CVE-2022-49014

net: tun: Fix use-after-free in tun_detach()

7.8 HighFix available

What does this mean?

: 7.8v3.1, from CVE List
: 0.26%18th percentile
Fixed in: 4.19.268Kernel
Published: October 21, 2024
Modified: November 3, 2026
Weakness: CWE-416
Also known as: CLSA-2024-1731430561CLSA-2024-1731431059CLSA-2024-1731431756CLSA-2025-1749480611DEBIAN-CVE-2022-49014EUVD-2022-53898GHSA-rm44-23mc-xq5wOESA-2025-1016
Show 23 moreShow less
RHSA-2025:6966SUSE-SU-2024:3983-1SUSE-SU-2024:3985-1SUSE-SU-2024:4081-1SUSE-SU-2024:4082-1SUSE-SU-2024:4100-1SUSE-SU-2024:4103-1SUSE-SU-2024:4131-1SUSE-SU-2024:4140-1SUSE-SU-2024:4364-1SUSE-SU-2025:0034-1SUSE-SU-2025:1213-1SUSE-SU-2025:1225-1SUSE-SU-2025:1231-1SUSE-SU-2025:1236-1SUSE-SU-2025:1248-1SUSE-SU-2025:1254-1SUSE-SU-2025:1259-1SUSE-SU-2025:1260-1SUSE-SU-2025:1262-1SUSE-SU-2025:1278-1SUSE-SU-2025:4123-1UBUNTU-CVE-2022-49014

In the Linux kernel, the following vulnerability has been resolved:

net: tun: Fix use-after-free in tun_detach()

syzbot reported use-after-free in tun_detach() [1]. This causes call trace like below:

================================================================== BUG: KASAN: use-after-free in notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75 Read of size 8 at addr ffff88807324e2a8 by task syz-executor.0/3673

CPU: 0 PID: 3673 Comm: syz-executor.0 Not tainted 6.1.0-rc5-syzkaller-00044-gcc675d22e422 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15e/0x461 mm/kasan/report.c:395 kasan_report+0xbf/0x1f0 mm/kasan/report.c:495 notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75 call_netdevice_notifiers_info+0x86/0x130 net/core/dev.c:1942 call_netdevice_notifiers_extack net/core/dev.c:1983 [inline] call_netdevice_notifiers net/core/dev.c:1997 [inline] netdev_wait_allrefs_any net/core/dev.c:10237 [inline] netdev_run_todo+0xbc6/0x1100 net/core/dev.c:10351 tun_detach drivers/net/tun.c:704 [inline] tun_chr_close+0xe4/0x190 drivers/net/tun.c:3467 __fput+0x27c/0xa90 fs/file_table.c:320 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xb3d/0x2a30 kernel/exit.c:820 do_group_exit+0xd4/0x2a0 kernel/exit.c:950 get_signal+0x21b1/0x2440 kernel/signal.c:2858 arch_do_signal_or_restart+0x86/0x2300 arch/x86/kernel/signal.c:869 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The cause of the issue is that sock_put() from __tun_detach() drops last reference count for struct net, and then notifier_call_chain() from netdev_state_change() accesses that struct net.

This patch fixes the issue by calling sock_put() from tun_detach() after all necessary accesses for the struct net has done.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.26%Up 0.2 points since Oct 22, 2024

What each source reports

CVE List Score used 7.8

net: tun: Fix use-after-free in tun_detach()

In the Linux kernel, the following vulnerability has been resolved:

net: tun: Fix use-after-free in tun_detach()

syzbot reported use-after-free in tun_detach() [1]. This causes call trace like below:

The cause of the issue is that sock_put() from __tun_detach() drops last reference count for struct net, and then notifier_call_chain() from netdev_state_change() accesses that struct net.

This patch fixes the issue by calling sock_put() from tun_detach() after all necessary accesses for the struct net has done.

Record: CVE-2022-49014
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2022-53898 7.8

In the Linux kernel, the following vulnerability has been resolved:

net: tun: Fix use-after-free in tun_detach()

syzbot reported use-after-free in tun_detach() [1]. This causes call trace like below:

The cause of the issue is that sock_put() from __tun_detach() drops last reference count for struct net, and then notifier_call_chain() from netdev_state_change() accesses that struct net.

This patch fixes the issue by calling sock_put() from tun_detach() after all necessary accesses for the struct net has done.

Record: EUVD-2022-53898
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rm44-23mc-xq5w 7.8

In the Linux kernel, the following vulnerability has been resolved: net: tun: Fix use-after-free...

In the Linux kernel, the following vulnerability has been resolved:

net: tun: Fix use-after-free in tun_detach()

syzbot reported use-after-free in tun_detach() [1]. This causes call trace like below:

The cause of the issue is that sock_put() from __tun_detach() drops last reference count for struct net, and then notifier_call_chain() from netdev_state_change() accesses that struct net.

