CVE-2022-4139

The Linux Kernel, the operating system core itself.

Security Fix(es):

An incorrect TLB flush issue was found in the Linux kernel?s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system.(CVE-2022-4139)

An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets.(CVE-2022-45934)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Rocky Linux8.4 - zfcp: fix missing auto port scan and thus missing target ports (BZ#2127849)

• vfio zero page mappings fail after 2M instances (BZ#2128515)

• ice: Driver Update up to 5.19 (BZ#2130992)

• atlantic: missing hybernate/resume fixes (BZ#2131935)

• Bluefield 2 DPU would crash and reboot due to a kernel panic (BZ#2134084)

• Fix issue that enables STABLE_WRITES by default and causes performance regressions (BZ#2135813)

• ice: Intel E810 PTP clock glitching (BZ#2136036)

• ice: configure link-down-on-close on and change interface mtu to 9000,the interface can't up (BZ#2136216)

• ice: dump additional CSRs for Tx hang debugging (BZ#2136513)

• ice,iavf: system panic during sriov sriov_test_cntvf_reboot testing (BZ#2137270)

• After upgrading to ocp4.11.1, our dpdk application using vlan strip offload is not working (BZ#2138157)

• i40e: orphaned-leaky memory when interacting with driver memory parameters (BZ#2138205)

• WARNING: CPU: 0 PID: 9637 at kernel/time/hrtimer.c:1309 hrtimer_start_range_ns+0x35d/0x400 (BZ#2138953)

• DELL EMC 8.6-RT: System is not booting into RT Kernel with perc12. (BZ#2139216)

• Lenovo 8.7: The VGA display shows no signal when install Rocky Linux8.7 (BZ#2140152)

• Host Pod -> NodePort Service traffic (Host Backend - Same Node) Flow Iperf Cannot Pass Traffic (BZ#2141878)

• mlx5_core: mlx5_cmd_check messages scrolling with hardware offload enabled (BZ#2141957)

• net/ice: VIRTCHNL_OP_CONFIG_VSI_QUEUES command handling failure with in-tree driver (BZ#2142017)

• Rocky Linux:8.6+ IBM Partner issue - Loopback driver with ABORT_TASKS causing hangs in scsi eh, this bug was cloned for Rocky Linux8.6 and need this patch in 8.6+ (BZ#2144583)

• AMdCLIENT 8.8: The kernel command line parameter "nomodeset" not working properly (BZ#2145218)

• Path loss during Volume Ownership Change on Rocky Linux 8.7 SAS (BZ#2147374)

• net/ice: OP_SET_RSS_HENA command not supported with in-tree driver (BZ#2148130)

• iavf panic: iavf 0000:ca:01.0: Failed to init adminq: -53 (BZ#2149081)

• Intel 8.8 iavf: Driver Update (bugfixes) (BZ#2149742)

• Azure Rocky Linux-8 PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150912)

• Rocky Linux-8.7: System fails to boot with soft lockup while loading/unloading an unsigned (E) kernel module. (BZ#2152206)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• The latest Rocky Linux 8.7.z1 kernel changes need to be merged into the RT source tree to keep source parity between the two kernels. (BZ#2137411)

• [DELL EMC 8.6-RT BUG] System is not booting into RT Kernel with perc12. (BZ#2139867)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)

• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• DELL EMC: System is not booting into RT Kernel with perc12 [kernel-rt] (BZ#2139863)

• kernel-rt: update RT source tree to the latest Rocky Linux-9.1.z1 Batch (BZ#2141817)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)

• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel 9.2: Important iavf bug fixes (BZ#2127884)

• vfio zero page mappings fail after 2M instances (BZ#2128514)

• nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359)

• ice: Driver Update to 5.19 (BZ#2132070)

• WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588)

• drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619)

• updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914)

• DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213)

• No signal showed in the VGA monitor when installing Rocky Linux9 in the legacy bios mode (BZ#2140153)

• Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142168)

• ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976)

• fatal error: error in backend: Branch target out of insn range (BZ#2144902)

• AMdCLIENT: The kernel command line parameter "nomodeset" not working properly (BZ#2145217)

• Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910)

• Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2151605)

• DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress (BZ#2154407)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Rocky Linux SIG Cloud8.4 - zfcp: fix missing auto port scan and thus missing target ports (BZ#2127849)

• vfio zero page mappings fail after 2M instances (BZ#2128515)

• ice: Driver Update up to 5.19 (BZ#2130992)

• atlantic: missing hybernate/resume fixes (BZ#2131935)

• Bluefield 2 DPU would crash and reboot due to a kernel panic (BZ#2134084)

• Fix issue that enables STABLE_WRITES by default and causes performance regressions (BZ#2135813)

• ice: Intel E810 PTP clock glitching (BZ#2136036)

• ice: configure link-down-on-close on and change interface mtu to 9000,the interface can't up (BZ#2136216)

• ice: dump additional CSRs for Tx hang debugging (BZ#2136513)

• ice,iavf: system panic during sriov sriov_test_cntvf_reboot testing (BZ#2137270)

• After upgrading to ocp4.11.1, our dpdk application using vlan strip offload is not working (BZ#2138157)

• i40e: orphaned-leaky memory when interacting with driver memory parameters (BZ#2138205)

• WARNING: CPU: 0 PID: 9637 at kernel/time/hrtimer.c:1309 hrtimer_start_range_ns+0x35d/0x400 (BZ#2138953)

• DELL EMC 8.6-RT: System is not booting into RT Kernel with perc12. (BZ#2139216)

• Lenovo 8.7: The VGA display shows no signal when install Rocky Linux SIG Cloud8.7 (BZ#2140152)

• Host Pod -> NodePort Service traffic (Host Backend - Same Node) Flow Iperf Cannot Pass Traffic (BZ#2141878)

• mlx5_core: mlx5_cmd_check messages scrolling with hardware offload enabled (BZ#2141957)

• net/ice: VIRTCHNL_OP_CONFIG_VSI_QUEUES command handling failure with in-tree driver (BZ#2142017)

• Rocky Linux SIG Cloud:8.6+ IBM Partner issue - Loopback driver with ABORT_TASKS causing hangs in scsi eh, this bug was cloned for Rocky Linux SIG Cloud8.6 and need this patch in 8.6+ (BZ#2144583)

• AMdCLIENT 8.8: The kernel command line parameter "nomodeset" not working properly (BZ#2145218)

• Path loss during Volume Ownership Change on Rocky Linux SIG Cloud 8.7 SAS (BZ#2147374)

• net/ice: OP_SET_RSS_HENA command not supported with in-tree driver (BZ#2148130)

• iavf panic: iavf 0000:ca:01.0: Failed to init adminq: -53 (BZ#2149081)

• Intel 8.8 iavf: Driver Update (bugfixes) (BZ#2149742)

• Azure Rocky Linux SIG Cloud-8 PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150912)

• Rocky Linux SIG Cloud-8.7: System fails to boot with soft lockup while loading/unloading an unsigned (E) kernel module. (BZ#2152206)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)

• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel 9.2: Important iavf bug fixes (BZ#2127884)

• vfio zero page mappings fail after 2M instances (BZ#2128514)

• nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359)

• ice: Driver Update to 5.19 (BZ#2132070)

• WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588)

• drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619)

• updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914)

• DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213)

• No signal showed in the VGA monitor when installing Rocky Linux SIG Cloud9 in the legacy bios mode (BZ#2140153)

• Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142168)

• ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976)

• fatal error: error in backend: Branch target out of insn range (BZ#2144902)

• AMdCLIENT: The kernel command line parameter "nomodeset" not working properly (BZ#2145217)

• Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910)

• Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2151605)

• DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress (BZ#2154407)

An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)
• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• AlmaLinux8.4 - zfcp: fix missing auto port scan and thus missing target ports (BZ#2127849)
• vfio zero page mappings fail after 2M instances (BZ#2128515)
• ice: Driver Update up to 5.19 (BZ#2130992)
• atlantic: missing hybernate/resume fixes (BZ#2131935)
• Bluefield 2 DPU would crash and reboot due to a kernel panic (BZ#2134084)
• Fix issue that enables STABLE_WRITES by default and causes performance regressions (BZ#2135813)
• ice: Intel E810 PTP clock glitching (BZ#2136036)
• ice: configure link-down-on-close on and change interface mtu to 9000,the interface can't up (BZ#2136216)
• ice: dump additional CSRs for Tx hang debugging (BZ#2136513)
• ice,iavf: system panic during sriov sriov_test_cntvf_reboot testing (BZ#2137270)
• After upgrading to ocp4.11.1, our dpdk application using vlan strip offload is not working (BZ#2138157)
• i40e: orphaned-leaky memory when interacting with driver memory parameters (BZ#2138205)
• WARNING: CPU: 0 PID: 9637 at kernel/time/hrtimer.c:1309 hrtimer_start_range_ns+0x35d/0x400 (BZ#2138953)
• DELL EMC 8.6-RT: System is not booting into RT Kernel with perc12. (BZ#2139216)
• Lenovo 8.7: The VGA display shows no signal when install AlmaLinux8.7 (BZ#2140152)
• Host Pod -> NodePort Service traffic (Host Backend - Same Node) Flow Iperf Cannot Pass Traffic (BZ#2141878)
• mlx5_core: mlx5_cmd_check messages scrolling with hardware offload enabled (BZ#2141957)
• net/ice: VIRTCHNL_OP_CONFIG_VSI_QUEUES command handling failure with in-tree driver (BZ#2142017)
• AlmaLinux:8.6+ IBM Partner issue - Loopback driver with ABORT_TASKS causing hangs in scsi eh, this bug was cloned for AlmaLinux8.6 and need this patch in 8.6+ (BZ#2144583)
• AMdCLIENT 8.8: The kernel command line parameter "nomodeset" not working properly (BZ#2145218)
• Path loss during Volume Ownership Change on AlmaLinux 8.7 SAS (BZ#2147374)
• net/ice: OP_SET_RSS_HENA command not supported with in-tree driver (BZ#2148130)
• iavf panic: iavf 0000:ca:01.0: Failed to init adminq: -53 (BZ#2149081)
• Intel 8.8 iavf: Driver Update (bugfixes) (BZ#2149742)
• Azure AlmaLinux-8 PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150912)
• AlmaLinux-8.7: System fails to boot with soft lockup while loading/unloading an unsigned (E) kernel module. (BZ#2152206)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)
• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• The latest AlmaLinux 8.7.z1 kernel changes need to be merged into the RT source tree to keep source parity between the two kernels. (BZ#2137411)
• [DELL EMC 8.6-RT BUG] System is not booting into RT Kernel with perc12. (BZ#2139867)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)
• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)
• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)
• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)
• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)
• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• DELL EMC: System is not booting into RT Kernel with perc12 [kernel-rt] (BZ#2139863)
• kernel-rt: update RT source tree to the latest AlmaLinux-9.1.z1 Batch (BZ#2141817)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)
• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)
• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)
• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)
• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)
• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel 9.2: Important iavf bug fixes (BZ#2127884)
• vfio zero page mappings fail after 2M instances (BZ#2128514)
• nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359)
• ice: Driver Update to 5.19 (BZ#2132070)
• WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588)
• drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619)
• updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914)
• DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213)
• No signal showed in the VGA monitor when installing AlmaLinux9 in the legacy bios mode (BZ#2140153)
• Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142168)
• ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976)
• fatal error: error in backend: Branch target out of insn range (BZ#2144902)
• AMdCLIENT: The kernel command line parameter "nomodeset" not working properly (BZ#2145217)
• Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910)
• Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2151605)
• DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress (BZ#2154407)

• ALSA: pcm: Fix races among concurrent prealloc proc writes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent read/write and buffer changes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent hw_params and hw_free calls {CVE-2022-1048}
• x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit {CVE-2022-25265}
• x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK {CVE-2022-25265}
• x86/elf: Add table to document READ_IMPLIES_EXEC {CVE-2022-25265}
• drm/i915: fix TLB invalidation for Gen12 video and compute engines {CVE-2022-4139}
• drm/i915: Flush TLBs before releasing backing store {CVE-2022-0330}
• xfs: fix up non-directory creation in SGID directories {CVE-2021-4037}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: Fix data races around sk->sk_prot. {CVE-2022-3567}
• ipv6: annotate some data-races around sk->sk_prot {CVE-2022-3567}
• ipv6: use indirect call wrappers for {tcp, udpv6}_{recv, send}msg() {CVE-2022-3567}
• netfilter: nf_tables: deactivate anonymous set from preparation phase {CVE-2023-32233}
• netfilter: nf_tables: bogus EBUSY when deleting set after flush
• media: dmxdev: fix UAF when dvb_register_device() fails {CVE-2022-41218}
• l2tp: Don't sleep and disable BH under writer-side sk_callback_lock {CVE-2022-4129}
• l2tp: Serialize access to sk_user_data with sk_callback_lock {CVE-2022-4129}
• net: fix a concurrency bug in l2tp_tunnel_register() {CVE-2022-4129}
• Bluetooth: L2CAP: Fix memory leak in vhci_write {CVE-2022-3619}
• Bluetooth: L2CAP: Fix handling fragmented length
• wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() {CVE-2022-3628}
• wifi: cfg80211: avoid nontransmitted BSS list corruption {CVE-2022-42721}
• cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
• wifi: cfg80211: fix BSS refcounting bugs {CVE-2022-42720}
• cfg80211: hold bss_lock while updating nontrans_list
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF {CVE-2023-0266}
• ALSA: control: Drop superfluous snd_power_wait() calls
• ALSA: control: Track in-flight control read/write/tlv accesses
• ALSA: control - introduce snd_ctl_notify_one() helper
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu {CVE-2022-3564}
• netfilter: nf_conntrack_irc: Tighten matching on DCC message {CVE-2022-2663}
• netfilter: nf_conntrack_irc: Fix forged IP logic {CVE-2022-2663}
• KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() {CVE-2022-2153}
• KVM: Add infrastructure and macro to mark VM as bugged
• KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID {CVE-2022-1789}
• tcp/udp: Fix memory leak in ipv6_renew_options(). {CVE-2022-3524}
• proc: proc_skip_spaces() shouldn't think it is working on C strings {CVE-2022-4378}
• proc: avoid integer type confusion in get_proc_long {CVE-2022-4378}
• wifi: mac80211: fix crash in beacon protection for P2P-device {CVE-2022-42722}
• net: sched: cbq: dont intepret cls results when asked to drop {CVE-2023-23454}
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames {CVE-2023-0394}
• net: sched: disallow noqueue for qdisc classes {CVE-2022-47929}
• wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() {CVE-2022-41674}
• af_key: Do not call xfrm_probe_algs in parallel {CVE-2022-3028}
• dm verity: set DM_TARGET_IMMUTABLE feature flag {CVE-2022-20572}

