CVE-2021-47309

In the Linux kernel, the following vulnerability has been resolved: net: validate lwtstate->data before returning from skb_tunnel_info() skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info type without validation. lwtstate->data can have various types such as mpls_iptunnel_encap, etc and these are not compatible. So skb_tunnel_info() should validate before returning that pointer. Splat looks like: BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan] Read of size 2 at addr ffff888106ec2698 by task ping/811 CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195 Call Trace: dump_stack_lvl+0x56/0x7b print_address_description.constprop.8.cold.13+0x13/0x2ee ? vxlan_get_route+0x418/0x4b0 [vxlan] ? vxlan_get_route+0x418/0x4b0 [vxlan] kasan_report.cold.14+0x83/0xdf ? vxlan_get_route+0x418/0x4b0 [vxlan] vxlan_get_route+0x418/0x4b0 [vxlan] [ ... ] vxlan_xmit_one+0x148b/0x32b0 [vxlan] [ ... ] vxlan_xmit+0x25c5/0x4780 [vxlan] [ ... ] dev_hard_start_xmit+0x1ae/0x6e0 __dev_queue_xmit+0x1f39/0x31a0 [ ... ] neigh_xmit+0x2f9/0x940 mpls_xmit+0x911/0x1600 [mpls_iptunnel] lwtunnel_xmit+0x18f/0x450 ip_finish_output2+0x867/0x2040 [ ... ]

• CVE-url: https://ubuntu.com/security/CVE-2024-38553/CVE-2024-38597
  • netpoll: make ndo_poll_controller() optional
  • bonding: use netpoll_poll_dev() helper
  • netpoll: do not test NAPI_STATE_SCHED in poll_one_napi()
• CVE-url: https://ubuntu.com/security/CVE-2024-38597
  • eth: sungem: remove .ndo_poll_controller to avoid deadlocks
• CVE-url: https://ubuntu.com/security/CVE-2024-38553
  • net: fec: remove .ndo_poll_controller to avoid deadlocks
• CVE-url: https://ubuntu.com/security/CVE-2024-41066
  • ibmvnic: Add tx check to prevent skb leak
• CVE-url: https://ubuntu.com/security/CVE-2024-40982
  • ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
• CVE-url: https://ubuntu.com/security/CVE-2024-50154
  • tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
• CVE-url: https://ubuntu.com/security/CVE-2024-56595
  • jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
• CVE-url: https://ubuntu.com/security/CVE-2024-57896
  • btrfs: fix hang during unmount when stopping a space reclaim worker
  • btrfs: wait for fixup workers before stopping cleaner kthread during umount
  • btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
• CVE-url: https://ubuntu.com/security/CVE-2024-56598
  • jfs: array-index-out-of-bounds fix in dtReadFirst
• CVE-url: https://ubuntu.com/security/CVE-2024-56596
  • jfs: fix array-index-out-of-bounds in jfs_readdir
• Bionic update: upstream stable patchset 2022-01-25 (LP: #1959033) // CVE- url: https://ubuntu.com/security/CVE-2021-47485
  • IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
• CVE-url: https://ubuntu.com/security/CVE-2024-56602
  • net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-56601
  • net: inet: do not leave a dangling sk pointer in inet_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-56600
  • sock: struct proto hash function may error
  • net: inet6: do not leave a dangling sk pointer in inet6_create()
• CVE-url: https://ubuntu.com/security/CVE-2023-52818
  • drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
• CVE-url: https://ubuntu.com/security/CVE-2024-35887
  • ax25: fix use-after-free bugs caused by ax25_ds_del_timer
• Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE- url: https://ubuntu.com/security/CVE-2021-47404
  • HID: betop: fix slab-out-of-bounds Write in betop_probe
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47254
  • gfs2: Fix use-after-free in gfs2_glock_shrink_scan
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47506
  • nfsd: fix use-after-free due to delegation race
• CVE-url: https://ubuntu.com/security/CVE-2024-56606
  • af_packet: avoid erroring out after sock_init_data() in packet_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-53141
  • netfilter: ipset: add missing range check in bitmap_ip_uadt
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47280
  • drm: Fix use-after-free read in drm_getunique()
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47235
  • net: ethernet: fix potential use-after-free in ec_bhf_remove
• Bionic update: upstream stable patchset 2021-08-13 (LP: #1939913) // CVE- url: https://ubuntu.com/security/CVE-2021-47309
  • net: validate lwtstate->data before returning from skb_tunnel_info()
• Bionic update: upstream stable patchset 2022-01-06 (LP: #1956614) // CVE- url: https://ubuntu.com/security/CVE-2021-47549
  • sata_fsl: fix UAF in…