This patch fixes the issue by calling sock_put() from tun_detach() after all necessary accesses for the struct net has done.

Record: GHSA-rm44-23mc-xq5w
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

net: tun: Fix use-after-free in tun_detach()

syzbot reported use-after-free in tun_detach() [1]. This causes call trace like below:

The cause of the issue is that sock_put() from __tun_detach() drops last reference count for struct net, and then notifier_call_chain() from netdev_state_change() accesses that struct net.

This patch fixes the issue by calling sock_put() from tun_detach() after all necessary accesses for the struct net has done.

Record: CVE-2022-49014
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSV 7.8

net: tun: Fix use-after-free in tun_detach()

In the Linux kernel, the following vulnerability has been resolved:

net: tun: Fix use-after-free in tun_detach()

syzbot reported use-after-free in tun_detach() [1]. This causes call trace like below:

The cause of the issue is that sock_put() from __tun_detach() drops last reference count for struct net, and then notifier_call_chain() from netdev_state_change() accesses that struct net.

This patch fixes the issue by calling sock_put() from tun_detach() after all necessary accesses for the struct net has done.

Record: CVE-2022-49014
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1016 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: Let probe fail when workqueue cannot be enabled

The workqueue is enabled when the appropriate driver is loaded and disabled when the driver is removed. When the driver is removed it assumes that the workqueue was enabled successfully and proceeds to free allocations made during workqueue enabling.

Failure during workqueue enabling does not prevent the driver from being loaded. This is because the error path within drv_enable_wq() returns success unless a second failure is encountered during the error path. By returning success it is possible to load the driver even if the workqueue cannot be enabled and allocations that do not exist are attempted to be freed during driver remove.

Some examples of problematic flows: (a)

idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq(): In above flow, if idxd_wq_request_irq() fails then idxd_wq_unmap_portal() is called on error exit path, but drv_enable_wq() returns 0 because idxd_wq_disable() succeeds. The driver is thus loaded successfully.

idxd_dmaengine_drv_remove()->drv_disable_wq()->idxd_wq_unmap_portal() Above flow on driver unload triggers the WARN in devm_iounmap() because the device resource has already been removed during error path of drv_enable_wq().

(b)

idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq(): In above flow, if idxd_wq_request_irq() fails then idxd_wq_init_percpu_ref() is never called to initialize the percpu counter, yet the driver loads successfully because drv_enable_wq() returns 0.

idxd_dmaengine_drv_remove()->__idxd_wq_quiesce()->percpu_ref_kill(): Above flow on driver unload triggers a BUG when attempting to drop the initial ref of the uninitialized percpu ref: BUG: kernel NULL pointer dereference, address: 0000000000000010

Fix the drv_enable_wq() error path by returning the original error that indicates failure of workqueue enabling. This ensures that the probe fails when an error is encountered and the driver remove paths are only attempted when the workqueue was enabled successfully.(CVE-2022-48868)

In the Linux kernel, the following vulnerability has been resolved: igb: Initialize mailbox message for VF reset When a MAC address is not assigned to the VF, that portion of the message sent to the VF is not set. The memory, however, is allocated from the stack meaning that information may be leaked to the VM. Initialize the message buffer to 0 so that no information is passed to the VM in this case.(CVE-2022-48949)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix not cleanup led when bt_init fails bt_init() calls bt_leds_init() to register led, but if it fails later, bt_leds_cleanup() is not called to unregister it. This can cause panic if the argument "bluetooth-power" in text is freed and then another led_trigger_register() tries to access it: BUG: unable to handle page fault for address: ffffffffc06d3bc0 RIP: 0010:strcmp+0xc/0x30 Call Trace: <TASK> led_trigger_register+0x10d/0x4f0 led_trigger_register_simple+0x7d/0x100 bt_init+0x39/0xf7 [bluetooth] do_one_initcall+0xd0/0x4e0(CVE-2022-48971)

Record: OESA-2025-1016
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 28 moreShow less

OSVRHSA-2025:6966 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2025:6966
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-49014 7.3

