CVE-2022-48686

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix memleak in io_init_wq_offload()

I got memory leak report when doing fuzz test:

BUG: memory leak unreferenced object 0xffff888107310a80 (size 96): comm "syz-executor.6", pid 4610, jiffies 4295140240 (age 20.135s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... backtrace: [<000000001974933b>] kmalloc include/linux/slab.h:591 [inline] [<000000001974933b>] kzalloc include/linux/slab.h:721 [inline] [<000000001974933b>] io_init_wq_offload fs/io_uring.c:7920 [inline] [<000000001974933b>] io_uring_alloc_task_context+0x466/0x640 fs/io_uring.c:7955 [<0000000039d0800d>] __io_uring_add_tctx_node+0x256/0x360 fs/io_uring.c:9016 [<000000008482e78c>] io_uring_add_tctx_node fs/io_uring.c:9052 [inline] [<000000008482e78c>] __do_sys_io_uring_enter fs/io_uring.c:9354 [inline] [<000000008482e78c>] __se_sys_io_uring_enter fs/io_uring.c:9301 [inline] [<000000008482e78c>] __x64_sys_io_uring_enter+0xabc/0xc20 fs/io_uring.c:9301 [<00000000b875f18f>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<00000000b875f18f>] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 [<000000006b0a8484>] entry_SYSCALL_64_after_hwframe+0x44/0xae

CPU0 CPU1 io_uring_enter io_uring_enter io_uring_add_tctx_node io_uring_add_tctx_node __io_uring_add_tctx_node __io_uring_add_tctx_node io_uring_alloc_task_context io_uring_alloc_task_context io_init_wq_offload io_init_wq_offload hash = kzalloc hash = kzalloc ctx->hash_map = hash ctx->hash_map = hash <- one of the hash is leaked

When calling io_uring_enter() in parallel, the 'hash_map' will be leaked, add uring_lock to protect 'hash_map'.(CVE-2021-47292)

In the Linux kernel, the following vulnerability has been resolved:

io_uring: ensure task_work gets run as part of cancelations

If we successfully cancel a work item but that work item needs to be processed through task_work, then we can be sleeping uninterruptibly in io_uring_cancel_generic() and never process it. Hence we don't make forward progress and we end up with an uninterruptible sleep warning.

While in there, correct a comment that should be IFF, not IIF.(CVE-2021-47504)

In the Linux kernel, the following vulnerability has been resolved:

ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()

ethtool_set_coalesce() now uses both the .get_coalesce() and .set_coalesce() callbacks. But the check for their availability is buggy, so changing the coalesce settings on a device where the driver provides only one of the callbacks results in a NULL pointer dereference instead of an -EOPNOTSUPP.

Fix the condition so that the availability of both callbacks is ensured. This also matches the netlink code.

Note that reproducing this requires some effort - it only affects the legacy ioctl path, and needs a specific combination of driver options:

• have .get_coalesce() and .coalesce_supported but no .set_coalesce(), or
• have .set_coalesce() but no .get_coalesce(). Here eg. ethtool doesn't cause the crash as it first attempts to call ethtool_get_coalesce() and bails out on error.(CVE-2021-47556)

In the Linux kernel, the following vulnerability has been resolved:

drm/gma500: Fix BUG: sleeping function called from invalid context errors

gma_crtc_page_flip() was holding the event_lock spinlock while calling crtc_funcs->mode_set_base() which takes ww_mutex.

The only reason to hold event_lock is to clear gma_crtc->page_flip_event on mode_set_base() errors.

Instead unlock it after setting gma_crtc->page_flip_event and on errors re-take…

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix UAF when detecting digest errors We should also bail from the io_work loop when we set rd_enabled to true, so we don't attempt to read data from the socket when the TCP stream is already out-of-sync or corrupted.