• ALSA: pcm: Fix races among concurrent prealloc proc writes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent read/write and buffer changes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent hw_params and hw_free calls {CVE-2022-1048}
• x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit {CVE-2022-25265}
• x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK {CVE-2022-25265}
• x86/elf: Add table to document READ_IMPLIES_EXEC {CVE-2022-25265}
• KVM: SEV-ES: fix another issue with string I/O VMGEXITs {CVE-2021-4093}
• KVM: SEV-ES: go over the sev_pio_data buffer in multiple passes if needed {CVE-2021-4093}
• KVM: SEV-ES: keep INS functions together {CVE-2021-4093}
• KVM: x86: remove unnecessary arguments from complete_emulator_pio_in {CVE-2021-4093}
• KVM: x86: split the two parts of emulator_pio_in {CVE-2021-4093}
• KVM: x86: leave vcpu->arch.pio.count alone in emulator_pio_in_out {CVE-2021-4093}
• KVM: SEV-ES: clean up kvm_sev_es_ins/outs {CVE-2021-4093}
• KVM: SEV-ES: rename guest_ins_data to sev_pio_data {CVE-2021-4093}
• KVM: SEV-ES: fix length of string I/O {CVE-2021-4093}
• drm/i915: fix TLB invalidation for Gen12 video and compute engines {CVE-2022-4139}
• drm/i915: Flush TLBs before releasing backing store {CVE-2022-0330}
• xfs: fix up non-directory creation in SGID directories {CVE-2021-4037}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: Fix data races around sk->sk_prot. {CVE-2022-3567}
• ipv6: annotate some data-races around sk->sk_prot {CVE-2022-3567}
• ipv6: use indirect call wrappers for {tcp, udpv6}_{recv, send}msg() {CVE-2022-3567}
• netfilter: nf_tables: deactivate anonymous set from preparation phase {CVE-2023-32233}
• netfilter: nf_tables: bogus EBUSY when deleting set after flush
• media: dmxdev: fix UAF when dvb_register_device() fails {CVE-2022-41218}
• l2tp: Don't sleep and disable BH under writer-side sk_callback_lock {CVE-2022-4129}
• l2tp: Serialize access to sk_user_data with sk_callback_lock {CVE-2022-4129}
• net: fix a concurrency bug in l2tp_tunnel_register() {CVE-2022-4129}
• Bluetooth: L2CAP: Fix memory leak in vhci_write {CVE-2022-3619}
• Bluetooth: L2CAP: Fix handling fragmented length
• wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() {CVE-2022-3628}
• wifi: cfg80211: avoid nontransmitted BSS list corruption {CVE-2022-42721}
• cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
• wifi: cfg80211: fix BSS refcounting bugs {CVE-2022-42720}
• cfg80211: hold bss_lock while updating nontrans_list
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF {CVE-2023-0266}
• ALSA: control: Drop superfluous snd_power_wait() calls
• ALSA: control: Track in-flight control read/write/tlv accesses
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu {CVE-2022-3564}
• netfilter: nf_conntrack_irc: Tighten matching on DCC message {CVE-2022-2663}
• netfilter: nf_conntrack_irc: Fix forged IP logic {CVE-2022-2663}
• KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() {CVE-2022-2153}
• KVM: Add infrastructure and macro to mark VM as bugged
• KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID {CVE-2022-1789}
• tcp/udp: Fix memory leak in ipv6_renew_options(). {CVE-2022-3524}
• proc: proc_skip_spaces() shouldn't think it is working on C strings {CVE-2022-4378}
• proc: avoid integer type confusion in get_proc_long {CVE-2022-4378}
• wifi: mac80211: fix crash in beacon protection for P2P-device {CVE-2022-42722}
• net: sched: cbq: dont intepret cls results when asked to drop {CVE-2023-23454}
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames {CVE-2023-0394}
• net: sched: disallow noqueue for qdisc classes {CVE-2022-47929}
• wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() {CVE-2022-41674}
• af_key: Do not call xfrm_probe_algs in…

An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system.

This kernel update is based on upstream 5.15.82 and fixes atleast the following security issues:

A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect (CVE-2022-3169).

A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel panic in the host (L0) (CVE-2022-3344).

A vulnerability has been found in Linux Kernel function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition (CVE-2022-3521).

Guests can trigger NIC interface reset/abort/crash via netback. It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior (CVE-2022-3643, XSA-423).

An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system (CVE-2022-4139).

A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-4378).

The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328, XSA-424). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329, XSA-424).

A race condition in the x86 KVM subsystem in the Linux kernel allows guest OS users to cause a denial of service (host OS crash or host OS memory corruption) when nested virtualisation and the TDP MMU are enabled (CVE-2022-45869).

For other upstream fixes in this update, see the referenced changelogs.

This kernel-linus update is based on upstream 5.15.82 and fixes atleast the following security issues:

A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect (CVE-2022-3169).

A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel panic in the host (L0) (CVE-2022-3344).

A vulnerability has been found in Linux Kernel function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition (CVE-2022-3521).

An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system (CVE-2022-4139).

A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-4378).

A race condition in the x86 KVM subsystem in the Linux kernel allows guest OS users to cause a denial of service (host OS crash or host OS memory corruption) when nested virtualisation and the TDP MMU are enabled (CVE-2022-45869).

For other upstream fixes in this update, see the referenced changelogs.

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c of the component IPsec (bsc#1204631).
• CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c (bsc#1203960).
• CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in net/bluetooth/l2cap_core.c (bsc#1205796).
• CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac (bsc#1204868).
• CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() of the component IPv6 Handler (bsc#1204414).
• CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
• CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
• CVE-2022-2602: Fixed a local privilege escalation vulnerability involving Unix socket Garbage Collection and io_uring (bsc#1204228).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. (bsc#1205711)
• CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req() which can be used to leak kernel pointers remotely (bsc#1205705).
• CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect() and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively) remotely via Bluetooth (bsc#1205709).
• CVE-2022-3707: Fixed a double free in the Intel GVT-g graphics driver (bsc#1204780).

The following non-security bugs were fixed:

• ALSA: hda/ca0132: add quirk for EVGA Z390 DARK (git-fixes).
• ALSA: hda: fix potential memleak in 'add_widget_node' (git-fixes).
• ALSA: usb-audio: Add DSD support for Accuphase DAC-60 (git-fixes).
• ALSA: usb-audio: Add quirk entry for M-Audio Micro (git-fixes).
• ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (git-fixes).
• ASoC: codecs: jz4725b: Fix spelling mistake 'Sourc' -> 'Source', 'Routee' -> 'Route' (git-fixes).
• ASoC: codecs: jz4725b: add missed Line In power control bit (git-fixes).
• ASoC: codecs: jz4725b: fix capture selector naming (git-fixes).
• ASoC: codecs: jz4725b: fix reported volume for Master ctl (git-fixes).
• ASoC: codecs: jz4725b: use right control for Capture Volume (git-fixes).
• ASoC: core: Fix use-after-free in snd_soc_exit() (git-fixes).
• ASoC: max98373: Add checks for devm_kcalloc (git-fixes).
• ASoC: soc-utils: Remove __exit for snd_soc_util_exit() (git-fixes).
• ASoC: wm5102: Revert 'ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe' (git-fixes).
• ASoC: wm5110: Revert 'ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe' (git-fixes).
• ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK (git-fixes).
• ASoC: wm8997: Revert 'ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe' (git-fixes).
• Bluetooth: L2CAP: Fix attempting to access uninitialized memory (git-fixes).
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm (git-fixes).
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (git-fixes).
• Do not enable CONFIG_ATARI_PARTITION (jsc#PED-1573)
• Drivers: hv: vmbus: Add /sys/bus/vmbus/hibernation (git-fixes).
• Drivers: hv: vmbus: Add VMbus IMC device to unsupported list (git-fixes).
• Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening…

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-42328: Guests could trigger denial of service via the netback driver (bnc#1206114).
• CVE-2022-42329: Guests could trigger denial of service via the netback driver (bnc#1206113).
• CVE-2022-3643: Guests could trigger NIC interface reset/abort/crash via netback driver (bnc#1206113).
• CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c of the component IPsec (bsc#1204631). - CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c (bsc#1203960).
• CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in net/bluetooth/l2cap_core.c (bsc#1205796).
• CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() of the component IPv6 Handler (bsc#1204414).
• CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
• CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
• CVE-2022-45869: Fixed a race condition in the x86 KVM subsystem which could cause a denial of service (bsc#1205882).
• CVE-2022-45888: Fixed a use-after-free during physical removal of a USB devices when using drivers/char/xillybus/xillyusb.c (bsc#1205764).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. (bsc#1205711)
• CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect() and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively) remotely via Bluetooth (bsc#1205709).
• CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req() which can be used to leak kernel pointers remotely (bsc#1205705).
• CVE-2022-3566: Fixed a race condition in the functions tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition (bsc#1204405).
• CVE-2022-2602: Fixed a local privilege escalation vulnerability involving Unix socket Garbage Collection and io_uring (bsc#1204228).
• CVE-2022-3176: Fixed a use-after-free in io_uring related to signalfd_poll() and binder_poll() (bsc#1203391).
• CVE-2022-3707: Fixed a double free in the Intel GVT-g graphics driver (bsc#1204780).
• CVE-2022-41850: Fixed a use-after-free in roccat_report_event in drivers/hid/hid-roccat.c (bnc#1203960).

The following non-security bugs were fixed:

• ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() (git-fixes).
• ACPI: HMAT: Fix initiator registration for single-initiator systems (git-fixes).
• ACPI: HMAT: remove unnecessary variable initialization (git-fixes).
• ACPI: scan: Add LATT2021 to acpi_ignore_dep_ids[] (git-fixes).
• ACPI: x86: Add another system to quirk list for forcing StorageD3Enable (git-fixes).
• ALSA: dice: fix regression for Lexicon I-ONIX FW810S (git-fixes).
• ALSA: hda/ca0132: add quirk for EVGA Z390 DARK (git-fixes).
• ALSA: hda/hdmi - enable runtime pm for more AMD display audio (git-fixes).
• ALSA: hda/realtek: Add Positivo C6300 model quirk (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS Zenbook using CS35L41 (git-fixes).
• ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 (bsc#1205100).
• ALSA: hda/realtek: fix speakers for Samsung Galaxy Book Pro (bsc#1205100).
• ALSA: hda: fix potential memleak in 'add_widget_node' (git-fixes). -…

This update for the Linux Kernel 5.3.18-150200_24_126 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3577: Fixed an out-of-bounds memory write in bigben_probe of drivers/hid/hid-bigbenff.c (bsc#1204470).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
• CVE-2022-41218: Fixed a use-after-free caused by refcount races, affecting dvb_demux_open() and dvb_dmxdev_release() in drivers/media/dvb-core/dmxdev.c (bsc#1202960).