In the Linux kernel, the following vulnerability has been resolved: net: tun: Fix use-after-free in tun_detach() syzbot reported use-after-free in tun_detach() [1]. This causes call trace like below: ================================================================== BUG: KASAN: use-after-free in notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75 Read of size 8 at addr ffff88807324e2a8 by task syz-executor.0/3673 CPU: 0 PID: 3673 Comm: syz-executor.0 Not tainted 6.1.0-rc5-syzkaller-00044-gcc675d22e422 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15e/0x461 mm/kasan/report.c:395 kasan_report+0xbf/0x1f0 mm/kasan/report.c:495 notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75 call_netdevice_notifiers_info+0x86/0x130 net/core/dev.c:1942 call_netdevice_notifiers_extack net/core/dev.c:1983 [inline] call_netdevice_notifiers net/core/dev.c:1997 [inline] netdev_wait_allrefs_any net/core/dev.c:10237 [inline] netdev_run_todo+0xbc6/0x1100 net/core/dev.c:10351 tun_detach drivers/net/tun.c:704 [inline] tun_chr_close+0xe4/0x190 drivers/net/tun.c:3467 __fput+0x27c/0xa90 fs/file_table.c:320 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xb3d/0x2a30 kernel/exit.c:820 do_group_exit+0xd4/0x2a0 kernel/exit.c:950 get_signal+0x21b1/0x2440 kernel/signal.c:2858 arch_do_signal_or_restart+0x86/0x2300 arch/x86/kernel/signal.c:869 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd The cause of the issue is that sock_put() from __tun_detach() drops last reference count for struct net, and then notifier_call_chain() from netdev_state_change() accesses that struct net. This patch fixes the issue by calling sock_put() from tun_detach() after all necessary accesses for the struct net has done.

Record: UBUNTU-CVE-2022-49014
CVSS 4.0: 7.3 HighCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2024-1731430561 No score

kernel: Fix of 29 CVEs

driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}
memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
tipc: guard against string buffer overrun {CVE-2024-49995}
ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
padata: Fix possible divide-by-0 panic in padata_mt_helper() {CVE-2024-43889}
hwmon: (coretemp) Check for null before removing sysfs attrs {CVE-2022-49010}
drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error {CVE-2024-47697}
wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
ipv6: avoid use-after-free in ip6_fragment() {CVE-2022-48956}
netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
firmware_loader: Block path traversal {CVE-2024-47742}
ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
tcp: drop the hash_32() part from the index calculation {CVE-2022-1012}
tcp: increase source port perturb table to 2^16 {CVE-2022-1012}
tcp: dynamically allocate the perturb table used by source ports {CVE-2022-1012}
net: dccp: fix kernel crash on module load {CVE-2022-1012}
net: dccp: initialize (addr,port) listening hashtable {CVE-2022-1012}
tcp: add small random increments to the source port {CVE-2022-1012}
tcp: resalt the secret every 10 seconds {CVE-2022-1012}
tcp: use different parts of the port_offset for index and offset {CVE-2022-1012}
secure_seq: use the 64 bits of the siphash for port offset calculation {CVE-2022-1012}
Revert "[ELSCVE-6395] secure_seq: use the 64 bits of the siphash for port offset calculation" {CVE-2022-1012}
tcp: add some entropy in __inet_hash_connect() {CVE-2022-1012}
tcp: change source port randomizarion at connect() time {CVE-2022-1012}
esp: limit skb_page_frag_refill use to a single page {CVE-2022-27666}
drm/vmwgfx: Fix stale file descriptors on failed usercopy {CVE-2022-22942}
drm/i915: Fix the GT fence revocation runtime PM logic {CVE-2022-0330}
PM: runtime: Add pm_runtime_get_if_active() {CVE-2022-0330}
PM-runtime: add tracepoints for usage_count changes {CVE-2022-0330}
fget: clarify and improve __fget_files() implementation {CVE-2021-4083}
proc/fd: In proc_fd_link use fget_task {CVE-2021-4083}
kcmp: In kcmp_epoll_target use fget_task {CVE-2021-4083}
file: Rename __fcheck_files to files_lookup_fd_raw {CVE-2021-4083}
bpf: In bpf_task_fd_query use fget_task {CVE-2021-4083}
fget: check that the fd still exists after getting a ref to it {CVE-2021-4083}
Revert "[ELSCVE-2732] fget: check that the fd still exists after getting a ref to it" {CVE-2021-4083}
file: Replace fcheck_files with files_lookup_fd_rcu {CVE-2021-4083}
file: Factor files_lookup_fd_locked out of fcheck_files {CVE-2021-4083}
vfs, fdtable: Add fget_task helper {CVE-2021-4083}

Record: CLSA-2024-1731430561
Updated: 2026-11-02

OSVCLSA-2024-1731431059 No score

kernel: Fix of 29 CVEs

driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}
memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
tipc: guard against string buffer overrun {CVE-2024-49995}
ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
padata: Fix possible divide-by-0 panic in padata_mt_helper() {CVE-2024-43889}
hwmon: (coretemp) Check for null before removing sysfs attrs {CVE-2022-49010}
drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error {CVE-2024-47697}
wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
ipv6: avoid use-after-free in ip6_fragment() {CVE-2022-48956}
netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
firmware_loader: Block path traversal {CVE-2024-47742}
ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
tcp: drop the hash_32() part from the index calculation {CVE-2022-1012}
tcp: increase source port perturb table to 2^16 {CVE-2022-1012}
tcp: dynamically allocate the perturb table used by source ports {CVE-2022-1012}
net: dccp: fix kernel crash on module load {CVE-2022-1012}
net: dccp: initialize (addr,port) listening hashtable {CVE-2022-1012}
tcp: add small random increments to the source port {CVE-2022-1012}
tcp: resalt the secret every 10 seconds {CVE-2022-1012}
tcp: use different parts of the port_offset for index and offset {CVE-2022-1012}
secure_seq: use the 64 bits of the siphash for port offset calculation {CVE-2022-1012}
Revert "[ELSCVE-6395] secure_seq: use the 64 bits of the siphash for port offset calculation" {CVE-2022-1012}
tcp: add some entropy in __inet_hash_connect() {CVE-2022-1012}
tcp: change source port randomizarion at connect() time {CVE-2022-1012}
esp: limit skb_page_frag_refill use to a single page {CVE-2022-27666}
drm/vmwgfx: Fix stale file descriptors on failed usercopy {CVE-2022-22942}
PM-runtime: add tracepoints for usage_count changes {CVE-2022-0330}
fget: clarify and improve __fget_files() implementation {CVE-2021-4083}
proc/fd: In proc_fd_link use fget_task {CVE-2021-4083}
kcmp: In kcmp_epoll_target use fget_task {CVE-2021-4083}
file: Rename __fcheck_files to files_lookup_fd_raw {CVE-2021-4083}
fget: check that the fd still exists after getting a ref to it {CVE-2021-4083}
Revert "[ELSCVE-2732] fget: check that the fd still exists after getting a ref to it" {CVE-2021-4083}
file: Replace fcheck_files with files_lookup_fd_rcu {CVE-2021-4083}
file: Factor files_lookup_fd_locked out of fcheck_files {CVE-2021-4083}

Record: CLSA-2024-1731431059
Updated: 2026-11-02

OSVCLSA-2024-1731431756 No score

kernel: Fix of 30 CVEs

tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
ext4: fix slab-use-after-free in ext4_split_extent_at() {CVE-2024-49884}
mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX {CVE-2024-46871}
Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950}
Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit {CVE-2024-49950}
driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
padata: Fix possible divide-by-0 panic in padata_mt_helper() {CVE-2024-43889}
wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}
ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
tipc: guard against string buffer overrun {CVE-2024-49995}
ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error {CVE-2024-47697}
slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
net: delete "register" keyword {CVE-2024-50033}
drm/amd/display: fix double free issue during amdgpu module unload {CVE-2024-49989}
drm/amd/display: Fix index out of bounds in degamma hardware format translation {CVE-2024-49894}
drm/amd/display: Fix index out of bounds in DCN30 color transformation {CVE-2024-49969}
drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation {CVE-2024-49895}
ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change {CVE-2021-47624}

Record: CLSA-2024-1731431756
Updated: 2026-11-02

OSVCLSA-2025-1749480611 No score

kernel: Fix of 26 CVEs

rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow {CVE-2024-38577}
tcp: fix mptcp DSS corruption due to large pmtu xmit {CVE-2024-50083}
vsock: Keep the binding until socket destruction {CVE-2025-21756}
memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove {CVE-2025-22020}
drm/i915: Fix potential bit_17 double-free {CVE-2023-52930}
netfilter: nft_tunnel: fix geneve_opt type confusion addition {CVE-2025-22056}
mm: shmem: fix data-race in shmem_getattr() {CVE-2024-46828}
nvmet-auth: assign dh_key to NULL after kfree_sensitive {CVE-2024-50215}
net: explicitly clear the sk pointer, when pf->create fails {CVE-2024-50186}
net: wwan: fix global oob in wwan_rtnl_policy {CVE-2024-50128}
ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free {CVE-2024-49983}
vhost_vdpa: assign irq bypass producer token correctly {CVE-2024-47748}
wifi: rtw88: always wait for both firmware loading attempts {CVE-2024-47718}
sched: sch_cake: fix bulk flow accounting logic for host fairness {CVE-2024-46828}
fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF {CVE-2024-46786}
net: bridge: mcast: wait for previous gc cycles when removing port {CVE-2024-44934}
vhost/vsock: always initialize seqpacket_allow {CVE-2024-43873}
ext4: check dot and dotdot of dx_root before making dir indexed {CVE-2024-42305}
nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync {CVE-2024-53208}
wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one {CVE-2024-56663}
Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006}
net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}

Record: CLSA-2025-1749480611
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-49014 No score

Record: DEBIAN-CVE-2022-49014
Updated: 2026-11-03

OSVSUSE-SU-2024:3983-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
CVE-2022-48957: dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() (bsc#1231973).
CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
CVE-2022-48980: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() (bsc#1232233).
CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070 git-fix prerequisity).
CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
CVE-2022-49017: tipc: re-fetch skb cb after tipc_msg_validate (bsc#1232004).
CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB (bsc#1228709).
CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005 stable-fixes).
CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837 stable-fixes).
CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
CVE-2024-46716: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor (bsc#1230715).
CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
CVE-2024-46809: drm/amd/display: Check BIOS images before it is used (bsc#1231148).
CVE-2024-46811: drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box (bsc#1231179).
CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231195).
CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (bsc#1231200).
CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
CVE-2024-46828: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1231114).
CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
CVE-2024-46841: btrfs: do not BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() (bsc#1231094).
CVE-2024-46848: perf/x86/intel: Limit the period on Haswell (bsc#1231072).
CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
CVE-2024-47660: fsnotify: clear…

Record: SUSE-SU-2024:3983-1
Updated: 2026-11-02

OSVSUSE-SU-2024:3985-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
CVE-2022-48957: dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() (bsc#1231973).
CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
CVE-2022-48980: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() (bsc#1232233).
CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
CVE-2022-49017: tipc: re-fetch skb cb after tipc_msg_validate (bsc#1232004).
CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB (bsc#1228709).
CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005).
CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837).
CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
CVE-2024-46716: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor (bsc#1230715).
CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
CVE-2024-46809: drm/amd/display: Check BIOS images before it is used (bsc#1231148).
CVE-2024-46811: drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box (bsc#1231179).
CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231195).
CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (bsc#1231200).
CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
CVE-2024-46828: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1231114).
CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
CVE-2024-46841: btrfs: do not…

Record: SUSE-SU-2024:3985-1
Updated: 2026-11-02

OSVSUSE-SU-2024:4081-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
CVE-2022-48967: NFC: nci: Bounds check struct nfc_target arrays (bsc#1232304).
CVE-2022-48988: memcg: Fix possible use-after-free in memcg_write_event_control() (bsc#1232069).
CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
CVE-2022-49003: nvme: fix SRCU protection of nvme_ns_head list (bsc#1232136).
CVE-2022-49014: net: tun: Fix use-after-free in tun_detach() (bsc#1231890).
CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
CVE-2022-49023: wifi: cfg80211: fix buffer overflow in elem comparison (bsc#1231961).
CVE-2022-49025: net/mlx5e: Fix use-after-free when reverting termination table (bsc#1231960).
CVE-2024-36971: Fixed __dst_negative_advice() race (bsc#1226145).
CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
CVE-2024-45026: s390/dasd: fix error recovery leading to data corruption on ESE devices (bsc#1230454).
CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231195).
CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (bsc#1231200).
CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
CVE-2024-47668: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (bsc#1231502).
CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
CVE-2024-47747: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition (bsc#1232145).
CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231861).
CVE-2024-49936: net/xen-netback: prevent UAF in xenvif_flush_hash() (bsc#1232424).
CVE-2024-49969: drm/amd/display: Fix index out of bounds in DCN30 color transformation (bsc#1232519).
CVE-2024-49974: NFSD: Force all NFSv4.2 COPY requests to be synchronous (bsc#1232383).
CVE-2024-49991: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (bsc#1232282).
CVE-2024-49995: tipc: guard against string buffer overrun (bsc#1232432).
CVE-2024-50047: smb: client: fix UAF in async decryption (bsc#1232418).

The following non-security bugs were fixed:

kernel-binary: generate and install compile_commands.json (bsc#1228971)
kernel-binary: vdso: Own module_dir
bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (bsc#1231375).
mkspec-dtb: add toplevel symlinks also on arm
net: mana: Fix the extra HZ in mana_hwc_send_request (bsc#1232033).
scsi: ibmvfc: Add max_sectors module parameter (bsc#1216223).

Record: SUSE-SU-2024:4081-1
Updated: 2026-11-02

OSVSUSE-SU-2024:4082-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
CVE-2024-45013: nvme: move stopping keep-alive into nvme_uninit_ctrl() (bsc#1230442).
CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
CVE-2024-45026: s390/dasd: fix error recovery leading to data corruption on ESE devices (bsc#1230454).
CVE-2024-46716: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor (bsc#1230715).
CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231195).
CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (bsc#1231200).
CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
CVE-2024-47668: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (bsc#1231502).
CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
CVE-2024-47747: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition (bsc#1232145).
CVE-2024-47748: vhost_vdpa: assign irq bypass producer token correctly (bsc#1232174).
CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231861).
CVE-2024-49930: wifi: ath11k: fix array out-of-bound access in SoC stats (bsc#1232260).
CVE-2024-49936: net/xen-netback: prevent UAF in xenvif_flush_hash() (bsc#1232424).
CVE-2024-49960: ext4: fix timer use-after-free on failed mount (bsc#1232395).
CVE-2024-49969: drm/amd/display: Fix index out of bounds in DCN30 color transformation (bsc#1232519).
CVE-2024-49974: NFSD: Force all NFSv4.2 COPY requests to be synchronous (bsc#1232383).
CVE-2024-49991: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (bsc#1232282).
CVE-2024-49995: tipc: guard against string buffer overrun (bsc#1232432).
CVE-2024-50047: smb: client: fix UAF in async decryption (bsc#1232418).

