CVE-2022-3107

An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-165329981References: Upstream kernel(CVE-2022-20566)

An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference.(CVE-2022-3107)

Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior.(CVE-2022-3643)

An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the resources, causing denial of service or potentially crashing the system.(CVE-2022-3903)

Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).(CVE-2022-42329)

Security Fix(es):

An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input data. This flaw allows a local user to crash the system.(CVE-2022-2873)

An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the resources, causing denial of service or potentially crashing the system.(CVE-2022-3903)

An issue was discovered in the Linux kernel through 5.16-rc6. lkdtm_ARRAY_BOUNDS in drivers/misc/lkdtm/bugs.c lacks check of the return value of kmalloc() and will cause the null pointer dereference.(CVE-2022-3104)

An issue was discovered in the Linux kernel through 5.16-rc6. free_charger_irq() in drivers/power/supply/wm8350_power.c lacks free of WM8350_IRQ_CHG_FAST_RDY, which is registered in wm8350_init_charger().(CVE-2022-3111)

An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference.(CVE-2022-3107)

An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c lacks check of the return value of kzalloc() and will cause the null pointer dereference.(CVE-2022-3112)

An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will cause the null pointer dereference.(CVE-2022-3113)

An issue was discovered in the Linux kernel through 5.16-rc6. malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c lacks check of the return value of kzalloc() and will cause the null pointer dereference.(CVE-2022-3115)

An issue was discovered in the Linux kernel through 5.16-rc6. imx_register_uart_clocks in drivers/clk/imx/clk.c lacks check of the return value of kcalloc() and will cause the null pointer dereference.(CVE-2022-3114)

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past commit 2e7eab81425a(CVE-2022-2196)

An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is a heap-based buffer overflow in set_ntacl_dacl, related to use of SMB2_QUERY_INFO_HE after a malformed SMB2_SET_INFO_HE command.(CVE-2022-47942)

An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18. fs/ksmbd/smb2pdu.c lacks length validation in the non-padding case in smb2_write.(CVE-2022-47940)

An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is an out-of-bounds read and OOPS for SMB2_WRITE, when there is a large length in the zero DataOffset case.(CVE-2022-47943)

An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference.

• xen/xenbus: don't let xenbus_grant_ring() remove grants in error case {CVE-2022-23040}
• xen/xenbus: Fix granting of vmalloc'd memory
• xen/blkfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23036}
• xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23036}
• xen/blkfront: don't trust the backend response data blindly
• xen/blkfront: don't take local copy of a request from the ring page
• xen/blkfront: read response from backend only once
• net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 {CVE-2022-45919}
• media: dvb-core: Fix use-after-free due on race condition at dvb_net {CVE-2022-45886}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() {CVE-2023-4387}
• tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() {CVE-2022-1462}
• tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
• mmu_gather: Force tlb-flush VM_PFNMAP vmas {CVE-2022-39188}
• net/sched: cls_u32: Fix reference counter leak leading to overflow {CVE-2023-3609}
• netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE {CVE-2023-3117}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• xfs: verify buffer contents when we skip log replay {CVE-2023-2124}
• netfilter: nf_tables: stricter validation of element data {CVE-2022-34918}
• tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
• drm/virtio: Fix compile warnings (ents/nents) {CVE-2023-22998}
• drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling {CVE-2023-22998}
• drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init {CVE-2023-22998}
• gfs2: Don't deref jdesc in evict {CVE-2023-3212}
• drm/i915/gvt: fix double free bug in split_2MB_gtt_entry {CVE-2022-3707}
• drm/amdkfd: Check for null pointer after calling kmemdup {CVE-2022-3108}
• hv_netvsc: Add check for kvmalloc_array {CVE-2022-3107}
• sfc_ef100: potential dereference of null pointer {CVE-2022-3106}
• RDMA/uverbs: Check for null return of kmalloc_array {CVE-2022-3105}
• drm: use the lookup lock in drm_is_current_master {CVE-2022-1280}
• drm: add a locked version of drm_is_current_master {CVE-2022-1280}
• drm: serialize drm_file.master with a new spinlock {CVE-2022-1280}
• drm/vmwgfx: fix potential UAF in vmwgfx_surface.c {CVE-2022-1280}
• drm: protect drm_master pointers in drm_lease.c {CVE-2022-1280}

