CVE-2021-47520

In the Linux kernel, the following vulnerability has been resolved: can: pch_can: pch_can_rx_normal: fix use after free After calling netif_receive_skb(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is dereferenced just after the call netif_receive_skb(skb). Reordering the lines solves the issue.

• CVE-url: https://ubuntu.com/security/CVE-2024-26777
  • fbdev: sis: Error out if pixclock equals zero
• CVE-url: https://ubuntu.com/security/CVE-2021-47542
  • net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()
• CVE-url: https://ubuntu.com/security/CVE-2021-47518
  • nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
• CVE-url: https://ubuntu.com/security/CVE-2024-36902
  • ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
• CVE-url: https://ubuntu.com/security/CVE-2024-36901
  • ipv6: prevent NULL dereference in ip6_output()
• CVE-url: https://ubuntu.com/security/CVE-2021-47571
  • staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
• CVE-url: https://ubuntu.com/security/CVE-2021-47521
  • can: sja1000: fix use after free in ems_pcmcia_add_card()
• CVE-url: https://ubuntu.com/security/CVE-2021-47520
  • can: pch_can: pch_can_rx_normal: fix use after free
• CVE-url: https://ubuntu.com/security/CVE-2024-27405
  • usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
  • usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
  • usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
• CVE-url: https://ubuntu.com/security/CVE-2024-26764
  • aio: remove an outdated BUG_ON and comment in aio_complete
  • fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
• Bionic update: upstream stable patchset 2020-09-16 (LP: #1895873) // CVE- url: https://ubuntu.com/security/CVE-2024-27405
  • USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()
• CVE-url: https://ubuntu.com/security/CVE-2024-26840
  • cachefiles: fix memory leak in cachefiles_add_cache()
• CVE-url: https://ubuntu.com/security/CVE-2024-26779
  • wifi: mac80211: fix race condition on enabling fast-xmit
• CVE-url: https://ubuntu.com/security/CVE-2024-26772
  • ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
• CVE-url: https://ubuntu.com/security/CVE-2024-26845
  • scsi: target: core: Add TMF to tmr_list handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26804
  • net: ip_tunnel: prevent perpetual headroom growth
• CVE-url: https://ubuntu.com/security/CVE-2024-27410
  • wifi: nl80211: reject iftype change with mesh ID change
• CVE-url: https://ubuntu.com/security/CVE-2024-26839
  • IB/hfi1: Fix a memleak in init_credit_return
• CVE-url: https://ubuntu.com/security/CVE-2024-26773
  • ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
• CVE-url: https://ubuntu.com/security/CVE-2024-26778
  • fbdev: savage: Error out if pixclock equals zero
• CVE-url: https://ubuntu.com/security/CVE-2024-26733
  • arp: Prevent overflow in arp_req_get().
• CVE-url: https://ubuntu.com/security/CVE-2024-26791
  • btrfs: dev-replace: properly validate device names

• CVE-url: https://ubuntu.com/security/CVE-2024-26777
  • fbdev: sis: Error out if pixclock equals zero
• CVE-url: https://ubuntu.com/security/CVE-2021-47542
  • net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()
• CVE-url: https://ubuntu.com/security/CVE-2021-47518
  • nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
• CVE-url: https://ubuntu.com/security/CVE-2024-36902
  • ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
• CVE-url: https://ubuntu.com/security/CVE-2024-36901
  • ipv6: prevent NULL dereference in ip6_output()
• CVE-url: https://ubuntu.com/security/CVE-2021-47571
  • staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
• CVE-url: https://ubuntu.com/security/CVE-2021-47521
  • can: sja1000: fix use after free in ems_pcmcia_add_card()
• CVE-url: https://ubuntu.com/security/CVE-2021-47520
  • can: pch_can: pch_can_rx_normal: fix use after free
• CVE-url: https://ubuntu.com/security/CVE-2024-27405
  • usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
  • usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
  • usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
• CVE-url: https://ubuntu.com/security/CVE-2024-26764
  • aio: remove an outdated BUG_ON and comment in aio_complete
  • fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
• Bionic update: upstream stable patchset 2020-09-16 (LP: #1895873) // CVE- url: https://ubuntu.com/security/CVE-2024-27405
  • USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()
• CVE-url: https://ubuntu.com/security/CVE-2024-26840
  • cachefiles: fix memory leak in cachefiles_add_cache()
• CVE-url: https://ubuntu.com/security/CVE-2024-26779
  • wifi: mac80211: fix race condition on enabling fast-xmit
• CVE-url: https://ubuntu.com/security/CVE-2024-26772
  • ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
• CVE-url: https://ubuntu.com/security/CVE-2024-26845
  • scsi: target: core: Add TMF to tmr_list handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26804
  • net: ip_tunnel: prevent perpetual headroom growth
• CVE-url: https://ubuntu.com/security/CVE-2024-27410
  • wifi: nl80211: reject iftype change with mesh ID change
• CVE-url: https://ubuntu.com/security/CVE-2024-26839
  • IB/hfi1: Fix a memleak in init_credit_return
• CVE-url: https://ubuntu.com/security/CVE-2024-26773
  • ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
• CVE-url: https://ubuntu.com/security/CVE-2024-26778
  • fbdev: savage: Error out if pixclock equals zero
• CVE-url: https://ubuntu.com/security/CVE-2024-26733
  • arp: Prevent overflow in arp_req_get().
• CVE-url: https://ubuntu.com/security/CVE-2024-26791
  • btrfs: dev-replace: properly validate device names

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
• CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52660: Fiedx IRQ handling due to shared interrupts (bsc#1224443).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26715: Fixed NULL pointer dereference in dwc3_gadget_suspend (bsc#1222561).
• CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes bsc#1222608).
• CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
• CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
• CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
• CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
• CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
• CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
• CVE-2024-27042: Fixed potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (bsc#1223823).
• CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).
• CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181).
• CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr() (bsc#1224721)
• CVE-2024-27419: Fixed data-races around sysctl_net_busy_read (bsc#1224759)
• CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
• CVE-2024-35791: Flush pages under…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
• CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
• CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
• CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
• CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
• CVE-2024-35904: Fixed dereference of garbage after mount failure (bsc#1224494).
• CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
• CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).

The following non-security bugs were fixed:

• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• filemap: remove use of wait bookmarks (bsc#1224085).
• idpf: extend tx watchdog timeout (bsc#1224137).
• ipvs: Fix checksumming on GSO of SCTP packets (bsc#1221958)
• powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).
• powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).
• powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).
• powerpc/powernv: Add a null pointer check to scom_debug_init_one() (bsc#1194869).
• powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV (bsc#1220492 ltc#205270).
• powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).
• powerpc: Refactor verification of MSR_RI (bsc#1223191).
• supported.conf: support tcp_dctcp module (jsc#PED-8111)

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575).
• CVE-2024-36938: Fixed NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761).
• CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2024-35998: Fixed lock ordering potential deadlock in cifs_sync_mid_result (bsc#1224549).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
• CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
• CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break() (bsc#1224668).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
• CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
• CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
• CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key() (bsc#1224667).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-35869: Guarantee refcounted children from parent session (bsc#1224679).
• CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2024-35964: Fixed not validating setsockopt user input (bsc#1224581).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
• CVE-2024-35860: struct bpf_link and bpf_link_ops kABI workaround (bsc#1224531).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).
• CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).
• CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
• CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
• CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
• CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios (bsc#1224530).
• CVE-2024-35852: Fixed memory leak when canceling rehash work (bsc#1224502).
• CVE-2024-36006: Fixed incorrect list API usage (bsc#1224541).
• CVE-2024-36007: Fixed warning during rehash (bsc#1224543).
• CVE-2024-35885: Stop interface during shutdown (bsc#1224519).
• CVE-2024-35907: Call request_irq() after NAPI initialized (bsc#1224492).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
• CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-35863: Fix potential UAF in is_valid_oplock_break() (bsc#1224763).
• CVE-2024-35867: Fix potential UAF in cifs_stats_proc_show() (bsc#1224664).
• CVE-2024-35868: Fix potential UAF in cifs_stats_proc_write() (bsc#1224678).
• CVE-2024-26928: Fix potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
• CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
• CVE-2024-35904: Avoid dereference of garbage after mount failure (bsc#1224494).
• CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
• CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).