The following non-security bugs were fixed:

NFSv3: only use NFS timeout for MOUNT when protocols are compatible (bsc#1231016).
PKCS#7: Check codeSigning EKU of certificates in PKCS#7 (bsc#1226666).
RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (bsc#1232036).
bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (bsc#1231375).
dn_route: set rt neigh to blackhole_netdev instead of loopback_dev in ifdown (bsc#1216813).
ipv6: blackhole_netdev needs snmp6 counters (bsc#1216813).
ipv6: give an IPv6 dev to blackhole_netdev (bsc#1216813).
net: mana: Fix the extra HZ in mana_hwc_send_request (bsc#1232033).
xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (bsc#1216813).

Record: SUSE-SU-2024:4082-1
Updated: 2026-11-02

OSVSUSE-SU-2024:4100-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The Linux Enterprise 12 SP5 kernel turned LTSS (Extended Security)

The following security bugs were fixed:

CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
CVE-2021-47163: kABI fix for tipc: wait and exit until all work queues are done (bsc#1221980).
CVE-2021-47612: nfc: fix segfault in nfc_genl_dump_devices_done (bsc#1226585).
CVE-2022-48809: net: fix a memleak when uncloning an skb dst and its metadata (bsc#1227947).
CVE-2022-48951: ASoC: ops: Correct bounds check for second channel on SX controls (bsc#1231929).
CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
CVE-2022-48967: NFC: nci: Bounds check struct nfc_target arrays (bsc#1232304).
CVE-2022-48971: Bluetooth: Fix not cleanup led when bt_init fails (bsc#1232037).
CVE-2022-48972: mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (bsc#1232025).
CVE-2022-48973: gpio: amd8111: Fix PCI device reference count leak (bsc#1232039).
CVE-2022-48978: HID: core: fix shift-out-of-bounds in hid_report_raw_event (bsc#1232038).
CVE-2022-48991: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths (bsc#1232070).
CVE-2022-48992: ASoC: soc-pcm: Add NULL check in BE reparenting (bsc#1232071).
CVE-2022-49000: iommu/vt-d: Fix PCI device refcount leak in has_external_pci() (bsc#1232123).
CVE-2022-49002: iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (bsc#1232133).
CVE-2022-49010: hwmon: (coretemp) Check for null before removing sysfs attrs (bsc#1232172).
CVE-2022-49011: hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (bsc#1232006).
CVE-2022-49014: net: tun: Fix use-after-free in tun_detach() (bsc#1231890).
CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
CVE-2022-49021: net: phy: fix null-ptr-deref while probe() failed (bsc#1231939).
CVE-2022-49026: e100: Fix possible use after free in e100_xmit_prepare (bsc#1231997).
CVE-2022-49027: iavf: Fix error handling in iavf_init_module() (bsc#1232007).
CVE-2022-49028: ixgbevf: Fix resource leak in ixgbevf_init_module() (bsc#1231996).
CVE-2022-49029: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (bsc#1231995).
CVE-2023-52898: xhci: Fix null pointer dereference when host dies (bsc#1229568).
CVE-2023-52918: media: pci: cx23885: check cx23885_vdev_init() return (bsc#1232047).
CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).
CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).
CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
CVE-2024-42114: netlink: extend policy range validation (bsc#1228564 prerequisite).
CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005 stable-fixes).
CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837 stable-fixes).
CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
CVE-2024-46724: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number (bsc#1230725).
CVE-2024-46755: wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() (bsc#1230802). -…

Record: SUSE-SU-2024:4100-1
Updated: 2026-11-02

OSVSUSE-SU-2024:4103-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47589: igbvf: fix double free in igbvf_probe (bsc#1226557).
CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
CVE-2022-48967: NFC: nci: Bounds check struct nfc_target arrays (bsc#1232304).
CVE-2022-48988: memcg: Fix possible use-after-free in memcg_write_event_control() (bsc#1206344 bsc#1232069).
CVE-2022-48991: khugepaged: retract_page_tables() remember to test exit (bsc#1232070).
CVE-2022-49003: nvme: fix SRCU protection of nvme_ns_head list (bsc#1232136).
CVE-2022-49014: net: tun: Fix use-after-free in tun_detach() (bsc#1231890).
CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
CVE-2022-49023: wifi: cfg80211: fix buffer overflow in elem comparison (bsc#1231961).
CVE-2022-49025: net/mlx5e: Fix use-after-free when reverting termination table (bsc#1231960).
CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (bsc#1231200).
CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
CVE-2024-47668: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (bsc#1231502).
CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
CVE-2024-47747: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition (bsc#1232145).
CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231861).
CVE-2024-49936: net/xen-netback: prevent UAF in xenvif_flush_hash() (bsc#1232424).
CVE-2024-49974: NFSD: Force all NFSv4.2 COPY requests to be synchronous (bsc#1232383).
CVE-2024-49991: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (bsc#1232282).
CVE-2024-49995: tipc: guard against string buffer overrun (bsc#1232432).
CVE-2024-50047: smb: client: fix UAF in async decryption (bsc#1232418).

