for fixup workers before stopping cleaner kthread during umount
  • btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
• CVE-url: https://ubuntu.com/security/CVE-2024-56598
  • jfs: array-index-out-of-bounds fix in dtReadFirst
• CVE-url: https://ubuntu.com/security/CVE-2024-56596
  • jfs: fix array-index-out-of-bounds in jfs_readdir
• Bionic update: upstream stable patchset 2022-01-25 (LP: #1959033) // CVE- url: https://ubuntu.com/security/CVE-2021-47485
  • IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
• CVE-url: https://ubuntu.com/security/CVE-2024-56602
  • net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-56601
  • net: inet: do not leave a dangling sk pointer in inet_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-56600
  • sock: struct proto hash function may error
  • net: inet6: do not leave a dangling sk pointer in inet6_create()
• CVE-url: https://ubuntu.com/security/CVE-2023-52818
  • drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
• CVE-url: https://ubuntu.com/security/CVE-2024-35887
  • ax25: fix use-after-free bugs caused by ax25_ds_del_timer
• Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE- url: https://ubuntu.com/security/CVE-2021-47404
  • HID: betop: fix slab-out-of-bounds Write in betop_probe
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47254
  • gfs2: Fix use-after-free in gfs2_glock_shrink_scan
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47506
  • nfsd: fix use-after-free due to delegation race
• CVE-url: https://ubuntu.com/security/CVE-2024-56606
  • af_packet: avoid erroring out after sock_init_data() in packet_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-53141
  • netfilter: ipset: add missing range check in bitmap_ip_uadt
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47280
  • drm: Fix use-after-free read in drm_getunique()
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47235
  • net: ethernet: fix potential use-after-free in ec_bhf_remove
• Bionic update: upstream stable patchset 2021-08-13 (LP: #1939913) // CVE- url: https://ubuntu.com/security/CVE-2021-47309
  • net: validate lwtstate->data before returning from skb_tunnel_info()
• Bionic update: upstream stable patchset 2022-01-06 (LP: #1956614) // CVE- url: https://ubuntu.com/security/CVE-2021-47549
  • sata_fsl: fix UAF in…

• CVE-url: https://ubuntu.com/security/CVE-2024-38553/CVE-2024-38597
  • netpoll: make ndo_poll_controller() optional
  • bonding: use netpoll_poll_dev() helper
  • netpoll: do not test NAPI_STATE_SCHED in poll_one_napi()
• CVE-url: https://ubuntu.com/security/CVE-2024-38597
  • eth: sungem: remove .ndo_poll_controller to avoid deadlocks
• CVE-url: https://ubuntu.com/security/CVE-2024-38553
  • net: fec: remove .ndo_poll_controller to avoid deadlocks
• CVE-url: https://ubuntu.com/security/CVE-2024-41066
  • ibmvnic: Add tx check to prevent skb leak
• CVE-url: https://ubuntu.com/security/CVE-2024-40982
  • ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
• CVE-url: https://ubuntu.com/security/CVE-2024-50154
  • tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
• CVE-url: https://ubuntu.com/security/CVE-2024-56595
  • jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
• CVE-url: https://ubuntu.com/security/CVE-2024-57896
  • btrfs: fix hang during unmount when stopping a space reclaim worker
  • btrfs: wait for fixup workers before stopping cleaner kthread during umount
  • btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
• CVE-url: https://ubuntu.com/security/CVE-2024-56598
  • jfs: array-index-out-of-bounds fix in dtReadFirst
• CVE-url: https://ubuntu.com/security/CVE-2024-56596
  • jfs: fix array-index-out-of-bounds in jfs_readdir
• Bionic update: upstream stable patchset 2022-01-25 (LP: #1959033) // CVE- url: https://ubuntu.com/security/CVE-2021-47485
  • IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
• CVE-url: https://ubuntu.com/security/CVE-2024-56602
  • net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-56601
  • net: inet: do not leave a dangling sk pointer in inet_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-56600
  • sock: struct proto hash function may error
  • net: inet6: do not leave a dangling sk pointer in inet6_create()
• CVE-url: https://ubuntu.com/security/CVE-2023-52818
  • drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
• CVE-url: https://ubuntu.com/security/CVE-2024-35887
  • ax25: fix use-after-free bugs caused by ax25_ds_del_timer
• Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE- url: https://ubuntu.com/security/CVE-2021-47404
  • HID: betop: fix slab-out-of-bounds Write in betop_probe
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47254
  • gfs2: Fix use-after-free in gfs2_glock_shrink_scan
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47506
  • nfsd: fix use-after-free due to delegation race
• CVE-url: https://ubuntu.com/security/CVE-2024-56606
  • af_packet: avoid erroring out after sock_init_data() in packet_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-53141
  • netfilter: ipset: add missing range check in bitmap_ip_uadt
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47280
  • drm: Fix use-after-free read in drm_getunique()
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47235
  • net: ethernet: fix potential use-after-free in ec_bhf_remove
• Bionic update: upstream stable patchset 2021-08-13 (LP: #1939913) // CVE- url: https://ubuntu.com/security/CVE-2021-47309
  • net: validate lwtstate->data before returning from skb_tunnel_info()
• Bionic update: upstream stable patchset 2022-01-06 (LP: #1956614) // CVE- url: https://ubuntu.com/security/CVE-2021-47549
  • sata_fsl: fix UAF in…

• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• scsi: mpt3sas: Fix kernel panic during drive powercycle test {CVE-2021-47565}
• net/sched: act_skbmod: Skip non-Ethernet packets {CVE-2021-47293}
• scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219}
• net: validate lwtstate->data before returning from skb_tunnel_info() {CVE-2021-47309}
• regmap: Fix possible double-free in regcache_rbtree_exit() {CVE-2021-47483}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() {CVE-2026-23193}
• isdn: cpai: check ctr->cnr to avoid array index out of bound {CVE-2021-3896}
• scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() {CVE-2021-47541}
• scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() {CVE-2021-47576}
• igbvf: fix double free in igbvf_probe {CVE-2021-47589}
• dm btree remove: fix use after free in rebalance_children() {CVE-2021-47600}
• RDMA/cxgb4: Do not dma memory off of the stack {CVE-2019-17075}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• smb: client: reject userspace cifs.spnego descriptions
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}

• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• dm btree remove: fix use after free in rebalance_children() {CVE-2021-47600}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• net/sched: act_skbmod: Skip non-Ethernet packets {CVE-2021-47293}
• scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219}
• drm: Fix use-after-free read in drm_getunique() {CVE-2021-47280}
• net: validate lwtstate->data before returning from skb_tunnel_info() {CVE-2021-47309}
• regmap: Fix possible double-free in regcache_rbtree_exit() {CVE-2021-47483}
• netfilter: nftables: avoid overflows in nft_hash_buckets() {CVE-2021-46992}
• ALSA: seq: Fix race of snd_seq_timer_open() {CVE-2021-47281}
• netfilter: synproxy: Fix out of bounds when parsing TCP options {CVE-2021-47245}
• scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() {CVE-2021-47576}
• net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() {CVE-2021-47541}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• ext4: fix null-ptr-deref in ext4_write_info {CVE-2022-50344}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• smb: client: reject userspace cifs.spnego descriptions
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}

• i40e: remove read access to debugfs files {CVE-2025-39901}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• md: fix resync softlockup when bitmap size is less than array size {CVE-2023-53357}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• tracing: Only have rmmod clear buffers that its events were active in {CVE-2022-49006}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• dm raid: fix accesses beyond end of raid member array {CVE-2022-49674}
• md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output {CVE-2023-53676}
• mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}