• xen/xenbus: don't let xenbus_grant_ring() remove grants in error case {CVE-2022-23040}
• xen/xenbus: Fix granting of vmalloc'd memory
• xen/blkfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23036}
• xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23036}
• xen/blkfront: don't trust the backend response data blindly
• xen/blkfront: don't take local copy of a request from the ring page
• xen/blkfront: read response from backend only once
• net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 {CVE-2022-45919}
• media: dvb-core: Fix use-after-free due on race condition at dvb_net {CVE-2022-45886}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() {CVE-2023-4387}
• tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() {CVE-2022-1462}
• tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
• mmu_gather: Force tlb-flush VM_PFNMAP vmas {CVE-2022-39188}
• net/sched: cls_u32: Fix reference counter leak leading to overflow {CVE-2023-3609}
• netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE {CVE-2023-3117}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• xfs: verify buffer contents when we skip log replay {CVE-2023-2124}
• netfilter: nf_tables: stricter validation of element data {CVE-2022-34918}
• tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
• drm/virtio: Fix compile warnings (ents/nents) {CVE-2023-22998}
• drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling {CVE-2023-22998}
• drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init {CVE-2023-22998}
• gfs2: Don't deref jdesc in evict {CVE-2023-3212}
• drm/i915/gvt: fix double free bug in split_2MB_gtt_entry {CVE-2022-3707}
• drm/amdkfd: Check for null pointer after calling kmemdup {CVE-2022-3108}
• hv_netvsc: Add check for kvmalloc_array {CVE-2022-3107}
• sfc_ef100: potential dereference of null pointer {CVE-2022-3106}
• RDMA/uverbs: Check for null return of kmalloc_array {CVE-2022-3105}
• drm: use the lookup lock in drm_is_current_master {CVE-2022-1280}
• drm: add a locked version of drm_is_current_master {CVE-2022-1280}
• drm: serialize drm_file.master with a new spinlock {CVE-2022-1280}
• drm/vmwgfx: fix potential UAF in vmwgfx_surface.c {CVE-2022-1280}
• drm: protect drm_master pointers in drm_lease.c {CVE-2022-1280}
• KVM: avoid NULL pointer dereference in kvm_dirty_ring_push {CVE-2022-1263}

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3435: Fixed an out-of-bounds read in fib_nh_match() of the file net/ipv4/fib_semantics.c (bsc#1204171).
• CVE-2022-4662: Fixed a recursive locking violation in usb-storage that can cause the kernel to deadlock. (bsc#1206664)
• CVE-2022-3105: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc_array. (bsc#1206398)
• CVE-2022-3108: Fixed a bug in kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c where a lack of check of the return value of kmemdup() could lead to a NULL pointer dereference. (bsc#1206389)
• CVE-2022-3106: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc. (bsc#1206397)
• CVE-2022-3107: Fixed a null pointer dereference caused by a missing check of the return value of kvmalloc_array. (bsc#1206395)
• CVE-2022-3111: Fixed a missing release of resource after effective lifetime bug caused by a missing free of the WM8350_IRQ_CHG_FAST_RDY in wm8350_init_charger. (bsc#1206394)
• CVE-2022-42328: Fixed a bug which could allow guests to trigger denial of service via the netback driver (bsc#1206114).
• CVE-2022-42329: Fixed a bug which could allow guests to trigger denial of service via the netback driver (bsc#1206113).
• CVE-2022-3643: Fixed a bug which could allow guests to trigger NIC interface reset/abort/crash via netback driver (bsc#1206113).
• CVE-2019-19083: Fixed a memory leaks in clock_source_create that could allow attackers to cause a denial of service (bsc#1157049).

The following non-security bugs were fixed:

• afs: Fix some tracing details (git-fixes).
• block: Do not reread partition table on exclusively open device (bsc#1190969).
• cuse: prevent clone (bsc#1206177).
• dt-bindings: clocks: imx8mp: Add ID for usb suspend clock (git-fixes).
• efi: Add iMac Pro 2017 to uefi skip cert quirk (git-fixes).
• fuse: do not check refcount after stealing page (bsc#1206174).
• fuse: fix the ->direct_IO() treatment of iov_iter (bsc#1206176).
• fuse: fix use after free in fuse_read_interrupt() (bsc#1206178).
• fuse: lock inode unconditionally in fuse_fallocate() (bsc#1206179).
• fuse: update attr_version counter on fuse_notify_inval_inode() (bsc#1206175).
• ipv6: ping: fix wrong checksum for large frames (bsc#1203183).
• kbuild: Unify options for BTF generation for vmlinux and modules (bsc#1204693).
• mm, page_alloc: avoid expensive reclaim when compaction may not succeed (bsc#1204250).
• net: mana: Fix race on per-CQ variable napi work_done (git-fixes).
• net: usb: cdc_ncm: do not spew notifications (git-fixes).
• net: usb: qmi_wwan: add u-blox 0x1342 composition (git-fixes).
• rtc: pcf85063: Fix reading alarm (git-fixes).
• s390/boot: add secure boot trailer (bsc#1205256 LTC#1205256).
• tracing: Add tracing_reset_all_online_cpus_unlocked() function (git-fixes).
• tracing: Delete all matched events (git-fixes).
• tracing: Free buffers when a used dynamic event is removed (git-fixes).
• usb: host: xhci-hub: fix extra endianness conversion (git-fixes).
• usbnet: move new members to end (git-fixes).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-4662: Fixed a recursive locking violation in usb-storage that can cause the kernel to deadlock. (bsc#1206664)
• CVE-2022-3564: Fixed a bug which could lead to use after free, it was found in the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. (bsc#1206073)
• CVE-2022-3108: Fixed a bug in kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c where a lack of check of the return value of kmemdup() could lead to a NULL pointer dereference. (bsc#1206389)
• CVE-2023-23454: Fixed a type confusion bug in the CBQ network scheduler which could lead to a use-after-free (bsc#1207036)
• CVE-2022-3107: Fixed a null pointer dereference caused by a missing check of the return value of kvmalloc_array. (bsc#1206395)
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).

The following non-security bugs were fixed:

• arm64: alternative: Use true and false for boolean values (git-fixes)
• arm64: cmpwait: Clear event register before arming exclusive monitor (git-fixes)
• arm64: Fix minor issues with the dcache_by_line_op macro (git-fixes)
• arm64: fix possible spectre-v1 in ptrace_hbp_get_event() (git-fixes)
• arm64: fix possible spectre-v1 write in ptrace_hbp_set_event() (git-fixes)
• arm64: ftrace: do not adjust the LR value (git-fixes)
• arm64: io: Ensure calls to delay routines are ordered against prior (git-fixes)
• arm64: io: Ensure value passed to __iormb() is held in a 64-bit (git-fixes)
• arm64: jump_label.h: use asm_volatile_goto macro instead of 'asm (git-fixes)
• arm64: make secondary_start_kernel() notrace (git-fixes)
• arm64: makefile fix build of .i file in external module case (git-fixes)
• arm64: ptrace: remove addr_limit manipulation (git-fixes)
• arm64: rockchip: Force CONFIG_PM on Rockchip systems (git-fixes)
• arm64: smp: Handle errors reported by the firmware (git-fixes)
• arm64/kvm: consistently handle host HCR_EL2 flags (git-fixes)
• Bluetooth: hci_qca: Fix the teardown problem for real (git-fixes).
• CDC-NCM: remove 'connected' log message (git-fixes).
• ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty (bsc#1207195).
• flexfiles: enforce per-mirror stateid only for v4 DSes (git-fixes).
• flexfiles: use per-mirror specified stateid for IO (git-fixes).
• fs: nfs: Fix possible null-pointer dereferences in encode_attrs() (git-fixes).
• ibmveth: Always stop tx queues during close (bsc#1065729).
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (bsc#1207168).
• kABI: mitigate new ufs_stats field (git-fixes).
• lockd: fix decoding of TEST results (git-fixes).
• media: Do not let tvp5150_get_vbi() go out of vbi_ram_default array (git-fixes).
• media: i2c: tvp5150: remove useless variable assignment in tvp5150_set_vbi() (git-fixes).
• memcg, kmem: further deprecate kmem.limit_in_bytes (bsc#1206896).
• memcg: Fix possible use-after-free in memcg_write_event_control() (bsc#1206344).
• mm, page_alloc: avoid expensive reclaim when compaction may not succeed (bsc#1204250).
• module: set MODULE_STATE_GOING state when a module fails to load (git-fixes).
• move new members of struct usbnet to end (git-fixes).
• net :sunrpc :clnt :Fix xps refcount imbalance on the error path (git-fixes).
• net: kalmia: clean up bind error path (git-fixes).
• net: kalmia: fix memory leaks (git-fixes).
• net: sched: atm: dont intepret cls results when asked to drop (bsc#1207036).
• net: sched: cbq: dont intepret cls results when asked to drop (bsc#1207036).
• net: sunrpc: Fix off-by-one issues in 'rpc_ntop6' (git-fixes).
• net: usb: asix: ax88772_bind return error when hw_reset fail (git-fixes).
• net: usb: asix: init MAC address buffers (git-fixes).
• net: usb: qmi_wwan: add Quectel EM160R-GL (git-fixes).
• net:…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3344: Fixed a flaw found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel panic in the host (L0). (bsc#1204652)
• CVE-2022-4662: Fixed a recursive locking violation in usb-storage that can cause the kernel to deadlock. (bsc#1206664)
• CVE-2022-3115: Fixed a null pointer dereference in malidp_crtc.c caused by a lack of checks of the return value of kzalloc. (bsc#1206393)
• CVE-2022-47520: Fixed an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet. (bsc#1206515)
• CVE-2022-3112: Fixed a null pointer dereference caused by a missing check of the return value of kzalloc() in vdec_helpers.c:amvdec_set_canvases. (bsc#1206399)
• CVE-2022-3564: Fixed a bug which could lead to use after free, it was found in the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. (bsc#1206073)
• CVE-2022-4379: Fixed a use-after-free vulnerability in nfs4file.c:__nfs42_ssc_open. (bsc#1206209)
• CVE-2022-3108: Fixed a bug in kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c where a lack of check of the return value of kmemdup() could lead to a NULL pointer dereference. (bsc#1206389)
• CVE-2022-3104: Fixed a null pointer dereference caused by caused by a missing check of the return value of kzalloc() in bugs.c:lkdtm_ARRAY_BOUNDS. (bsc#1206396)
• CVE-2022-3113: Fixed a null pointer dereference caused by a missing check of the return value of devm_kzalloc. (bsc#1206390)
• CVE-2022-3107: Fixed a null pointer dereference caused by a missing check of the return value of kvmalloc_array. (bsc#1206395)
• CVE-2022-3114: Fixed a null pointer dereference caused by a missing check of the return value of kcalloc. (bsc#1206391)
• CVE-2022-3111: Fixed a missing release of resource after effective lifetime bug caused by a missing free of the WM8350_IRQ_CHG_FAST_RDY in wm8350_init_charger. (bsc#1206394)
• CVE-2022-3105: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc_array. (bsc#1206398)
• CVE-2022-3106: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc. (bsc#1206397)

The following non-security bugs were fixed:

• acct: fix potential integer overflow in encode_comp_t() (git-fixes).
• ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA (git-fixes).
• ACPICA: Fix error code path in acpi_ds_call_control_method() (git-fixes).
• ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (git-fixes).
• ALSA: asihpi: fix missing pci_disable_device() (git-fixes).
• ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list (git-fixes).
• ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB (git-fixes).
• ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops (git-fixes).
• ALSA: line6: correct midi status byte when receiving data from podxt (git-fixes).
• ALSA: line6: fix stack overflow in line6_midi_transmit (git-fixes).
• ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt (git-fixes).
• ALSA: patch_realtek: Fix Dell Inspiron Plus 16 (git-fixes).
• ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT (git-fixes).
• ALSA: pcm: Set missing stop_operating flag at undoing trigger start (git-fixes).
• ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event (git-fixes).
• ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT (git-fixes).
• ALSA: usb-audio: add the quirk for KT0206 device (git-fixes).
• amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() (git-fixes).
• apparmor: fix a memleak in multi_transaction_new() (git-fixes).
• apparmor: Fix abi check to include v8 abi…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3344: Fixed a flaw found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel panic in the host (L0). (bsc#1204652)
• CVE-2022-4662: Fixed a recursive locking violation in usb-storage that can cause the kernel to deadlock. (bsc#1206664)
• CVE-2022-3115: Fixed a null pointer dereference in malidp_crtc.c caused by a lack of checks of the return value of kzalloc. (bsc#1206393)
• CVE-2022-47520: Fixed an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet. (bsc#1206515)
• CVE-2022-3112: Fixed a null pointer dereference caused by a missing check of the return value of kzalloc() in vdec_helpers.c:amvdec_set_canvases. (bsc#1206399)
• CVE-2022-3564: Fixed a bug which could lead to use after free, it was found in the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. (bsc#1206073)
• CVE-2022-4379: Fixed a use-after-free vulnerability in nfs4file.c:__nfs42_ssc_open. (bsc#1206209)
• CVE-2022-3108: Fixed a bug in kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c where a lack of check of the return value of kmemdup() could lead to a NULL pointer dereference. (bsc#1206389)
• CVE-2022-3104: Fixed a null pointer dereference caused by a missing check of the return value of kzalloc() in bugs.c:lkdtm_ARRAY_BOUNDS. (bsc#1206396)
• CVE-2022-3113: Fixed a null pointer dereference caused by a missing check of the return value of devm_kzalloc. (bsc#1206390)
• CVE-2022-3107: Fixed a null pointer dereference caused by a missing check of the return value of kvmalloc_array. (bsc#1206395)
• CVE-2022-3111: Fixed a missing release of resource after effective lifetime bug caused by a missing free of the WM8350_IRQ_CHG_FAST_RDY in wm8350_init_charger. (bsc#1206394)
• CVE-2022-3105: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc_array. (bsc#1206398)
• CVE-2022-3106: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc. (bsc#1206397)

The following non-security bugs were fixed:

• acct: fix potential integer overflow in encode_comp_t() (git-fixes).
• ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA (git-fixes).
• ACPICA: Fix error code path in acpi_ds_call_control_method() (git-fixes).
• ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (git-fixes).
• ALSA: asihpi: fix missing pci_disable_device() (git-fixes).
• ALSA: control-led: use strscpy in set_led_id() (git-fixes).
• ALSA: hda - Enable headset mic on another Dell laptop with ALC3254 (git-fixes).
• ALSA: hda: cs35l41: Check runtime suspend capability at runtime_idle (git-fixes).
• ALSA: hda: cs35l41: Do not return -EINVAL from system suspend/resume (git-fixes).
• ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list (git-fixes).
• ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list (git-fixes).
• ALSA: hda/realtek - Turn on power early (git-fixes).
• ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB (git-fixes).
• ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops (git-fixes).
• ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs do not work for a HP platform (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook (git-fixes).
• ALSA: line6: correct midi status byte when receiving data from podxt (git-fixes).
• ALSA: line6: fix stack overflow in line6_midi_transmit (git-fixes).
• ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt (git-fixes).
• ALSA: patch_realtek: Fix Dell Inspiron Plus 16 (git-fixes).
• ALSA: pcm: fix undefined behavior in bit…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3564: Fixed a bug which could lead to use after free, it was found in the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. (bsc#1206073)
• CVE-2022-3108: Fixed a bug in kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c where a lack of check of the return value of kmemdup() could lead to a NULL pointer dereference. (bsc#1206389)
• CVE-2022-4662: Fixed a recursive locking violation in usb-storage that can cause the kernel to deadlock. (bsc#1206664)
• CVE-2022-3107: Fixed a null pointer dereference caused by a missing check of the return value of kvmalloc_array. (bsc#1206395)