• CVE-url: https://ubuntu.com/security/CVE-2024-38553/CVE-2024-38597
  • netpoll: make ndo_poll_controller() optional
  • bonding: use netpoll_poll_dev() helper
  • netpoll: do not test NAPI_STATE_SCHED in poll_one_napi()
• CVE-url: https://ubuntu.com/security/CVE-2024-38597
  • eth: sungem: remove .ndo_poll_controller to avoid deadlocks
• CVE-url: https://ubuntu.com/security/CVE-2024-38553
  • net: fec: remove .ndo_poll_controller to avoid deadlocks
• CVE-url: https://ubuntu.com/security/CVE-2024-41066
  • ibmvnic: Add tx check to prevent skb leak
• CVE-url: https://ubuntu.com/security/CVE-2024-40982
  • ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
• CVE-url: https://ubuntu.com/security/CVE-2024-50154
  • tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
• CVE-url: https://ubuntu.com/security/CVE-2024-56595
  • jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
• CVE-url: https://ubuntu.com/security/CVE-2024-57896
  • btrfs: fix hang during unmount when stopping a space reclaim worker
  • btrfs: wait for fixup workers before stopping cleaner kthread during umount
  • btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
• CVE-url: https://ubuntu.com/security/CVE-2024-56598
  • jfs: array-index-out-of-bounds fix in dtReadFirst
• CVE-url: https://ubuntu.com/security/CVE-2024-56596
  • jfs: fix array-index-out-of-bounds in jfs_readdir
• Bionic update: upstream stable patchset 2022-01-25 (LP: #1959033) // CVE- url: https://ubuntu.com/security/CVE-2021-47485
  • IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
• CVE-url: https://ubuntu.com/security/CVE-2024-56602
  • net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-56601
  • net: inet: do not leave a dangling sk pointer in inet_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-56600
  • sock: struct proto hash function may error
  • net: inet6: do not leave a dangling sk pointer in inet6_create()
• CVE-url: https://ubuntu.com/security/CVE-2023-52818
  • drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
• CVE-url: https://ubuntu.com/security/CVE-2024-35887
  • ax25: fix use-after-free bugs caused by ax25_ds_del_timer
• Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE- url: https://ubuntu.com/security/CVE-2021-47404
  • HID: betop: fix slab-out-of-bounds Write in betop_probe
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47254
  • gfs2: Fix use-after-free in gfs2_glock_shrink_scan
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47506
  • nfsd: fix use-after-free due to delegation race
• CVE-url: https://ubuntu.com/security/CVE-2024-56606
  • af_packet: avoid erroring out after sock_init_data() in packet_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-53141
  • netfilter: ipset: add missing range check in bitmap_ip_uadt
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47280
  • drm: Fix use-after-free read in drm_getunique()
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47235
  • net: ethernet: fix potential use-after-free in ec_bhf_remove
• Bionic update: upstream stable patchset 2021-08-13 (LP: #1939913) // CVE- url: https://ubuntu.com/security/CVE-2021-47309
  • net: validate lwtstate->data before returning from skb_tunnel_info()
• Bionic update: upstream stable patchset 2022-01-06 (LP: #1956614) // CVE- url: https://ubuntu.com/security/CVE-2021-47549
  • sata_fsl: fix UAF in…

• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• scsi: mpt3sas: Fix kernel panic during drive powercycle test {CVE-2021-47565}
• net/sched: act_skbmod: Skip non-Ethernet packets {CVE-2021-47293}
• scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219}
• net: validate lwtstate->data before returning from skb_tunnel_info() {CVE-2021-47309}
• regmap: Fix possible double-free in regcache_rbtree_exit() {CVE-2021-47483}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() {CVE-2026-23193}
• isdn: cpai: check ctr->cnr to avoid array index out of bound {CVE-2021-3896}
• scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() {CVE-2021-47541}
• scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() {CVE-2021-47576}
• igbvf: fix double free in igbvf_probe {CVE-2021-47589}
• dm btree remove: fix use after free in rebalance_children() {CVE-2021-47600}
• RDMA/cxgb4: Do not dma memory off of the stack {CVE-2019-17075}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• smb: client: reject userspace cifs.spnego descriptions
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}

• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• dm btree remove: fix use after free in rebalance_children() {CVE-2021-47600}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• net/sched: act_skbmod: Skip non-Ethernet packets {CVE-2021-47293}
• scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219}
• drm: Fix use-after-free read in drm_getunique() {CVE-2021-47280}
• net: validate lwtstate->data before returning from skb_tunnel_info() {CVE-2021-47309}
• regmap: Fix possible double-free in regcache_rbtree_exit() {CVE-2021-47483}
• netfilter: nftables: avoid overflows in nft_hash_buckets() {CVE-2021-46992}
• ALSA: seq: Fix race of snd_seq_timer_open() {CVE-2021-47281}
• netfilter: synproxy: Fix out of bounds when parsing TCP options {CVE-2021-47245}
• scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() {CVE-2021-47576}
• net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() {CVE-2021-47541}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• ext4: fix null-ptr-deref in ext4_write_info {CVE-2022-50344}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• smb: client: reject userspace cifs.spnego descriptions
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52754: media: imon: fix access to invalid resource for the second interface (bsc#1225490).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52764: media: gspca: cpia1: shift-out-of-bounds in set_flicker (bsc#1225571).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52832: wifi: mac80211: do not return unset power in ieee80211_get_tx_power() (bsc#1225577).
• CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52754: media: imon: fix access to invalid resource for the second interface (bsc#1225490).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52764: media: gspca: cpia1: shift-out-of-bounds in set_flicker (bsc#1225571).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52832: wifi: mac80211: do not return unset power in ieee80211_get_tx_power() (bsc#1225577).
• CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52843: llc: verify mac len before…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-10135: Legacy pairing and secure-connections pairing authentication Bluetooth might have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access (bsc#1171988).
• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47145: btrfs: do not BUG_ON in link_to_fixup_dir (bsc#1222005).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47201: iavf: free q_vectors before queues in iavf_disable_vf (bsc#1222792).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47275: bcache: avoid oversized read request in cache missing code path (bsc#1224965).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47328: blacklist.conf: bsc#1225047 CVE-2021-47328: breaks kABI Also, does not apply.
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47438: net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() (bsc#1225229)
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47498: dm rq: do not queue request to blk-mq during DM suspend (bsc#1225357).
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47520: can: pch_can: pch_can_rx_normal: fix use after free (bsc#1225431).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci…