CVE-2022-48768

• wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds {CVE-2023-53582}
• net/sched: accept TCA_STAB only for root qdisc {CVE-2024-50039}
• bpf, sockmap: Several fixes to bpf_msg_pop_data {CVE-2024-56720}
• net: add more sanity checks to qdisc_pkt_len_init() {CVE-2024-49948}
• nvme-tcp: sanitize request list handling {CVE-2025-38264}
• smb: client: fix double free of TCP_Server_Info::hostname {CVE-2025-21673}
• net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815}
• net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo {CVE-2026-46132}
• RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
• Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
• bpf: Fix bpf_xdp_store_bytes proto for read-only arg {CVE-2026-45886}
• libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
• nfsd: never defer requests during idmap lookup {CVE-2026-45983}
• openvswitch: cap upcall PID array size and pre-size vport replies {CVE-2026-45840}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• dm mirror: fix integer overflow in create_dirty_log() {CVE-2026-46023}
• thermal: core: Fix thermal zone governor cleanup issues {CVE-2026-46021}
• tcp: call sk_data_ready() after listener migration {CVE-2026-46015}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• netfilter: nft_exthdr: fix register tracking for F_PRESENT flag {CVE-2026-53218}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
• Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER {CVE-2026-53072}
• netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
• smb: client: fix krb5 mount with username option {CVE-2026-31392}
• netfilter: nft_tunnel: fix use-after-free on object destroy {CVE-2026-53212}
• USB: serial: io_ti: fix heap overflow in get_manuf_info() {CVE-2026-53196}
• crypto: ccp - copy IV using skcipher ivsize {CVE-2026-53016}
• netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176}
• fuse: reject fuse_notify() pagecache ops on directories {CVE-2026-53168}
• ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075}
• xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
• ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options {CVE-2026-53249}
• ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• uio_hv_generic: Let userspace take care of interrupt mask {CVE-2025-40048}
• net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove {CVE-2026-52947}
• net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
• libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955}
• libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957}
• netfilter: nft_ct: fix missing expect put in obj eval {CVE-2026-52970}
• netfilter: nf_tables: always walk all pending catchall elements {CVE-2026-23278}
• crypto: af_alg - Cap AEAD AD length to 0x80000000 {CVE-2026-52972}
• wifi: cfg80211: advance loop vars in cfg80211_merge_profile() {CVE-2026-64174}
• NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr {CVE-2026-53391}
• Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock {CVE-2026-63945}
• pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800}
• RDMA/vmw_pvrdma: Fix…

• mac802154: llsec: reject frames shorter than the authentication tag {CVE-2026-68125}
• KVM: x86/mmu: Fix use-after-free on vendor module reload {CVE-2026-68428}
• wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper {CVE-2026-68197}
• bpf: account for current allocated stack depth in widen_imprecise_scalars() {CVE-2025-68208}
• tun: free page on build_skb failure in tun_xdp_one() {CVE-2026-46322}
• smb: client: fix potential cfid UAF in smb2_query_info_compound {CVE-2025-40320}
• net/packet: avoid fanout hook re-registration after unregister {CVE-2026-68338}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• binfmt_misc: set have_execfd only once the interpreter is opened {CVE-2026-68186}
• tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175}
• tipc: fix u16 MTU truncation in media and bearer MTU validation {CVE-2026-68297}
• net: gro: fix double aggregation of flush-marked skbs {CVE-2026-68136}
• bpf, sockmap: Reject unhashed UDP sockets on sockmap update {CVE-2026-68386}
• wifi: brcmfmac: fix 802.1X-SHA256 call trace warning {CVE-2026-68304}
• udf: fix partition descriptor append bookkeeping {CVE-2026-45991}
• Bluetooth: SCO: fix race conditions in sco_sock_connect() {CVE-2026-43023}
• smb: client: validate dacloffset before building DACL pointers {CVE-2026-46195}
• smb/client: fix out-of-bounds read in symlink_data() {CVE-2026-46185}
• net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo {CVE-2026-46132}
• Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
• RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
• RDMA/mana: Validate rx_hash_key_len {CVE-2026-46145}
• scsi: qla2xxx: Completely fix fcport double free {CVE-2026-43414}
• bpf: Fix bpf_xdp_store_bytes proto for read-only arg {CVE-2026-45886}
• libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
• wifi: mac80211: use safe list iteration in radar detect work {CVE-2026-46166}
• RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads {CVE-2026-46114}
• nfsd: never defer requests during idmap lookup {CVE-2026-45983}
• drop_monitor: fix size calculations for 64-bit attributes {CVE-2026-68287}
• openvswitch: cap upcall PID array size and pre-size vport replies {CVE-2026-45840}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069}
• dm mirror: fix integer overflow in create_dirty_log() {CVE-2026-46023}
• netfilter: nft_inner: Fix IPv6 inner_thoff desync {CVE-2026-46244}
• drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() {CVE-2026-68429}
• crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033}
• RDMA/rxe: Fix race condition in QP timer handlers {CVE-2026-45910}
• wifi: mac80211: remove station if connection prep fails {CVE-2026-46125}
• tcp: call sk_data_ready() after listener migration {CVE-2026-46015}
• scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk {CVE-2025-38289}
• net/sched: act_ct: Only release RCU read lock after ct_ft {CVE-2026-46319}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• io-wq: check that the predecessor is hashed in io_wq_remove_pending() {CVE-2026-46274}
• wifi: mac80211: drop stray 'static' from fast-RX rx_result {CVE-2026-46152}
• io_uring/poll: fix signed comparison in io_poll_get_ownership() {CVE-2026-52933}
• xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
• Bluetooth: btusb: validate Realtek vendor event length {CVE-2026-68339}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• netfilter: nft_exthdr: fix register tracking for F_PRESENT flag {CVE-2026-53218}
• ipc: limit next_id…

In the Linux kernel, the following vulnerability has been resolved:

tracing/histogram: Fix a potential memory leak for kstrdup()

kfree() is missing on an error path to free the memory allocated by kstrdup():

p = param = kstrdup(data->params[i], GFP_KERNEL);

So it is better to free it via kfree(p).

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47247: net/mlx5e: Fix use-after-free of encap entry in neigh update handler (bsc#1224865).
• CVE-2021-47311: net: qcom/emac: fix UAF in emac_remove (bsc#1225010).
• CVE-2021-47368: enetc: Fix illegal access when reading affinity_hint (bsc#1225161).
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2022-48760: USB: core: Fix hang in usb_kill_urb by adding memory barriers (bsc#1226712).
• CVE-2023-52707: sched/psi: Fix use-after-free in ep_remove_wait_queue() (bsc#1225109). polled (bsc#1202623).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
• CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1224703).
• CVE-2024-36894: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (bsc#1225749).
• CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
• CVE-2024-36940: pinctrl: core: delete incorrect free in pinctrl_enable() (bsc#1225840).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
• CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595)
• CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226758).
• CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).

The following non-security bugs were fixed:

• NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633 bsc#1226226).
• ocfs2: adjust enabling place for la window (bsc#1219224).
• ocfs2: fix sparse warnings (bsc#1219224).
• ocfs2: improve write IO performance when fragmentation is high (bsc#1219224).
• ocfs2: speed up chain-list searching (bsc#1219224).
• psi: Fix uaf issue when psi trigger is destroyed while being
• x86/tsc: Trust initial offset in architectural TSC-adjust MSRs (bsc#1222015 bsc#1226962).

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958.
• CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
• CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
• CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
• CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
• CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
• CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
• CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
• CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
• CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
• CVE-2023-52869: pstore/platform: Add check for kstrdup (bsc#1225050).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2023-52882: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change (bsc#1225692).
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
• CVE-2024-26644: btrfs: do not abort filesystem when attempting to snapshot deleted subvolume (bsc#1221282bsc#1222072).
• CVE-2024-26720: mm: Avoid overflows in dirty throttling logic (bsc#1222364).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
• CVE-2024-26973: fat: fix uninitialized field in nostale filehandles (git-fixesbsc#1223641).
• CVE-2024-27432: net: ethernet: mtk_eth_soc: fix PPE hanging issue (bsc#1224716).
• CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
• CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
• CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (bsc#1224712).
• CVE-2024-35807: ext4: fix corruption during on-line resize (bsc#1224735).
• CVE-2024-35835: net/mlx5e: fix a double-free in arfs_create_groups (bsc#1224605).
• CVE-2024-35848: eeprom: at24: fix memory corruption race condition (bsc#1224612).
• CVE-2024-35857: icmp: prevent possible NULL dereferences from icmp_build_probe() (bsc#1224619).
• CVE-2024-35861:…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.