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
• af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done {CVE-2026-63801}
• tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
• Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
• drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}
• nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
• net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
• drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138}
• drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136}
• RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
• netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
• net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398}
• mm/khugepaged: fix ->anon_vma race {CVE-2023-52935}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
• drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
• bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548}
• NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
• wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
• uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
• md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• ALSA: usx2y: Fix potential leaks of uninitialized memory {CVE-2026-74641}
• bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}
• net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}
• drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• sctp: validate cookie AUTH state before use {CVE-2026-74752}
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
• nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320}
• tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
• crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
• libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304}
• nvme-tcp: fix UAF when detecting digest errors {CVE-2022-48686}
• isdn: cpai: check ctr->cnr…

• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• ALSA: usx2y: Fix potential leaks of uninitialized memory {CVE-2026-74641}
• net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}
• drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138}
• drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136}
• tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
• netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
• mptcp: fix slab-use-after-free in __inet_lookup_established {CVE-2026-31669}
• ethtool: do not perform operations on net devices being unregistered {CVE-2021-47517}
• Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
• net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556}
• vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
• af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done {CVE-2026-63801}
• tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}
• nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
• net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
• drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}
• bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}
• bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO {CVE-2022-49961}
• dm cache: fix null-deref with concurrent writes in passthrough mode {CVE-2026-53064}
• net: bonding: fix use-after-free after 802.3ad slave unbind {CVE-2022-49667}
• bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
• uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
• md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262}
• tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
• crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
• libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304}
• nvme-tcp: fix UAF when detecting digest errors {CVE-2022-48686}
• ALSA: 6fire: fix use-after-free on disconnect…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
• CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
• CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
• CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).
• CVE-2022-48631: Fixed a bug in ext4, when parsing extents where eh_entries == 0 and eh_depth > 0 (bsc#1223475).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223513).
• CVE-2024-26906: Disallowed vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26816: Fixed relocations in .notes section when building with CONFIG_XEN_PV=y by ignoring them (bsc#1222624).
• CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221299).
• CVE-2024-26689: Fixed a use-after-free in encode_cap_msg() (bsc#1222503).
• CVE-2021-47041: Don't set sk_user_data without write_lock (bsc#1220755).
• CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
• CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449).

The following non-security bugs were fixed:

• dm rq: do not queue request to blk-mq during DM suspend (bsc#1221113).
• dm: rearrange core declarations for extended use from dm-zone.c (bsc#1221113).
• net/tls: Remove the context from the list in tls_device_down (bsc#1221545).
• tls: Fix context leak on tls_device_down (bsc#1221545).

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-27389: Fixed pstore inode handling with d_invalidate() (bsc#1223705).
• CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).
• CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).
• CVE-2024-27046: Fixed nfp/flower handling acti_netdevs allocation failure (bsc#1223827).
• CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).
• CVE-2024-27042: Fixed drm/amdgpu for potential out-of-bounds access in amdgpu_discovery_reg_base_init() (bsc#1223823).
• CVE-2024-27041: Fixed drm/amd/display NULL checks for adev->dm.dc in amdgpu_dm_fini() (bsc#1223714).
• CVE-2024-27039: Fixed clk/hisilicon/hi3559a an erroneous devm_kfree() (bsc#1223821).
• CVE-2024-27038: Fixed clk_core_get NULL pointer dereference (bsc#1223816).
• CVE-2024-27030: Fixed octeontx2-af to use separate handlers for interrupts (bsc#1223790).
• CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).
• CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).
• CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).
• CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).
• CVE-2024-26970: Fixed clk/qcom/gcc-ipq6018 termination of frequency table arrays (bsc#1223644).
• CVE-2024-26969: Fixed clk/qcom/gcc-ipq8074 termination of frequency table arrays (bsc#1223645).
• CVE-2024-26966: Fixed clk/qcom/mmcc-apq8084 termination of frequency table arrays (bsc#1223646).
• CVE-2024-26965: Fixed clk/qcom/mmcc-msm8974 termination of frequency table arrays (bsc#1223648).
• CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).
• CVE-2024-26951: Fixed wireguard/netlink check for dangling peer via is_dead instead of empty list (bsc#1223660).
• CVE-2024-26950: Fixed wireguard/netlink to access device through ctx instead of peer (bsc#1223661).
• CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).
• CVE-2024-26939: Fixed drm/i915/vma UAF on destroy against retire race (bsc#1223679).
• CVE-2024-26927: Fixed ASoC/SOF bounds checking to firmware data Smatch (bsc#1223525).
• CVE-2024-26915: Fixed drm/amdgpu reset IH OVERFLOW_CLEAR bit (bsc#1223207).
• CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).
• CVE-2024-26898: Fixed aoe potential use-after-free problem in aoecmd_cfg_pkts (bsc#1223016).
• CVE-2024-26896: Fixed wifi/wfx memory leak when starting AP (bsc#1223042).
• CVE-2024-26893: Fixed firmware/arm_scmi for possible double free in SMC transport cleanup path (bsc#1223196).
• CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).
• CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).
• CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).
• CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).
• CVE-2024-26881: Fixed net/hns3 kernel crash when 1588 is received on HIP08 devices (bsc#1223041).
• CVE-2024-26879: Fixed clk/meson by adding missing clocks to axg_clk_regmaps (bsc#1223066).
• CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).
• CVE-2024-26876: Fixed drm/bridge/adv7511 crash on irq during probe (bsc#1223119).
• CVE-2024-26866: Fixed spi/spi-fsl-lpspi by removing redundant spi_controller_put call (bsc#1223024).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-26861: Fixed wireguard/receive annotate data-race around receiving_counter.counter (bsc#1223076).
• CVE-2024-26857: Fixed geneve to make sure to pull inner header in…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
• CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
• CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
• CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).
• CVE-2022-48631: Fixed a bug in ext4, when parsing extents where eh_entries == 0 and eh_depth > 0 (bsc#1223475).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223513).
• CVE-2024-26906: Disallowed vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26816: Fixed relocations in .notes section when building with CONFIG_XEN_PV=y by ignoring them (bsc#1222624).
• CVE-2021-47207: Fixed a null pointer dereference on pointer block in gus (bsc#1222790).
• CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221299).
• CVE-2024-26689: Fixed a use-after-free in encode_cap_msg() (bsc#1222503).
• CVE-2021-47041: Don't set sk_user_data without write_lock (bsc#1220755).
• CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
• CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449).