The following non-security bugs were fixed:

• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• filemap: remove use of wait bookmarks (bsc#1224085).
• idpf: extend tx watchdog timeout (bsc#1224137).
• ipvs: Fix checksumming on GSO of SCTP packets (bsc#1221958)
• powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).
• powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).
• powerpc/powernv: Add a null pointer check to scom_debug_init_one() (bsc#1194869).
• powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV (bsc#1220492 ltc#205270).
• powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).
• powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).
• powerpc: Refactor verification of MSR_RI (bsc#1223191).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
• CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52660: Fiedx IRQ handling due to shared interrupts (bsc#1224443).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26700: Fixed drm/amd/display: Fix MST Null Ptr for RV (bsc#1222870)
• CVE-2024-26715: Fixed NULL pointer dereference in dwc3_gadget_suspend (bsc#1222561).
• CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes bsc#1222608).
• CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
• CVE-2024-26777: Error out if pixclock equals zero in fbdev/sis (bsc#1222765)
• CVE-2024-26778: Error out if pixclock equals zero in fbdev/savage (bsc#1222770)
• CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26839: Fixed a memleak in init_credit_return() (bsc#1222975)
• CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
• CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
• CVE-2024-26907: Fixed a fortify source warning while accessing Eth segment in mlx5 (bsc#1223203).
• CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
• CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
• CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
• CVE-2024-27042: Fixed potential out-of-bounds access in…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47145: btrfs: do not BUG_ON in link_to_fixup_dir (bsc#1222005).
• CVE-2021-47201: iavf: free q_vectors before queues in iavf_disable_vf (bsc#1222792).
• CVE-2021-47275: bcache: avoid oversized read request in cache missing code path (bsc#1224965).
• CVE-2021-47438: net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() (bsc#1225229)
• CVE-2021-47498: dm rq: do not queue request to blk-mq during DM suspend (bsc#1225357).
• CVE-2021-47520: can: pch_can: pch_can_rx_normal: fix use after free (bsc#1225431).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci (bsc#1220833).
• CVE-2023-52683: ACPI: LPIT: Avoid u32 multiplication overflow (bsc#1224627).
• CVE-2023-52693: ACPI: video: check for error while searching for backlight device parent (bsc#1224686).
• CVE-2023-52753: drm/amd/display: Avoid NULL dereference of timing generator (bsc#1225478).
• CVE-2023-52817: drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (bsc#1225569).
• CVE-2023-52818: drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 (bsc#1225530).
• CVE-2023-52819: drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga (bsc#1225532).
• CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2 (bsc#1221656).
• CVE-2024-26636: llc: make llc_ui_sendmsg() more robust against bonding changes (bsc#1221659).
• CVE-2024-26880: dm: call the resume method on internal suspend (bsc#1223188).
• CVE-2024-35805: dm snapshot: fix lockup in dm_exception_table_exit (bsc#1224743).
• CVE-2024-35819: soc: fsl: qbman: Use raw spinlock for cgr_lock (bsc#1224683).
• CVE-2024-35828: wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() (bsc#1224622).
• CVE-2024-35947: dyndbg: fix old BUG_ON in >control parser (bsc#1224647).
• CVE-2024-36014: drm/arm/malidp: fix a possible null pointer dereference (bsc#1225593).
• CVE-2024-36941: wifi: nl80211: do not free NULL coalescing rule (bsc#1225835).
• CVE-2024-38598: md: fix resync softlockup when bitmap size is less than array size (bsc#1226757).
• CVE-2024-38619: usb-storage: alauda: Check whether the media is initialized (bsc#1226861).
• CVE-2024-39301: net/9p: fix uninit-value in p9_client_rpc() (bsc#1226994).
• CVE-2024-39475: fbdev: savage: Handle err return when savagefb_check_var failed (bsc#1227435)

The following non-security bugs were fixed:

• PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820 integrity check (git-fixes).
• SUNRPC: Fix gss_free_in_token_pages() (git-fixes).
• SUNRPC: Fix loop termination condition in gss_free_in_token_pages() (git-fixes).
• drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (git-fixes).
• kgdb: Add kgdb_has_hit_break function (git-fixes).
• kgdb: Move the extern declaration kgdb_has_hit_break() to generic kgdb.h (git-fixes).
• net: hsr: fix placement of logical operator in a multi-line statement (bsc#1223021).
• nfs: Handle error of rpc_proc_register() in nfs_net_init() (git-fixes).
• powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() (bsc#1227487).
• sched/deadline: Fix BUG_ON condition for deboosted tasks (bsc#1227407).
• sunrpc: fix NFSACL RPC retry on soft mount (git-fixes).
• x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys (git-fixes).
• x86/boot/e820: Fix typo in e820.c comment (git-fixes).
• x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs (git-fixes).
• x86/fpu: Return proper error codes from user access functions (git-fixes).
• x86/ioremap: Fix page aligned size calculation in __ioremap_caller() (git-fixes).
• x86/kprobes: Fix kprobes instruction boudary check…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-10135: Legacy pairing and secure-connections pairing authentication Bluetooth might have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access (bsc#1171988).
• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47145: btrfs: do not BUG_ON in link_to_fixup_dir (bsc#1222005).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47201: iavf: free q_vectors before queues in iavf_disable_vf (bsc#1222792).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47275: bcache: avoid oversized read request in cache missing code path (bsc#1224965).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47328: blacklist.conf: bsc#1225047 CVE-2021-47328: breaks kABI Also, does not apply.
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47438: net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() (bsc#1225229)
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47498: dm rq: do not queue request to blk-mq during DM suspend (bsc#1225357).
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47520: can: pch_can: pch_can_rx_normal: fix use after free (bsc#1225431).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-41069: ASoC: topology: Fix route memory corruption (bsc#1228644).
• CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
• CVE-2024-40956: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list (bsc#1227810).
• CVE-2023-52885: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (bsc#1227750).
• CVE-2022-48792: scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task (bsc#1228013).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1224918).
• CVE-2021-47126: ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions (bsc#1221539).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2021-47580: scsi: scsi_debug: Fix type in min_t to avoid stack OOB (bsc#1226550).
• CVE-2021-47219: scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() (bsc#1222824).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2022-48821: misc: fastrpc: avoid double fput() on failed usercopy (bsc#1227976).
• CVE-2021-47520: can: pch_can: pch_can_rx_normal: fix use after free (bsc#1225431).
• CVE-2024-36974: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (bsc#1226519).

The following non-security bugs were fixed:

• Fix spurious WARNING caused by a qxl driver patch (bsc#1227213)
• NFS: Clean up directory array handling (bsc#1226662).
• NFS: Clean up nfs_readdir_page_filler() (bsc#1226662).
• NFS: Clean up readdir struct nfs_cache_array (bsc#1226662).
• NFS: Do not discard readdir results (bsc#1226662).
• NFS: Do not overfill uncached readdir pages (bsc#1226662).
• NFS: Do not re-read the entire page cache to find the next cookie (bsc#1226662).
• NFS: Ensure contents of struct nfs_open_dir_context are consistent (bsc#1226662).
• NFS: Fix up directory verifier races (bsc#1226662).
• NFS: Further optimisations for 'ls -l' (bsc#1226662).
• NFS: More readdir cleanups (bsc#1226662).
• NFS: Reduce number of RPC calls when doing uncached readdir (bsc#1226662).
• NFS: Reduce use of uncached readdir (bsc#1226662).
• NFS: Support larger readdir buffers (bsc#1226662).
• NFS: Use the 64-bit server readdir cookies when possible (bsc#1226662).
• NFSv4.x: by default serialize open/close operations (bsc#1223863 bsc#1227362)
• X.509: Fix the parser of extended key usage for length (bsc#1218820 bsc#1226666).
• nfs: optimise readdir cache page invalidation (bsc#1226662).
• ocfs2: fix DIO failure due to insufficient transaction credits (bsc#1216834).
• powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() (bsc#1227487).
• powerpc/rtas: clean up includes (bsc#1227487).