• i40e: remove read access to debugfs files {CVE-2025-39901}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• md: fix resync softlockup when bitmap size is less than array size {CVE-2023-53357}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• tracing: Only have rmmod clear buffers that its events were active in {CVE-2022-49006}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• dm raid: fix accesses beyond end of raid member array {CVE-2022-49674}
• md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output {CVE-2023-53676}
• mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}

• i40e: remove read access to debugfs files {CVE-2025-39901}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• md: fix resync softlockup when bitmap size is less than array size {CVE-2023-53357}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• tracing: Only have rmmod clear buffers that its events were active in {CVE-2022-49006}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• dm raid: fix accesses beyond end of raid member array {CVE-2022-49674}
• md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output {CVE-2023-53676}
• mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948). Update blacklist.conf: remove entry
• CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2022-48697: Fix a use-after-free (bsc#1223922). Update blacklist.conf: drop entry from it
• CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).
• CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222 CVE-2023-52732).
• CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2024-36029: Pervent access to suspended controller (bsc#1225708 CVE-2024-36029)
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
• CVE-2021-47352: Add validation for used length (bsc#1225124).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).
• CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2021-47423: Fix file release memory leak (bsc#1225366).
• CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
• CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
• CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)
• CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
• CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960, CVE-2021-47277).
• CVE-2024-35791: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (bsc#1224725).
• CVE-2021-47401: Fix stack information leak (bsc#1225242).
• CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).
• CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).
• CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
• CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
• CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).
• CVE-2023-52864: Fix opening of char device (bsc#1225132).
• CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).
• CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).
• CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)
• CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).
• CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).
• CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)
• CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).
• CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931) -…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948).
• CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2022-48697: Fix a use-after-free (bsc#1223922).
• CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).
• CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222).
• CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
• CVE-2021-47548: Fixed a possible array out-of-bounds (bsc#1225506)
• CVE-2024-36029: Pervent access to suspended controller (bsc#1225708)
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
• CVE-2021-47352: Add validation for used length (bsc#1225124).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).
• CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2021-47423: Fix file release memory leak (bsc#1225366).
• CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
• CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
• CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)
• CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
• CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960).
• CVE-2024-35791: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (bsc#1224725).
• CVE-2021-47401: Fix stack information leak (bsc#1225242).
• CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).
• CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).
• CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
• CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
• CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).
• CVE-2023-52864: Fix opening of char device (bsc#1225132).
• CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).
• CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).
• CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)
• CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).
• CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).
• CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)
• CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).
• CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)
• CVE-2021-47249: Fix memory leak in rds_recvmsg (bsc#1224880)
• CVE-2021-47397: Break out if skb_header_pointer returns NULL in…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
• CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
• CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
• CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).

The following non-security bugs were fixed:

• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• cifs: add missing spinlock around tcon refcount (bsc#1213476).
• cifs: avoid dup prefix path in dfs_get_automount_devname() (bsc#1213476).
• cifs: avoid race conditions with parallel reconnects (bsc#1213476).
• cifs: avoid re-lookups in dfs_cache_find() (bsc#1213476).
• cifs: avoid use of global locks for high contention data (bsc#1213476).
• cifs: check only tcon status on tcon related functions (bsc#1213476).
• cifs: do all necessary checks for credits within or before locking (bsc#1213476).
• cifs: do not block in dfs_cache_noreq_update_tgthint() (bsc#1213476).
• cifs: do not refresh cached referrals from unactive mounts (bsc#1213476).
• cifs: do not take exclusive lock for updating target hints (bsc#1213476).
• cifs: fix confusing debug message (bsc#1213476).
• cifs: fix missing unload_nls() in smb2_reconnect() (bsc#1213476).
• cifs: fix potential deadlock in cache_refresh_path() (bsc#1213476).
• cifs: fix refresh of cached referrals (bsc#1213476).
• cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (bsc#1213476).
• cifs: fix source pathname comparison of dfs supers (bsc#1213476).
• cifs: fix status checks in cifs_tree_connect (bsc#1213476).
• cifs: fix use-after-free bug in refresh_cache_worker() (bsc#1213476).
• cifs: get rid of dns resolve worker (bsc#1213476).
• cifs: get rid of mount options string parsing (bsc#1213476).
• cifs: handle cache lookup errors different than -ENOENT (bsc#1213476).
• cifs: ignore ipc reconnect failures during dfs failover (bsc#1213476).
• cifs: match even the scope id for ipv6 addresses (bsc#1213476).
• cifs: optimize reconnect of nested links (bsc#1213476).
• cifs: prevent data race in smb2_reconnect() (bsc#1213476). -…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
• CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
• CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
• CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
• CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
• CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).