The following non-security bugs were fixed:

• dm rq: do not queue request to blk-mq during DM suspend (bsc#1221113).
• dm: rearrange core declarations for extended use from dm-zone.c (bsc#1221113).
• net/tls: Remove the context from the list in tls_device_down (bsc#1221545).
• tls: Fix context leak on tls_device_down (bsc#1221545).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26760: Fixed scsi/target/pscsi bio_put() for error case (bsc#1222596).
• CVE-2024-27389: Fixed pstore inode handling with d_invalidate() (bsc#1223705).
• CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).
• CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).
• CVE-2024-27046: Fixed nfp/flower handling acti_netdevs allocation failure (bsc#1223827).
• CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).
• CVE-2024-27041: Fixed drm/amd/display NULL checks for adev->dm.dc in amdgpu_dm_fini() (bsc#1223714).
• CVE-2024-27039: Fixed clk/hisilicon/hi3559a an erroneous devm_kfree() (bsc#1223821).
• CVE-2024-27038: Fixed clk_core_get NULL pointer dereference (bsc#1223816).
• CVE-2024-27030: Fixed octeontx2-af to use separate handlers for interrupts (bsc#1223790).
• CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).
• CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).
• CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).
• CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).
• CVE-2024-26970: Fixed clk/qcom/gcc-ipq6018 termination of frequency table arrays (bsc#1223644).
• CVE-2024-26969: Fixed clk/qcom/gcc-ipq8074 termination of frequency table arrays (bsc#1223645).
• CVE-2024-26966: Fixed clk/qcom/mmcc-apq8084 termination of frequency table arrays (bsc#1223646).
• CVE-2024-26965: Fixed clk/qcom/mmcc-msm8974 termination of frequency table arrays (bsc#1223648).
• CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).
• CVE-2024-26951: Fixed wireguard/netlink check for dangling peer via is_dead instead of empty list (bsc#1223660).
• CVE-2024-26950: Fixed wireguard/netlink to access device through ctx instead of peer (bsc#1223661).
• CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).
• CVE-2024-26927: Fixed ASoC/SOF bounds checking to firmware data Smatch (bsc#1223525).
• CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).
• CVE-2024-26896: Fixed wifi/wfx memory leak when starting AP (bsc#1223042).
• CVE-2024-26893: Fixed firmware/arm_scmi for possible double free in SMC transport cleanup path (bsc#1223196).
• CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).
• CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).
• CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).
• CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).
• CVE-2024-26881: Fixed net/hns3 kernel crash when 1588 is received on HIP08 devices (bsc#1223041).
• CVE-2024-26879: Fixed clk/meson by adding missing clocks to axg_clk_regmaps (bsc#1223066).
• CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).
• CVE-2024-26866: Fixed spi/spi-fsl-lpspi by removing redundant spi_controller_put call (bsc#1223024).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-26861: Fixed wireguard/receive annotate data-race around receiving_counter.counter (bsc#1223076).
• CVE-2024-26857: Fixed geneve to make sure to pull inner header in geneve_rx() (bsc#1223058).
• CVE-2024-26856: Fixed use-after-free inside sparx5_del_mact_entry (bsc#1223052).
• CVE-2024-26855: Fixed net/ice potential NULL pointer dereference in ice_bridge_setlink() (bsc#1223051).
• CVE-2024-26853: Fixed igc returning frame twice in XDP_REDIRECT (bsc#1223061).
• CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify()…

The SUSE Linux Enterprise 15 SP5 Real Time kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-27389: Fixed pstore inode handling with d_invalidate() (bsc#1223705).
• CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).
• CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).
• CVE-2024-27046: Fixed nfp/flower handling acti_netdevs allocation failure (bsc#1223827).
• CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).
• CVE-2024-27041: Fixed drm/amd/display NULL checks for adev->dm.dc in amdgpu_dm_fini() (bsc#1223714).
• CVE-2024-27039: Fixed clk/hisilicon/hi3559a an erroneous devm_kfree() (bsc#1223821).
• CVE-2024-27038: Fixed clk_core_get NULL pointer dereference (bsc#1223816).
• CVE-2024-27030: Fixed octeontx2-af to use separate handlers for interrupts (bsc#1223790).
• CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).
• CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).
• CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).
• CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).
• CVE-2024-26970: Fixed clk/qcom/gcc-ipq6018 termination of frequency table arrays (bsc#1223644).
• CVE-2024-26969: Fixed clk/qcom/gcc-ipq8074 termination of frequency table arrays (bsc#1223645).
• CVE-2024-26966: Fixed clk/qcom/mmcc-apq8084 termination of frequency table arrays (bsc#1223646).
• CVE-2024-26965: Fixed clk/qcom/mmcc-msm8974 termination of frequency table arrays (bsc#1223648).
• CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).
• CVE-2024-26951: Fixed wireguard/netlink check for dangling peer via is_dead instead of empty list (bsc#1223660).
• CVE-2024-26950: Fixed wireguard/netlink to access device through ctx instead of peer (bsc#1223661).
• CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).
• CVE-2024-26927: Fixed ASoC/SOF bounds checking to firmware data Smatch (bsc#1223525).
• CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).
• CVE-2024-26896: Fixed wifi/wfx memory leak when starting AP (bsc#1223042).
• CVE-2024-26893: Fixed firmware/arm_scmi for possible double free in SMC transport cleanup path (bsc#1223196).
• CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).
• CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).
• CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).
• CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).
• CVE-2024-26881: Fixed net/hns3 kernel crash when 1588 is received on HIP08 devices (bsc#1223041).
• CVE-2024-26879: Fixed clk/meson by adding missing clocks to axg_clk_regmaps (bsc#1223066).
• CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).
• CVE-2024-26866: Fixed spi/spi-fsl-lpspi by removing redundant spi_controller_put call (bsc#1223024).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-26861: Fixed wireguard/receive annotate data-race around receiving_counter.counter (bsc#1223076).
• CVE-2024-26857: Fixed geneve to make sure to pull inner header in geneve_rx() (bsc#1223058).
• CVE-2024-26856: Fixed use-after-free inside sparx5_del_mact_entry (bsc#1223052).
• CVE-2024-26855: Fixed net/ice potential NULL pointer dereference in ice_bridge_setlink() (bsc#1223051).
• CVE-2024-26853: Fixed igc returning frame twice in XDP_REDIRECT (bsc#1223061).
• CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2024-26848: Fixed afs endless loop in directory parsing…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948). Update blacklist.conf: remove entry
• CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2022-48697: Fix a use-after-free (bsc#1223922). Update blacklist.conf: drop entry from it
• CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).
• CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222 CVE-2023-52732).
• CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2024-36029: Pervent access to suspended controller (bsc#1225708 CVE-2024-36029)
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
• CVE-2021-47352: Add validation for used length (bsc#1225124).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).
• CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2021-47423: Fix file release memory leak (bsc#1225366).
• CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
• CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
• CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)
• CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
• CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960, CVE-2021-47277).
• CVE-2024-35791: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (bsc#1224725).
• CVE-2021-47401: Fix stack information leak (bsc#1225242).
• CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).
• CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).
• CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
• CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
• CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).
• CVE-2023-52864: Fix opening of char device (bsc#1225132).
• CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).
• CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).
• CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)
• CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).
• CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).
• CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)
• CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).
• CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931) -…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948).
• CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2022-48697: Fix a use-after-free (bsc#1223922).
• CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).
• CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222).
• CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
• CVE-2021-47548: Fixed a possible array out-of-bounds (bsc#1225506)
• CVE-2024-36029: Pervent access to suspended controller (bsc#1225708)
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
• CVE-2021-47352: Add validation for used length (bsc#1225124).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).
• CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2021-47423: Fix file release memory leak (bsc#1225366).
• CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
• CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
• CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)
• CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
• CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960).
• CVE-2024-35791: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (bsc#1224725).
• CVE-2021-47401: Fix stack information leak (bsc#1225242).
• CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).
• CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).
• CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
• CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
• CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).
• CVE-2023-52864: Fix opening of char device (bsc#1225132).
• CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).
• CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).
• CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)
• CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).
• CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).
• CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)
• CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).
• CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)
• CVE-2021-47249: Fix memory leak in rds_recvmsg (bsc#1224880)
• CVE-2021-47397: Break out if skb_header_pointer returns NULL in…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
• CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
• CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
• CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
• CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
• CVE-2024-35904: Fixed dereference of garbage after mount failure (bsc#1224494).
• CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
• CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).