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743)
• CVE-2021-47580: scsi: scsi_debug: Fix type in min_t to avoid stack OOB (bsc#1226550).
• CVE-2021-47219: scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() (bsc#1222824).
• CVE-2021-47520: can: pch_can: pch_can_rx_normal: fix use after free (bsc#1225431).
• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1226575).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2024-38599: jffs2: prevent xattr node from overflowing the eraseblock (bsc#1226848).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).

The following non-security bugs were fixed:

• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• kvm: prevent kvm_clock time-warps (bsc#1197439).
• net: unix: properly re-increment inflight counter of GC discarded candidates (bsc#1223384).

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-42096: x86: stop playing stack games in profile_pc() (bsc#1228633).
• CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).
• CVE-2021-47619: i40e: Fix queues reservation for XDP (bsc#1226645).
• CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743).
• CVE-2024-42124: scsi: qedf: Make qedf_execute_tmf() non-preemptible (bsc#1228705).
• CVE-2024-42223: media: dvb-frontends: tda10048: Fix integer overflow (bsc#1228726).
• CVE-2024-42119: drm/amd/display: Skip finding free audio for unknown engine_id (bsc#1228584).
• CVE-2024-42120: drm/amd/display: Check pipe offset before setting vblank (bsc#1228588).
• CVE-2024-41095: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes (bsc#1228662).
• CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list (bsc#1228723).
• CVE-2024-41072: wifi: cfg80211: wext: add extra SIOCSIWSCAN data check (bsc#1228626).
• CVE-2024-41048: skmsg: Skip zero length skb in sk_msg_recvmsg (bsc#1228565).
• CVE-2024-40995: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830).
• CVE-2024-41044: ppp: reject claimed-as-LCP but actually malformed packets (bsc#1228530).
• CVE-2024-41066: ibmvnic: add tx check to prevent skb leak (bsc#1228640).
• CVE-2024-42093: net/dpaa2: Avoid explicit cpumask var allocation on stack (bsc#1228680).
• CVE-2024-41089: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes (bsc#1228658).
• CVE-2024-41060: drm/radeon: check bo_va->bo is non-NULL before using it (bsc#1228567).
• CVE-2022-48829: NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes (bsc#1228055).
• CVE-2022-48828: NFSD: Fix ia_size underflow (bsc#1228054).
• CVE-2022-48827: NFSD: Fix the behavior of READ near OFFSET_MAX (bsc#1228037).
• CVE-2024-41078: btrfs: qgroup: fix quota root leak after quota disable failure (bsc#1228655).
• CVE-2024-41071: wifi: mac80211: Avoid address calculations via out of bounds array indexing (bsc#1228625).
• CVE-2024-41064: powerpc/eeh: avoid possible crash when edev->pdev changes (bsc#1228599).
• CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
• CVE-2024-41081: ila: block BH in ila_output() (bsc#1228617).
• CVE-2024-40978: scsi: qedi: Fix crash while reading debugfs attribute (bsc#1227929).
• CVE-2022-48792: scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task (bsc#1228013).
• CVE-2022-48823: scsi: qedf: Fix refcount issue when LOGO is received during TMF (bsc#1228045).
• CVE-2024-41076: NFSv4: Fix memory leak in nfs4_set_security_label (bsc#1228649).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
• CVE-2024-40987: drm/amdgpu: fix UBSAN warning in kv_dpm.c (bsc#1228235).
• CVE-2022-48826: drm/vc4: Fix deadlock on DSI device attach error (bsc#1227975)
• CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
• CVE-2024-41015: ocfs2: add bounds checking to ocfs2_check_dir_entry() (bsc#1228409).
• CVE-2024-41016: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() (bsc#1228410).
• CVE-2024-41063: bluetooth: hci_core: cancel all works upon hci_unregister_dev() (bsc#1228580).
• CVE-2024-42070: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (bsc#1228470).
• CVE-2024-41070: KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() (bsc#1228581).
• CVE-2021-47405: HID: usbhid: free raw_report buffers in usbhid_stop (bsc#1225238).
• CVE-2024-40988: drm/radeon: fix UBSAN warning in kv_dpm.c (bsc#1227957).
• CVE-2024-40932: drm/exynos/vidi:…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-41069: ASoC: topology: Fix route memory corruption (bsc#1228644).
• CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
• CVE-2023-52885: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (bsc#1227750).
• CVE-2022-48792: scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task (bsc#1228013).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1224918).
• CVE-2021-47126: ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions (bsc#1221539).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2021-47580: scsi: scsi_debug: Fix type in min_t to avoid stack OOB (bsc#1226550).
• CVE-2021-47219: scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() (bsc#1222824).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bsc#1186463).
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (bsc#1179610).
• CVE-2022-48821: misc: fastrpc: avoid double fput() on failed usercopy (bsc#1227976).
• CVE-2021-47506: nfsd: fix use-after-free due to delegation race (bsc#1225404).
• CVE-2021-47520: can: pch_can: pch_can_rx_normal: fix use after free (bsc#1225431).
• CVE-2024-26583: tls: fix use-after-free on failed backlog decryption (bsc#1220185).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1226575).
• CVE-2024-36974: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (bsc#1226519).