The following security bugs were fixed:

- CVE-2021-47247: net/mlx5e: Fix use-after-free of encap entry in neigh update handler (bsc#1224865).
- CVE-2021-47311: net: qcom/emac: fix UAF in emac_remove (bsc#1225010).
- CVE-2021-47368: enetc: Fix illegal access when reading affinity_hint (bsc#1225161).
- CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
- CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
- CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
- CVE-2022-2938: psi: Fix uaf issue when psi trigger is destroyed while being polled (bsc#1202623).
- CVE-2022-48760: USB: core: Fix hang in usb_kill_urb by adding memory barriers (bsc#1226712).
- CVE-2023-52707: sched/psi: Fix use-after-free in ep_remove_wait_queue() (bsc#1225109). polled (bsc#1202623).
- CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
- CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
- CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
- CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
- CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
- CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
- CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
- CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1224703).
- CVE-2024-36894: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (bsc#1225749).
- CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
- CVE-2024-36940: pinctrl: core: delete incorrect free in pinctrl_enable() (bsc#1225840).
- CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
- CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595).
- CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
- CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).

The following non-security bugs were fixed:

- NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633 bsc#1226226).
- ocfs2: adjust enabling place for la window (bsc#1219224).
- ocfs2: fix sparse warnings (bsc#1219224).
- ocfs2: improve write IO performance when fragmentation is high (bsc#1219224).
- ocfs2: speed up chain-list searching (bsc#1219224).
- psi: Fix uaf issue when psi trigger is destroyed while being
- x86/tsc: Trust initial offset in architectural TSC-adjust MSRs (bsc#1222015 bsc#1226962).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958.
• CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
• CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
• CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
• CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
• CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
• CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
• CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
• CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
• CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
• CVE-2023-52869: pstore/platform: Add check for kstrdup (bsc#1225050).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2023-52882: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change (bsc#1225692).
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
• CVE-2024-26644: btrfs: do not abort filesystem when attempting to snapshot deleted subvolume (bsc#1221282, bsc#1222072).
• CVE-2024-26720: mm: Avoid overflows in dirty throttling logic (bsc#1222364).
• CVE-2024-26845: scsi: target: core: Add TMF to tmr_list handling (bsc#1223018).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
• CVE-2024-26973: fat: fix uninitialized field in nostale filehandles (bsc#1223641).
• CVE-2024-27432: net: ethernet: mtk_eth_soc: fix PPE hanging issue (bsc#1224716).
• CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
• CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
• CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (bsc#1224712).
• CVE-2024-35807: ext4: fix corruption during on-line resize (bsc#1224735).
• CVE-2024-35835: net/mlx5e: fix a double-free in arfs_create_groups (bsc#1224605).
• CVE-2024-35848: eeprom: at24: fix memory corruption race condition (bsc#1224612).
• CVE-2024-35857: icmp: prevent possible…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-41069: ASoC: topology: Fix route memory corruption (bsc#1228644).
• CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808)
• CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743).
• CVE-2024-40994: ptp: fix integer overflow in max_vclocks_store (bsc#1227829).
• CVE-2024-41012: filelock: Remove locks reliably when fcntl/close race is detected (bsc#1228247).
• CVE-2024-42093: net/dpaa2: Avoid explicit cpumask var allocation on stack (bsc#1228680).
• CVE-2024-40989: KVM: arm64: Disassociate vcpus from redistributor region on teardown (bsc#1227823).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
• CVE-2024-40956: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list (bsc#1227810).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2024-39463: 9p: add missing locking around taking dentry fid list (bsc#1227090).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-35901: net: mana: Fix Rx DMA datasize and skb_over_panic (bsc#1224495).
• CVE-2024-42230: powerpc/pseries: Fix scv instruction crash with kexec (bsc#1194869).
• CVE-2024-36974: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (bsc#1226519).
• CVE-2024-38555: net/mlx5: Discard command completions in internal error (bsc#1226607).