The following non-security bugs were fixed:

initrd: Revert 'build initrd without systemd' (bsc#1195775).
bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (bsc#1231375).
kernel-binary.spec.in: Enable klp_symbols on openSUSE Tumbleweed (boo#1229042).
kernel-binary: generate and install compile_commands.json (bsc#1228971).
net: mana: Fix the extra HZ in mana_hwc_send_request (bsc#1232033).
rpm/check-for-config-changes: Exclude ARCH_USING_PATCHABLE_FUNCTION_ENTRY gcc version dependent, at least on ppc
rpm/check-for-config-changes: add HAVE_RUST and RUSTC_SUPPORTS_ to IGNORED_CONFIGS_RE They depend on SHADOW_CALL_STACK.
rpm/kernel-binary.spec.in: Fix build regression The previous fix forgot to take over grep -c option that broke the conditional expression.
rpm/kernel-binary.spec.in: fix klp_symbols macro The commit below removed openSUSE filter from %ifs of the klp_symbols definition (boo#1229042).
rpm/kernel-obs-build.spec.in: Some builds do not just create an iso9660 image, but also mount it during build (bsc#1226212).
rpm/kernel-obs-build.spec.in: Add networking modules for docker (bsc#1226211).
rpm/release-projects: Add SLFO projects (bsc#1231293).

Record: SUSE-SU-2024:4103-1
Updated: 2026-11-02

OSVSUSE-SU-2024:4131-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)
CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
CVE-2024-45013: nvme: move stopping keep-alive into nvme_uninit_ctrl() (bsc#1230442).
CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
CVE-2024-45026: s390/dasd: fix error recovery leading to data corruption on ESE devices (bsc#1230454).
CVE-2024-46716: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor (bsc#1230715).
CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231195).
CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (bsc#1231200).
CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
CVE-2024-47668: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (bsc#1231502).
CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
CVE-2024-47747: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition (bsc#1232145).
CVE-2024-47748: vhost_vdpa: assign irq bypass producer token correctly (bsc#1232174).
CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231861).
CVE-2024-49930: wifi: ath11k: fix array out-of-bound access in SoC stats (bsc#1232260).
CVE-2024-49936: net/xen-netback: prevent UAF in xenvif_flush_hash() (bsc#1232424).
CVE-2024-49960: ext4: fix timer use-after-free on failed mount (bsc#1232395).
CVE-2024-49969: drm/amd/display: Fix index out of bounds in DCN30 color transformation (bsc#1232519).
CVE-2024-49974: NFSD: Force all NFSv4.2 COPY requests to be synchronous (bsc#1232383).
CVE-2024-49991: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (bsc#1232282).
CVE-2024-49995: tipc: guard against string buffer overrun (bsc#1232432).
CVE-2024-50047: smb: client: fix UAF in async decryption (bsc#1232418).

The following non-security bugs were fixed:

NFSv3: only use NFS timeout for MOUNT when protocols are compatible (bsc#1231016).
PKCS#7: Check codeSigning EKU of certificates in PKCS#7 (bsc#1226666).
RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (bsc#1232036).
bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (bsc#1231375).
dn_route: set rt neigh to blackhole_netdev instead of loopback_dev in…