The following non-security bugs were fixed:

• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• filemap: remove use of wait bookmarks (bsc#1224085).
• idpf: extend tx watchdog timeout (bsc#1224137).
• ipvs: Fix checksumming on GSO of SCTP packets (bsc#1221958)
• powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).
• powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).
• powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).
• powerpc/powernv: Add a null pointer check to scom_debug_init_one() (bsc#1194869).
• powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV (bsc#1220492 ltc#205270).
• powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).
• powerpc: Refactor verification of MSR_RI (bsc#1223191).
• supported.conf: support tcp_dctcp module (jsc#PED-8111)

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).
• CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
• CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
• CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
• CVE-2021-47206: Check return value after calling platform_get_resource() (bsc#1222894).
• CVE-2021-47238: Fixed memory leak in ip_mc_add1_src (bsc#1224847)
• CVE-2021-47245: Fixed out of bounds when parsing TCP options (bsc#1224838)
• CVE-2021-47246: Fixed page reclaim for dead peer hairpin (CVE-2021-47246 bsc#1224831).
• CVE-2021-47249: Fixed memory leak in rds_recvmsg (bsc#1224880)
• CVE-2021-47250: Fixed memory leak in netlbl_cipsov4_add_std (bsc#1224827)
• CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
• CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960).
• CVE-2021-47281: Fixed race of snd_seq_timer_open() (bsc#1224983).
• CVE-2021-47334: Fixed two use after free in ibmasm_init_one (bsc#1225112).
• CVE-2021-47352: Add validation for used length (bsc#1225124).
• CVE-2021-47355: Fixed possible use-after-free in nicstar_cleanup() (bsc#1225141).
• CVE-2021-47357: Fixed possible use-after-free in ia_module_exit() (bsc#1225144).
• CVE-2021-47361: Fixed error handling in mcb_alloc_bus() (bsc#1225151).
• CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb (bsc#1225082)
• CVE-2021-47401: Fixed stack information leak (bsc#1225242).
• CVE-2021-47423: Fixed file release memory leak (bsc#1225366).
• CVE-2021-47431: Fixed gart.bo pin_count leak (bsc#1225390).
• CVE-2021-47469: Add SPI fix commit to be ignored (bsc#1225347)
• CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit() (bsc#1224907).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48672: Fixed off-by-one error in unflatten_dt_nodes() (CVE-2022-48672 bsc#1223931).
• CVE-2022-48686: Fixed UAF when detecting digest errors (bsc#1223948).
• CVE-2022-48697: Fixed a use-after-free (bsc#1223922).
• CVE-2022-48702: Fixed out of bounds access in snd_emu10k1_pcm_channel_alloc() (bsc#1223923).
• CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)
• CVE-2022-48708: Fixed potential NULL dereference (bsc#1224942).
• CVE-2022-48710: Fixed a possible null pointer dereference (bsc#1225230).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52691: Fixed a double-free in si_dpm_init (bsc#1224607).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2023-52730: Fixed possible resource leaks in some error paths (bsc#1224956).
• CVE-2023-52732: Blocklist the kclient when…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
• CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-35863: Fix potential UAF in is_valid_oplock_break() (bsc#1224763).
• CVE-2024-35867: Fix potential UAF in cifs_stats_proc_show() (bsc#1224664).
• CVE-2024-35868: Fix potential UAF in cifs_stats_proc_write() (bsc#1224678).
• CVE-2024-26928: Fix potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
• CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
• CVE-2024-35904: Avoid dereference of garbage after mount failure (bsc#1224494).
• CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
• CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).

The following non-security bugs were fixed:

• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• filemap: remove use of wait bookmarks (bsc#1224085).
• idpf: extend tx watchdog timeout (bsc#1224137).
• ipvs: Fix checksumming on GSO of SCTP packets (bsc#1221958)
• powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).
• powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).
• powerpc/powernv: Add a null pointer check to scom_debug_init_one() (bsc#1194869).
• powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV (bsc#1220492 ltc#205270).
• powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).
• powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).
• powerpc: Refactor verification of MSR_RI (bsc#1223191).

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-44947: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454).
• CVE-2022-48919: Fix double free race when mount fails in cifs_get_root() (bsc#1229657).
• CVE-2023-52854: Fix refcnt handling in padata_free_shell() (bsc#1225584).
• CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).
• CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
• CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).
• CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
• CVE-2022-48912: Fix use-after-free in __nf_register_net_hook() (bsc#1229641)
• CVE-2022-48872: Fix use-after-free race condition for maps (bsc#1229510).
• CVE-2022-48873: Do not remove map on creater_process and device_release (bsc#1229512).
• CVE-2024-42271: Fixed a use after free in iucv_sock_close(). (bsc#1229400)
• CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
• CVE-2024-40910: Fix refcount imbalance on inbound connections (bsc#1227832).
• CVE-2022-48686: Fixed UAF when detecting digest errors (bsc#1223948).
• CVE-2024-41009: bpf: Fix overrunning reservations in ringbuf (bsc#1228020).
• CVE-2022-48791: Fix use-after-free for aborted TMF sas_task (bsc#1228002)

The following non-security bugs were fixed:

• Bluetooth: L2CAP: Fix deadlock (git-fixes).
• powerpc: Remove support for PowerPC 601 (Remove unused and malformed assembly causing build error).
• sched/psi: use kernfs polling functions for PSI trigger polling (bsc#1209799 bsc#1225109).
• scsi: pm80xx: Fix TMF task completion race condition (bsc#1228002).

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48791: Fix use-after-free for aborted TMF sas_task (bsc#1228002)
• CVE-2024-44947: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454).
• CVE-2022-48919: Fix double free race when mount fails in cifs_get_root() (bsc#1229657).
• CVE-2023-52854: Fix refcnt handling in padata_free_shell() (bsc#1225584).
• CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).
• CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
• CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).
• CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
• CVE-2022-48912: Fix use-after-free in __nf_register_net_hook() (bsc#1229641)
• CVE-2022-48872: Fix use-after-free race condition for maps (bsc#1229510).
• CVE-2022-48873: Do not remove map on creater_process and device_release (bsc#1229512).
• CVE-2024-42271: Fixed a use after free in iucv_sock_close(). (bsc#1229400)
• CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
• CVE-2022-48686: Fixed UAF when detecting digest errors (bsc#1223948).

The following non-security bugs were fixed:

• Bluetooth: L2CAP: Fix deadlock (git-fixes).
• powerpc: Remove support for PowerPC 601 (Remove unused and malformed assembly causing build error).
• sched/psi: use kernfs polling functions for PSI trigger polling (bsc#1209799 bsc#1225109).
• scsi: pm80xx: Fix TMF task completion race condition (bsc#1228002)

This update for the Linux Kernel 4.12.14-122_216 fixes several issues.