The following non-security bugs were fixed:

• arm64: alternative: Use true and false for boolean values (git-fixes)
• arm64: cmpwait: Clear event register before arming exclusive monitor (git-fixes)
• arm64: Fix minor issues with the dcache_by_line_op macro (git-fixes)
• arm64: fix possible spectre-v1 in ptrace_hbp_get_event() (git-fixes)
• arm64: fix possible spectre-v1 write in ptrace_hbp_set_event() (git-fixes)
• arm64: ftrace: do not adjust the LR value (git-fixes)
• arm64: io: Ensure calls to delay routines are ordered against prior (git-fixes)
• arm64: io: Ensure value passed to __iormb() is held in a 64-bit (git-fixes)
• arm64: jump_label.h: use asm_volatile_goto macro instead of 'asm (git-fixes)
• arm64: make secondary_start_kernel() notrace (git-fixes)
• arm64: makefile fix build of .i file in external module case (git-fixes)
• arm64: ptrace: remove addr_limit manipulation (git-fixes)
• arm64: rockchip: Force CONFIG_PM on Rockchip systems (git-fixes)
• arm64: smp: Handle errors reported by the firmware (git-fixes)
• arm64/kvm: consistently handle host HCR_EL2 flags (git-fixes)
• Bluetooth: hci_qca: Fix the teardown problem for real (git-fixes).
• CDC-NCM: remove 'connected' log message (git-fixes).
• flexfiles: enforce per-mirror stateid only for v4 DSes (git-fixes).
• flexfiles: use per-mirror specified stateid for IO (git-fixes).
• fs: nfs: Fix possible null-pointer dereferences in encode_attrs() (git-fixes).
• ibmveth: Always stop tx queues during close (bsc#1065729).
• kABI: mitigate new ufs_stats field (git-fixes).
• lockd: fix decoding of TEST results (git-fixes).
• media: Do not let tvp5150_get_vbi() go out of vbi_ram_default array (git-fixes).
• media: i2c: tvp5150: remove useless variable assignment in tvp5150_set_vbi() (git-fixes).
• memcg, kmem: further deprecate kmem.limit_in_bytes (bsc#1206896).
• memcg: Fix possible use-after-free in memcg_write_event_control() (bsc#1206344).
• mm, page_alloc: avoid expensive reclaim when compaction may not succeed (bsc#1204250).
• move new members of struct usbnet to end (git-fixes).
• net :sunrpc :clnt :Fix xps refcount imbalance on the error path (git-fixes).
• net: kalmia: clean up bind error path (git-fixes).
• net: kalmia: fix memory leaks (git-fixes).
• net: sunrpc: Fix off-by-one issues in 'rpc_ntop6' (git-fixes).
• net: usb: asix: ax88772_bind return error when hw_reset fail (git-fixes).
• net: usb: asix: init MAC address buffers (git-fixes).
• net: usb: qmi_wwan: add Quectel EM160R-GL (git-fixes).
• net: usb: qmi_wwan: add Telit 0x103a composition (git-fixes).
• net: usb: qmi_wwan: Add the BroadMobi BM818 card (git-fixes).
• net: usb: qmi_wwan: add u-blox 0x1342 composition (git-fixes).
• net: usb: qmi_wwan: restore mtu min/max values after raw_ip switch (git-fixes).
• net: usb: qmi_wwan: Set DTR quirk for MR400 (git-fixes).
• net: usb: rtl8150: demote allmulti message to dev_dbg() (git-fixes).
• net: xfrm: fix compress vs decompress serialization (SLE Realtime Extension, bsc#1174298, bsc#1204667).
• net/usb/kalmia: use ARRAY_SIZE for various array sizing calculations (git-fixes).
• net/xfrm/input: Protect queue with lock (SLE Realtime Extension, bsc#1174299, bsc#1204667).…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3344: Fixed a bug where nested shutdown interception could lead to host crash (bsc#1204652)
• CVE-2022-4662: Fixed a recursive locking violation in usb-storage that can cause the kernel to deadlock. (bsc#1206664)
• CVE-2022-3115: Fixed a null pointer dereference in malidp_crtc.c caused by a lack of checks of the return value of kzalloc. (bsc#1206393)
• CVE-2022-47520: Fixed an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet. (bsc#1206515)
• CVE-2022-3112: Fixed a null pointer dereference caused by lacks check of the return value of kzalloc() in vdec_helpers.c:amvdec_set_canvases. (bsc#1206399)
• CVE-2022-3564: Fixed a bug which could lead to use after free, it was found in the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. (bsc#1206073)
• CVE-2022-4379: Fixed a use-after-free vulnerability in nfs4file.c:__nfs42_ssc_open. (bsc#1206209)
• CVE-2022-3108: Fixed a bug in kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c where a lack of check of the return value of kmemdup() could lead to a NULL pointer dereference. (bsc#1206389)
• CVE-2022-3104: Fixed a null pointer dereference caused by caused by a missing check of the return value of kzalloc() in bugs.c:lkdtm_ARRAY_BOUNDS. (bsc#1206396)
• CVE-2022-3113: Fixed a null pointer dereference caused by a missing check of the return value of devm_kzalloc. (bsc#1206390)
• CVE-2022-3107: Fixed a null pointer dereference caused by a missing check of the return value of kvmalloc_array. (bsc#1206395)
• CVE-2022-3114: Fixed a null pointer dereference caused by a missing check of the return value of kcalloc. (bsc#1206391)
• CVE-2022-3111: Fixed a missing release of resource after effective lifetime bug caused by a missing free of the WM8350_IRQ_CHG_FAST_RDY in wm8350_init_charger. (bsc#1206394)
• CVE-2022-3105: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc_array. (bsc#1206398)
• CVE-2022-3106: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc. (bsc#1206397)

The following non-security bugs were fixed:

• acct: fix potential integer overflow in encode_comp_t() (git-fixes).
• ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA (git-fixes).
• ACPICA: Fix error code path in acpi_ds_call_control_method() (git-fixes).
• ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (git-fixes).
• ALSA: asihpi: fix missing pci_disable_device() (git-fixes).
• ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list (git-fixes).
• ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB (git-fixes).
• ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops (git-fixes).
• ALSA: line6: correct midi status byte when receiving data from podxt (git-fixes).
• ALSA: line6: fix stack overflow in line6_midi_transmit (git-fixes).
• ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt (git-fixes).
• ALSA: patch_realtek: Fix Dell Inspiron Plus 16 (git-fixes).
• ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT (git-fixes).
• ALSA: pcm: Set missing stop_operating flag at undoing trigger start (git-fixes).
• ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event (git-fixes).
• ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT (git-fixes).
• ALSA: usb-audio: add the quirk for KT0206 device (git-fixes).
• amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() (git-fixes).
• apparmor: fix a memleak in multi_transaction_new() (git-fixes).
• apparmor: Fix abi check to include v8 abi (git-fixes).
• apparmor: fix lockdep warning when removing a namespace (git-fixes).
• apparmor: Fix memleak in alloc_ns() (git-fixes).
• apparmor: Use pointer to struct…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-0266: Fixed a use-after-free bug led by a missing lock in ALSA. (bsc#1207134)
• CVE-2022-47929: Fixed a NULL pointer dereference bug in the traffic control subsystem which allowed an unprivileged user to trigger a denial of service via a crafted traffic control configuration. (bsc#1207237)
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036)
• CVE-2023-23455: Fixed a bug that could allow attackers to cause a denial of service because of type confusion in atm_tc_enqueue. (bsc#1207125)
• CVE-2022-3435: Fixed an out-of-bounds read in fib_nh_match() of the file net/ipv4/fib_semantics.c (bsc#1204171).
• CVE-2022-4662: Fixed a recursive locking violation in usb-storage that can cause the kernel to deadlock. (bsc#1206664)
• CVE-2022-3115: Fixed a null pointer dereference in malidp_crtc.c caused by a lack of checks of the return value of kzalloc. (bsc#1206393)
• CVE-2022-47520: Fixed an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet. (bsc#1206515)
• CVE-2022-3112: Fixed a null pointer dereference caused by lacks check of the return value of kzalloc() in vdec_helpers.c:amvdec_set_canvases. (bsc#1206399)
• CVE-2022-3564: Fixed a bug which could lead to use after free, it was found in the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. (bsc#1206073)
• CVE-2022-3108: Fixed a bug in kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c where a lack of check of the return value of kmemdup() could lead to a NULL pointer dereference. (bsc#1206389)
• CVE-2019-19083: Fixed a memory leaks in clock_source_create that could allow attackers to cause a denial of service (bsc#1157049).
• CVE-2022-42328: Fixed a bug which could allow guests to trigger denial of service via the netback driver (bsc#1206114).
• CVE-2022-42329: Fixed a bug which could allow guests to trigger denial of service via the netback driver (bsc#1206113).
• CVE-2022-3643: Fixed a bug which could allow guests to trigger NIC interface reset/abort/crash via netback driver (bsc#1206113).
• CVE-2022-3107: Fixed a null pointer dereference caused by a missing check of the return value of kvmalloc_array. (bsc#1206395)
• CVE-2022-3111: Fixed a missing release of resource after effective lifetime bug caused by a missing free of the WM8350_IRQ_CHG_FAST_RDY in wm8350_init_charger. (bsc#1206394)
• CVE-2022-3105: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc_array. (bsc#1206398)
• CVE-2022-3106: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc. (bsc#1206397)

The following non-security bugs were fixed:

• afs: Fix some tracing details (git-fixes).
• arm64: cpu_errata: Add Hisilicon TSV110 to spectre-v2 safe list (git-fixes)
• arm64: dts: allwinner: H5: Add PMU node (git-fixes)
• arm64: dts: allwinner: H6: Add PMU mode (git-fixes)
• arm64: dts: marvell: Add AP806-dual missing CPU clocks (git-fixes)
• arm64: dts: rockchip: add reg property to brcmf sub-nodes (git-fixes)
• arm64: dts: rockchip: fix dwmmc clock name for px30 (git-fixes)
• arm64: dts: rockchip: Fix NanoPC-T4 cooling maps (git-fixes)
• arm64: memory: Add missing brackets to untagged_addr() macro (git-fixes)
• arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() (git-fixes).
• arm64: tags: Preserve tags for addresses translated via TTBR1 (git-fixes)
• arm64: tegra: Fix 'active-low' warning for Jetson Xavier regulator (git-fixes)
• block: Do not reread partition table on exclusively open device (bsc#1190969).
• ceph: avoid putting the realm twice when decoding snaps fails (bsc#1207198).
• ceph: do not update snapshot context when there is no new snapshot (bsc#1207218).
• cuse: prevent clone (bsc#1206177).
• drbd: destroy workqueue when drbd device…

The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23454: Fixed denial or service in cbq_classify in net/sched/sch_cbq.c (bnc#1207036).
• CVE-2023-0266: Fixed a use-after-free vulnerability inside the ALSA PCM package. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 was missing locks that could have been used in a use-after-free that could have resulted in a priviledge escalation to gain ring0 access from the system user (bsc#1207134).
• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bnc#1207237).
• CVE-2022-47520: Fixed a out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet in the WILC1000 wireless driver (bsc#1206515).
• CVE-2022-4662: Fixed incorrect access control in the USB core subsystem that could lead a local user to crash the system (bnc#1206664).
• CVE-2022-42328, CVE-2022-42329: Fixed deadlock inside the netback driver that could have been triggered from a VM guest (bnc#1206114).
• CVE-2022-3643: Fixed reset/abort/crash via netback from VM guest (bnc#1206113).
• CVE-2022-3564: Fixed use-after-free in l2cap_core.c of the Bluetooth component (bnc#1206073).
• CVE-2022-3435: Fixed a out-of-bounds read in function fib_nh_match of the file net/ipv4/fib_semantics.c. It is possible to initiate the attack remotely (bnc#1204171).
• CVE-2022-3115: Fixed a null pointer dereference inside malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c that lacked a check of the return value of kzalloc() (bnc#1206393).
• CVE-2022-3112: Fixed a null pointer dereference in amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c that lacked a check of the return value of kzalloc() (bnc#1206399).
• CVE-2022-3108: Fixed missing check of return value of kmemdup() (bnc#1206389).
• CVE-2022-3107: Fixed missing check of return value of kvmalloc_array() (bnc#1206395).
• CVE-2022-3105: Fixed missing check of kmalloc_array() in uapi_finalize in drivers/infiniband/core/uverbs_uapi.c (bnc#1206398).

The following non-security bugs were fixed:

• HID: betop: check shape of output reports (git-fixes, bsc#1207186).
• HID: check empty report_list in bigben_probe() (git-fixes, bsc#1206784).
• HID: check empty report_list in hid_validate_values() (git-fixes, bsc#1206784).
• NFS: Handle missing attributes in OPEN reply (bsc#1203740).
• constraints: increase disk space for all architectures (bsc#1203693).
• ipv6: ping: fix wrong checksum for large frames (bsc#1203183).
• mm: /proc/pid/smaps_rollup: fix no vma's null-deref (bsc#1207769).
• net: sched: atm: dont intepret cls results when asked to drop (bsc#1207036).
• net: sched: cbq: dont intepret cls results when asked to drop (bsc#1207036).
• netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() (bsc#1204614).
• rpm: suse-kernel-rpm-scriptlets to kmp buildreqs (boo#1205149).
• sctp: fail if no bound addresses can be used for a given scope (bsc#1206677).
• sctp: sysctl: make extra pointers netns aware (bsc#1204760).