Record: SUSE-SU-2024:4131-1
Updated: 2026-11-02

OSVSUSE-SU-2024:4140-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47589: igbvf: fix double free in igbvf_probe (bsc#1226557).
CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
CVE-2022-48967: NFC: nci: Bounds check struct nfc_target arrays (bsc#1232304).
CVE-2022-48988: memcg: Fix possible use-after-free in memcg_write_event_control() (bsc#1232069).
CVE-2022-48991: khugepaged: retract_page_tables() remember to test exit (bsc#1232070 prerequisity).
CVE-2022-49003: nvme: fix SRCU protection of nvme_ns_head list (bsc#1232136).
CVE-2022-49014: net: tun: Fix use-after-free in tun_detach() (bsc#1231890).
CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
CVE-2022-49023: wifi: cfg80211: fix buffer overflow in elem comparison (bsc#1231961).
CVE-2022-49025: net/mlx5e: Fix use-after-free when reverting termination table (bsc#1231960).
CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
CVE-2024-45026: s390/dasd: fix error recovery leading to data corruption on ESE devices (bsc#1230454).
CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (bsc#1231200).
CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
CVE-2024-47668: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (bsc#1231502).
CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
CVE-2024-47747: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition (bsc#1232145).
CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231861).
CVE-2024-49936: net/xen-netback: prevent UAF in xenvif_flush_hash() (bsc#1232424).
CVE-2024-49969: drm/amd/display: Fix index out of bounds in DCN30 color transformation (bsc#1232519).
CVE-2024-49974: NFSD: Force all NFSv4.2 COPY requests to be synchronous (bsc#1232383).
CVE-2024-49991: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (bsc#1232282).
CVE-2024-49995: tipc: guard against string buffer overrun (bsc#1232432).
CVE-2024-50047: smb: client: fix UAF in async decryption (bsc#1232418).

The following non-security bugs were fixed:

bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (bsc#1231375).
kernel-binary: generate and install compile_commands.json (bsc#1228971)
kernel-binary: vdso: Own module_dir
mkspec-dtb: add toplevel symlinks also on arm
net: mana: Fix the extra HZ in mana_hwc_send_request (bsc#1232033).
scsi: ibmvfc: Add max_sectors module parameter (bsc#1216223).

Record: SUSE-SU-2024:4140-1
Updated: 2026-11-02

OSVSUSE-SU-2024:4364-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
CVE-2022-48957: dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() (bsc#1231973).
CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
CVE-2022-48980: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() (bsc#1232233).
CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
CVE-2022-49017: tipc: re-fetch skb cb after tipc_msg_validate (bsc#1232004).
CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB (bsc#1228709).
CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005).
CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837).
CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
CVE-2024-46716: dmaengine: altera-msgdma:…

Record: SUSE-SU-2024:4364-1
Updated: 2026-11-02

OSVSUSE-SU-2025:0034-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The Linux Enterprise 12 SP5 kernel turned LTSS (Extended Security)

The following security bugs were fixed:

CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
CVE-2021-47163: kABI fix for tipc: wait and exit until all work queues are done (bsc#1221980).
CVE-2021-47612: nfc: fix segfault in nfc_genl_dump_devices_done (bsc#1226585).
CVE-2022-48809: net: fix a memleak when uncloning an skb dst and its metadata (bsc#1227947).
CVE-2022-48951: ASoC: ops: Correct bounds check for second channel on SX controls (bsc#1231929).
CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
CVE-2022-48967: NFC: nci: Bounds check struct nfc_target arrays (bsc#1232304).
CVE-2022-48971: Bluetooth: Fix not cleanup led when bt_init fails (bsc#1232037).
CVE-2022-48972: mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (bsc#1232025).
CVE-2022-48973: gpio: amd8111: Fix PCI device reference count leak (bsc#1232039).
CVE-2022-48978: HID: core: fix shift-out-of-bounds in hid_report_raw_event (bsc#1232038).
CVE-2022-48991: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths (bsc#1232070).
CVE-2022-48992: ASoC: soc-pcm: Add NULL check in BE reparenting (bsc#1232071).
CVE-2022-49000: iommu/vt-d: Fix PCI device refcount leak in has_external_pci() (bsc#1232123).
CVE-2022-49002: iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (bsc#1232133).
CVE-2022-49010: hwmon: (coretemp) Check for null before removing sysfs attrs (bsc#1232172).
CVE-2022-49011: hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (bsc#1232006).
CVE-2022-49014: net: tun: Fix use-after-free in tun_detach() (bsc#1231890).
CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
CVE-2022-49021: net: phy: fix null-ptr-deref while probe() failed (bsc#1231939).
CVE-2022-49026: e100: Fix possible use after free in e100_xmit_prepare (bsc#1231997).
CVE-2022-49027: iavf: Fix error handling in iavf_init_module() (bsc#1232007).
CVE-2022-49028: ixgbevf: Fix resource leak in ixgbevf_init_module() (bsc#1231996).
CVE-2022-49029: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (bsc#1231995).
CVE-2023-52898: xhci: Fix null pointer dereference when host dies (bsc#1229568).
CVE-2023-52918: media: pci: cx23885: check cx23885_vdev_init() return (bsc#1232047).
CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).
CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).
CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
CVE-2024-42114: netlink: extend policy range validation (bsc#1228564 prerequisite).
CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005 stable-fixes).
CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837 stable-fixes).
CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
CVE-2024-46724: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number (bsc#1230725).
CVE-2024-46755: wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() (bsc#1230802). -…

Record: SUSE-SU-2025:0034-1
Updated: 2026-11-02

OSVSUSE-SU-2025:1213-1 No score

Security update for the Linux Kernel (Live Patch 42 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-150300_59_153 fixes several issues.