The following security issues were fixed:

• CVE-2022-48686: Fixed UAF when detecting digest errors (bsc#1226337).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233712).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1232637).
• CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229553).
• CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1229273).
• CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1225011).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311).
• CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1225012).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 4.12.14-122_186 fixes several issues.

The following security issues were fixed:

• CVE-2022-48686: Fixed UAF when detecting digest errors (bsc#1226337).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233712).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1232637).

This update for the Linux Kernel 4.12.14-122_194 fixes several issues.

The following security issues were fixed:

• CVE-2022-48686: Fixed UAF when detecting digest errors (bsc#1226337).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233712).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1232637).

This update for the Linux Kernel 4.12.14-122_201 fixes several issues.

The following security issues were fixed:

• CVE-2022-48686: Fixed UAF when detecting digest errors (bsc#1226337).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233712).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1232637).
• CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229553).
• CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1229273).
• CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1225011).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311).
• CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1225012).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223681).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-53095: smb: client: Fix use-after-free of network namespace (bsc#1233642).
• CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234853).
• CVE-2024-53156: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() (bsc#1234846).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234891).
• CVE-2024-53179: smb: client: fix use-after-free of signing key (bsc#1234921).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235004).
• CVE-2024-53239: ALSA: 6fire: Release resources at card release (bsc#1235054).
• CVE-2024-53240: xen/netfront: fix crash when removing device (bsc#1234281).
• CVE-2024-53241: x86/xen: use new hypercall functions instead of hypercall page (XSA-466 bsc#1234282).
• CVE-2024-56539: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() (bsc#1234963).
• CVE-2024-56548: hfsplus: do not query the device logical block size multiple times (bsc#1235073).
• CVE-2024-56570: ovl: Filter invalid inodes with missing lookup function (bsc#1235035).
• CVE-2024-56598: jfs: array-index-out-of-bounds fix in dtReadFirst (bsc#1235220).
• CVE-2024-56604: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() (bsc#1235056).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235061).
• CVE-2024-56619: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() (bsc#1235224).
• CVE-2024-8805: Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE (bsc#1230697).

The following non-security bugs were fixed:

• KVM: x86: fix sending PV IPI (git-fixes).
• idpf: add support for SW triggered interrupts (bsc#1235507).
• idpf: enable WB_ON_ITR (bsc#1235507).
• idpf: trigger SW interrupt when exiting wb_on_itr mode (bsc#1235507).
• kernel-binary: do not BuildIgnore m4. It is actually needed for regenerating zconf when it is not up-to-date due to merge.
• kernel/fork: beware of __put_task_struct() calling context (bsc#1189998 (PREEMPT_RT prerequisite backports)).
• net: mana: Increase the DEF_RX_BUFFERS_PER_QUEUE to 1024 (bsc#1235246).
• rpm/kernel-binary.spec.in: Fix build regression The previous fix forgot to take over grep -c option that broke the conditional expression
• scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (git-fixes).
• smb: client: fix TCP timers deadlock after rmmod (git-fixes) [hcarvalho: this fixes issue discussed in bsc#1233642].
• usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode() (git-fixes).
• usb: typec: tps6598x: Fix return value check in tps6598x_probe() (git-fixes).
• x86/bug: Merge annotate_reachable() into _BUG_FLAGS() asm (git-fixes).
• x86/fpu/xsave: Handle compacted offsets correctly with supervisor states (git-fixes).
• x86/fpu/xstate: Fix the ARCH_REQ_XCOMP_PERM implementation (git-fixes).
• x86/fpu: Remove unused supervisor only offsets (git-fixes).
• x86/kvm: Do not use pv tlb/ipi/sched_yield if on 1 vCPU (git-fixes).
• x86/mce/inject: Avoid out-of-bounds write when setting flags (git-fixes).
• x86/mce: Allow instrumentation during task work queueing (git-fixes).
• x86/mce: Mark mce_end() noinstr (git-fixes).
• x86/mce: Mark mce_panic() noinstr (git-fixes).
• x86/mce: Mark mce_read_aux() noinstr (git-fixes).
• x86/mm: Flush global TLB when switching to trampoline page-table (git-fixes).
• x86/sgx: Free backing memory after faulting the enclave page (git-fixes).
• x86/sgx: Silence softlockup detection when releasing large enclaves (git-fixes).
• x86/uaccess: Move variable into switch case statement (git-fixes).
• x86: Annotate call_on_stack() (git-fixes).