The following non-security bugs were fixed:

• NFS: Do not re-read the entire page cache to find the next cookie (bsc#1226662).
• NFS: Reduce use of uncached readdir (bsc#1226662).
• NFSv4.x: by default serialize open/close operations (bsc#1226226 bsc#1223863).
• X.509: Fix the parser of extended key usage for length (bsc#1218820).
• btrfs: sysfs: update fs features directory asynchronously (bsc#1226168).
• cgroup/cpuset: Prevent UAF in proc_cpuset_show() (bsc#1228801).
• jfs: xattr: fix buffer overflow for invalid xattr (bsc#1227383).
• kABI: rtas: Workaround false positive due to lost definition (bsc#1227487).
• kernel-binary: vdso: Own module_dir
• net/dcb: check for detached device before executing callbacks (bsc#1215587).
• ocfs2: fix DIO failure due to insufficient transaction credits (bsc#1216834).
• powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() (bsc#1227487).
• powerpc/rtas: clean up includes (bsc#1227487).
• workqueue: Improve scalability of workqueue watchdog touch (bsc#1193454).
• workqueue: wq_watchdog_touch is always called with valid CPU (bsc#1193454).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-41069: ASoC: topology: Fix route memory corruption (bsc#1228644).
• CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808)
• CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743)
• CVE-2024-40994: ptp: fix integer overflow in max_vclocks_store (bsc#1227829).
• CVE-2024-41012: filelock: Remove locks reliably when fcntl/close race is detected (bsc#1228247).
• CVE-2024-42093: net/dpaa2: Avoid explicit cpumask var allocation on stack (bsc#1228680).
• CVE-2024-40989: KVM: arm64: Disassociate vcpus from redistributor region on teardown (bsc#1227823).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
• CVE-2024-40956: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list (bsc#1227810).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2024-39463: 9p: add missing locking around taking dentry fid list (bsc#1227090).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-35901: net: mana: Fix Rx DMA datasize and skb_over_panic (bsc#1224495).
• CVE-2024-42230: powerpc/pseries: Fix scv instruction crash with kexec (bsc#1194869).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2024-36974: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (bsc#1226519).
• CVE-2024-38555: net/mlx5: Discard command completions in internal error (bsc#1226607).

The following non-security bugs were fixed:

• NFS: Do not re-read the entire page cache to find the next cookie (bsc#1226662).
• NFS: Reduce use of uncached readdir (bsc#1226662).
• NFSv4.x: by default serialize open/close operations (bsc#1226226 bsc#1223863).
• X.509: Fix the parser of extended key usage for length (bsc#1218820).
• btrfs: sysfs: update fs features directory asynchronously (bsc#1226168).
• cgroup/cpuset: Prevent UAF in proc_cpuset_show() (bsc#1228801).
• jfs: xattr: fix buffer overflow for invalid xattr (bsc#1227383).
• kABI: rtas: Workaround false positive due to lost definition (bsc#1227487).
• kernel-binary: vdso: Own module_dir
• net/dcb: check for detached device before executing callbacks (bsc#1215587).
• ocfs2: fix DIO failure due to insufficient transaction credits (bsc#1216834).
• powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() (bsc#1227487).
• powerpc/rtas: clean up includes (bsc#1227487).
• workqueue: Improve scalability of workqueue watchdog touch (bsc#1193454).
• workqueue: wq_watchdog_touch is always called with valid CPU (bsc#1193454).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
• CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958).
• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47186: tipc: check for null after calling kmemdup (bsc#1222702).
• CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
• CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
• CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
• CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
• CVE-2021-47546: ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
• CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
• CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
• CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
• CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571).
• CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len. (bsc#1226555).
• CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
• CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
• CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
• CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
• CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071).
• CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869).
• CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
• CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
• CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52787: blk-mq: make…