The SUSE Linux Enterprise 15 SP1 kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3107: Fixed missing check of return value of kvmalloc_array() (bnc#1206395).
• CVE-2022-3108: Fixed missing check of return value of kmemdup() (bnc#1206389).
• CVE-2022-3564: Fixed use-after-free in l2cap_core.c of the Bluetooth component (bnc#1206073).
• CVE-2022-4662: Fixed incorrect access control in the USB core subsystem that could lead a local user to crash the system (bnc#1206664).
• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bnc#1207237).
• CVE-2023-23454: Fixed denial or service in cbq_classify in net/sched/sch_cbq.c (bnc#1207036).

The following non-security bugs were fixed:

• Added support for enabling livepatching related packages on -RT (jsc#PED-1706).
• Added suse-kernel-rpm-scriptlets to kmp buildreqs (boo#1205149).
• HID: betop: check shape of output reports (git-fixes, bsc#1207186).
• HID: betop: fix slab-out-of-bounds Write in betop_probe (git-fixes, bsc#1207186).
• HID: check empty report_list in hid_validate_values() (git-fixes, bsc#1206784).
• Reverted 'constraints: increase disk space for all architectures' (bsc#1203693)
• net: sched: atm: dont intepret cls results when asked to drop (bsc#1207036).
• net: sched: cbq: dont intepret cls results when asked to drop (bsc#1207036).
• sctp: fail if no bound addresses can be used for a given scope (bsc#1206677).

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-23454: Fixed denial or service in cbq_classify in net/sched/sch_cbq.c (bnc#1207036).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2023-0266: Fixed a use-after-free vulnerability inside the ALSA PCM package. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 was missing locks that could have been used in a use-after-free that could have resulted in a priviledge escalation to gain ring0 access from the system user (bsc#1207134).
• CVE-2023-0045: Fixed flush IBP in ib_prctl_set() (bsc#1207773).
• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bnc#1207237).
• CVE-2022-4662: Fixed incorrect access control in the USB core subsystem that could lead a local user to crash the system (bnc#1206664).
• CVE-2022-36280: Fixed an out-of-bounds memory access vulnerability that was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c (bnc#1203332).
• CVE-2022-3564: Fixed use-after-free in l2cap_core.c of the Bluetooth component (bnc#1206073).
• CVE-2022-3108: Fixed missing check of return value of kmemdup() (bnc#1206389).
• CVE-2022-3107: Fixed missing check of return value of kvmalloc_array() (bnc#1206395).

The following non-security bugs were fixed:

• Bluetooth: hci_qca: Fix the teardown problem for real (git-fixes).
• CDC-NCM: remove 'connected' log message (git-fixes).
• HID: betop: check shape of output reports (git-fixes, bsc#1207186).
• HID: betop: fix slab-out-of-bounds Write in betop_probe (git-fixes, bsc#1207186).
• HID: check empty report_list in hid_validate_values() (git-fixes, bsc#1206784).
• Input: convert autorepeat timer to use timer_setup() (git-fixes).
• Input: do not use WARN() in input_alloc_absinfo() (git-fixes).
• Input: i8042 - Add quirk for Fujitsu Lifebook T725 (git-fixes).
• Input: iforce - reformat the packet dump output (git-fixes).
• Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag (git-fixes).
• Input: replace hard coded string with func in pr_err() (git-fixes).
• Input: switch to using sizeof(*type) when allocating memory (git-fixes).
• Input: use seq_putc() in input_seq_print_bitmap() (git-fixes).
• Input: use seq_puts() in input_devices_seq_show() (git-fixes).
• Makefile: link with -z noexecstack --no-warn-rwx-segments (bsc#1203200).
• NFS Handle missing attributes in OPEN reply (bsc#1203740).
• NFS: Correct size calculation for create reply length (git-fixes).
• NFS: Fix an Oops in nfs_d_automount() (git-fixes).
• NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup (git-fixes).
• NFS: Fix memory leaks in nfs_pageio_stop_mirroring() (git-fixes).
• NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails (git-fixes).
• NFS: nfs_compare_mount_options always compare auth flavors (git-fixes).
• NFS: nfs_find_open_context() may only select open files (git-fixes).
• NFS: swap IO handling is slightly different for O_DIRECT IO (git-fixes).
• NFS: swap-out must always use STABLE writes (git-fixes).
• NFSD: Keep existing listeners on portlist error (git-fixes).
• NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data (git-fixes).
• NFSv2: Fix eof handling (git-fixes).
• NFSv2: Fix write regression (git-fixes).
• NFSv4 expose nfs_parse_server_name function (git-fixes).
• NFSv4 only print the label when its queried (git-fixes).
• NFSv4 remove zero number of fs_locations entries error check (git-fixes).
• NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation recall (git-fixes).
• NFSv4.1: Fix uninitialised variable in devicenotify (git-fixes).
• NFSv4.1: Handle RECLAIM_COMPLETE trunking errors (git-fixes).
• NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot (git-fixes). -…