This update for the Linux Kernel 5.3.18-150200_24_134 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3577: Fixed an out-of-bounds memory write in bigben_probe of drivers/hid/hid-bigbenff.c (bsc#1204470).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).

This update for the Linux Kernel 5.3.18-150300_59_93 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3640: Fixed a use-after-free in l2cap_conn_del of the file net/bluetooth/l2cap_core.c (bsc#1204619).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
• CVE-2022-41218: Fixed a use-after-free caused by refcount races, affecting dvb_demux_open() and dvb_dmxdev_release() in drivers/media/dvb-core/dmxdev.c (bsc#1202960).

This update for the Linux Kernel 5.3.18-150300_59_98 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3640: Fixed a use-after-free in l2cap_conn_del of the file net/bluetooth/l2cap_core.c (bsc#1204619).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).

This update for the Linux Kernel 5.14.21-150400_24_18 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
• CVE-2022-41218: Fixed a use-after-free caused by refcount races, affecting dvb_demux_open() and dvb_dmxdev_release() in drivers/media/dvb-core/dmxdev.c (bsc#1202960).

This update for the Linux Kernel 5.3.18-150300_59_60 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3577: Fixed an out-of-bounds memory write in bigben_probe of drivers/hid/hid-bigbenff.c (bsc#1204470).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
• CVE-2022-41218: Fixed a use-after-free caused by refcount races, affecting dvb_demux_open() and dvb_dmxdev_release() in drivers/media/dvb-core/dmxdev.c (bsc#1202960).
• CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).

This update for the Linux Kernel 5.3.18-150300_59_71 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3577: Fixed an out-of-bounds memory write in bigben_probe of drivers/hid/hid-bigbenff.c (bsc#1204470).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
• CVE-2022-41218: Fixed a use-after-free caused by refcount races, affecting dvb_demux_open() and dvb_dmxdev_release() in drivers/media/dvb-core/dmxdev.c (bsc#1202960).

This update for the Linux Kernel 5.14.21-150400_24_33 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2021-39698: Fixed a use-after-free in aio_poll_complete_work of aio.c (bsc#1196956).

This update for the Linux Kernel 5.3.18-150300_59_87 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
• CVE-2022-41218: Fixed a use-after-free caused by refcount races, affecting dvb_demux_open() and dvb_dmxdev_release() in drivers/media/dvb-core/dmxdev.c (bsc#1202960).

This update for the Linux Kernel 5.3.18-150300_59_90 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3640: Fixed a use-after-free in l2cap_conn_del of the file net/bluetooth/l2cap_core.c (bsc#1204619).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
• CVE-2022-41218: Fixed a use-after-free caused by refcount races, affecting dvb_demux_open() and dvb_dmxdev_release() in drivers/media/dvb-core/dmxdev.c (bsc#1202960).

This update for the Linux Kernel 5.3.18-150300_59_76 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
• CVE-2022-41218: Fixed a use-after-free caused by refcount races, affecting dvb_demux_open() and dvb_dmxdev_release() in drivers/media/dvb-core/dmxdev.c (bsc#1202960).

This update for the Linux Kernel 5.14.21-150400_24_21 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3640: Fixed a use-after-free in l2cap_conn_del of the file net/bluetooth/l2cap_core.c (bsc#1204619).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
• CVE-2022-41218: Fixed a use-after-free caused by refcount races, affecting dvb_demux_open() and dvb_dmxdev_release() in drivers/media/dvb-core/dmxdev.c (bsc#1202960).

This update for the Linux Kernel 5.14.21-150400_24_28 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3640: Fixed a use-after-free in l2cap_conn_del of the file net/bluetooth/l2cap_core.c (bsc#1204619).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).