The following non-security bugs were fixed:

• NFC: nxp: add NXP1002 (bsc#1185589).
• PCI: rpaphp: Add MODULE_DESCRIPTION (bsc#1176869 ltc#188243).
• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• md: Replace snprintf with scnprintf (git-fixes).
• netfilter: nf_tables: GC transaction race with abort path (git-fixes).
• netfilter: nf_tables: GC transaction race with netns dismantle (git-fixes).
• netfilter: nf_tables: defer gc run if previous batch is still pending (git-fixes).
• netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path (git-fixes).
• netfilter: nf_tables: fix kdoc warnings after gc rework (git-fixes).
• netfilter: nf_tables: fix memleak when more than 255 elements expired (git-fixes).
• netfilter: nf_tables: mark newset as dead on transaction abort (git-fixes).
• netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (git-fixes).
• netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure (git-fixes).
• netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (git-fixes).
• netfilter: nf_tables: skip dead set elements in netlink dump (git-fixes).
• netfilter: nf_tables: use correct lock to protect gc_list (git-fixes).
• netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration (git-fixes).
• netfilter: nft_set_rbtree: Add missing expired checks (git-fixes).
• netfilter: nft_set_rbtree: Detect partial overlap with start endpoint match (git-fixes).
• netfilter: nft_set_rbtree: Detect partial overlaps on insertion (git-fixes).
• netfilter: nft_set_rbtree: Do not account for expired elements on insertion (git-fixes).
• netfilter: nft_set_rbtree: Drop spurious condition for overlap detection on insertion (git-fixes).
• netfilter: nft_set_rbtree: Handle outcomes of tree rotations in overlap detection (git-fixes).
• netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start() (git-fixes). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).
• CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
• CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
• CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
• CVE-2021-47206: Check return value after calling platform_get_resource() (bsc#1222894).
• CVE-2021-47238: Fixed memory leak in ip_mc_add1_src (bsc#1224847)
• CVE-2021-47245: Fixed out of bounds when parsing TCP options (bsc#1224838)
• CVE-2021-47246: Fixed page reclaim for dead peer hairpin (CVE-2021-47246 bsc#1224831).
• CVE-2021-47249: Fixed memory leak in rds_recvmsg (bsc#1224880)
• CVE-2021-47250: Fixed memory leak in netlbl_cipsov4_add_std (bsc#1224827)
• CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
• CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960).
• CVE-2021-47281: Fixed race of snd_seq_timer_open() (bsc#1224983).
• CVE-2021-47334: Fixed two use after free in ibmasm_init_one (bsc#1225112).
• CVE-2021-47352: Add validation for used length (bsc#1225124).
• CVE-2021-47355: Fixed possible use-after-free in nicstar_cleanup() (bsc#1225141).
• CVE-2021-47357: Fixed possible use-after-free in ia_module_exit() (bsc#1225144).
• CVE-2021-47361: Fixed error handling in mcb_alloc_bus() (bsc#1225151).
• CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb (bsc#1225082)
• CVE-2021-47401: Fixed stack information leak (bsc#1225242).
• CVE-2021-47423: Fixed file release memory leak (bsc#1225366).
• CVE-2021-47431: Fixed gart.bo pin_count leak (bsc#1225390).
• CVE-2021-47469: Add SPI fix commit to be ignored (bsc#1225347)
• CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit() (bsc#1224907).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48672: Fixed off-by-one error in unflatten_dt_nodes() (CVE-2022-48672 bsc#1223931).
• CVE-2022-48686: Fixed UAF when detecting digest errors (bsc#1223948).
• CVE-2022-48697: Fixed a use-after-free (bsc#1223922).
• CVE-2022-48702: Fixed out of bounds access in snd_emu10k1_pcm_channel_alloc() (bsc#1223923).
• CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)
• CVE-2022-48708: Fixed potential NULL dereference (bsc#1224942).
• CVE-2022-48710: Fixed a possible null pointer dereference (bsc#1225230).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52691: Fixed a double-free in si_dpm_init (bsc#1224607).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2023-52730: Fixed possible resource leaks in some error paths (bsc#1224956).
• CVE-2023-52732: Blocklist the kclient when…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
• CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
• CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
• CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
• CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).