The following non-security bugs were fixed:

• Fix spurious WARNING caused by a qxl driver patch (bsc#1227213)
• X.509: Fix the parser of extended key usage for length (bsc#1218820 bsc#1226666).
• ocfs2: fix DIO failure due to insufficient transaction credits (bsc#1216834).
• powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() (bsc#1227487).
• powerpc/rtas: clean up includes (bsc#1227487).

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (bsc#1179610).
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bsc#1186463).
• CVE-2021-47126: ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions (bsc#1221539).
• CVE-2021-47219: scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() (bsc#1222824).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1224918).
• CVE-2021-47506: nfsd: fix use-after-free due to delegation race (bsc#1225404).
• CVE-2021-47520: can: pch_can: pch_can_rx_normal: fix use after free (bsc#1225431).
• CVE-2021-47580: scsi: scsi_debug: Fix type in min_t to avoid stack OOB (bsc#1226550).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1226575).
• CVE-2022-48792: scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task (bsc#1228013).
• CVE-2022-48821: misc: fastrpc: avoid double fput() on failed usercopy (bsc#1227976).
• CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).
• CVE-2023-52885: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (bsc#1227750).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2024-36974: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (bsc#1226519).
• CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-40956: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list (bsc#1227810).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
• CVE-2024-41069: ASoC: topology: Fix route memory corruption (bsc#1228644).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743).

The following non-security bugs were fixed:

• Fix spurious WARNING caused by a qxl driver patch (bsc#1227213)
• nfs: Clean up directory array handling (bsc#1226662).
• nfs: Clean up nfs_readdir_page_filler() (bsc#1226662).
• nfs: Clean up readdir struct nfs_cache_array (bsc#1226662).
• nfs: Do not discard readdir results (bsc#1226662).
• nfs: Do not overfill uncached readdir pages (bsc#1226662).
• nfs: Do not re-read the entire page cache to find the next cookie (bsc#1226662).
• nfs: Ensure contents of struct nfs_open_dir_context are consistent (bsc#1226662).
• nfs: Fix up directory verifier races (bsc#1226662).
• nfs: Further optimisations for 'ls -l' (bsc#1226662).
• nfs: More readdir cleanups (bsc#1226662).
• nfs: Reduce number of RPC calls when doing uncached readdir (bsc#1226662).
• nfs: Reduce use of uncached readdir (bsc#1226662).
• nfs: Support larger readdir buffers (bsc#1226662).
• nfs: Use the 64-bit server readdir cookies when possible (bsc#1226662).
• nfs: optimise readdir cache page invalidation (bsc#1226662).
• nfsv4.x: by default serialize open/close operations (bsc#1223863 bsc#1227362)
• ocfs2: fix DIO failure due to insufficient transaction credits (bsc#1216834).
• powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() (bsc#1227487).
• powerpc/rtas: clean up includes (bsc#1227487).
• x.509: Fix the parser of extended key usage for length (bsc#1218820, bsc#1226666).