The following non-security bugs were fixed:

• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• cifs: add missing spinlock around tcon refcount (bsc#1213476).
• cifs: avoid dup prefix path in dfs_get_automount_devname() (bsc#1213476).
• cifs: avoid race conditions with parallel reconnects (bsc#1213476).
• cifs: avoid re-lookups in dfs_cache_find() (bsc#1213476).
• cifs: avoid use of global locks for high contention data (bsc#1213476).
• cifs: check only tcon status on tcon related functions (bsc#1213476).
• cifs: do all necessary checks for credits within or before locking (bsc#1213476).
• cifs: do not block in dfs_cache_noreq_update_tgthint() (bsc#1213476).
• cifs: do not refresh cached referrals from unactive mounts (bsc#1213476).
• cifs: do not take exclusive lock for updating target hints (bsc#1213476).
• cifs: fix confusing debug message (bsc#1213476).
• cifs: fix missing unload_nls() in smb2_reconnect() (bsc#1213476).
• cifs: fix potential deadlock in cache_refresh_path() (bsc#1213476).
• cifs: fix refresh of cached referrals (bsc#1213476).
• cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (bsc#1213476).
• cifs: fix source pathname comparison of dfs supers (bsc#1213476).
• cifs: fix status checks in cifs_tree_connect (bsc#1213476).
• cifs: fix use-after-free bug in refresh_cache_worker() (bsc#1213476).
• cifs: get rid of dns resolve worker (bsc#1213476).
• cifs: get rid of mount options string parsing (bsc#1213476).
• cifs: handle cache lookup errors different than -ENOENT (bsc#1213476).
• cifs: ignore ipc reconnect failures during dfs failover (bsc#1213476).
• cifs: match even the scope id for ipv6 addresses (bsc#1213476).
• cifs: optimize reconnect of nested links (bsc#1213476).
• cifs: prevent data race in smb2_reconnect() (bsc#1213476). -…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49110: netfilter: conntrack: revisit gc autotuning (bsc#1237981).
• CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
• CVE-2022-49767: 9p/trans_fd: always use O_NONBLOCK read/write (bsc#1242493).
• CVE-2022-49769: gfs2: Check sb_bsize_shift after reading superblock (bsc#1242440).
• CVE-2022-49770: ceph: avoid putting the realm twice when decoding snaps fails (bsc#1242597).
• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2022-49789: scsi: zfcp: Fix double free of FSF request when qdio send fails (bsc#1242366).
• CVE-2023-53039: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function (bsc#1242745).
• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).

The following non-security bugs were fixed:

• HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc (bsc#1242745).
• devm-helpers: Add resource managed version of work init (bsc#1242745).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• workqueue: Add resource managed version of delayed work init (bsc#1242745).
• Remove debug flavor (bsc#1243919).