CVE-2022-49080

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix mpol_new leak in shared_policy_replace If mpol_new is allocated but not used in restart loop, mpol_new will be freed via mpol_put before returning to the caller. But refcnt is not initialized yet, so mpol_put could not do the right things and might leak the unused mpol_new. This would happen if mempolicy was updated on the shared shmem file while the sp->lock has been dropped during the memory allocation. This issue could be triggered easily with the below code snippet if there are many processes doing the below work at the same time: shmid = shmget((key_t)5566, 1024 * PAGE_SIZE, 0666|IPC_CREAT); shm = shmat(shmid, 0, 0); loop many times { mbind(shm, 1024 * PAGE_SIZE, MPOL_LOCAL, mask, maxnode, 0); mbind(shm + 128 * PAGE_SIZE, 128 * PAGE_SIZE, MPOL_DEFAULT, mask, maxnode, 0); }

In the Linux kernel, the following vulnerability has been resolved:

mm/mempolicy: fix mpol_new leak in shared_policy_replace

If mpol_new is allocated but not used in restart loop, mpol_new will be freed via mpol_put before returning to the caller. But refcnt is not initialized yet, so mpol_put could not do the right things and might leak the unused mpol_new. This would happen if mempolicy was updated on the shared shmem file while the sp->lock has been dropped during the memory allocation.

This issue could be triggered easily with the below code snippet if there are many processes doing the below work at the same time:

shmid = shmget((key_t)5566, 1024 * PAGE_SIZE, 0666|IPC_CREAT); shm = shmat(shmid, 0, 0); loop many times { mbind(shm, 1024 * PAGE_SIZE, MPOL_LOCAL, mask, maxnode, 0); mbind(shm + 128 * PAGE_SIZE, 128 * PAGE_SIZE, MPOL_DEFAULT, mask, maxnode, 0); }

This update for the Linux Kernel 4.12.14-122_219 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 4.12.14-122_228 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.3.18-150300_59_179 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.14.21-150500_55_68 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-49855: nbd: fix race between timeout and normal completion (bsc#1232900).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.14.21-150500_55_80 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-49855: nbd: fix race between timeout and normal completion (bsc#1232900).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.14.21-150500_55_91 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.3.18-150300_59_185 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.14.21-150500_55_94 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 4.12.14-122_216 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.3.18-150300_59_188 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.14.21-150400_24_125 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 4.12.14-122_247 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).
• CVE-2022-49563: crypto: qat - add param check for RSA (bsc#1238788).
• CVE-2022-49564: crypto: qat - add param check for DH (bsc#1238790).

This update for the Linux Kernel 5.14.21-150400_24_144 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.14.21-150400_24_150 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.14.21-150400_24_136 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.14.21-150400_24_122 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.14.21-150400_24_128 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.3.18-150300_59_195 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).
• CVE-2022-49563: crypto: qat - add param check for RSA (bsc#1238788).
• CVE-2022-49564: crypto: qat - add param check for DH (bsc#1238790).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238033).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-53226: RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() (bsc#1236576)
• CVE-2024-57948: mac802154: check local interfaces before deleting sdata list (bsc#1236677).
• CVE-2025-21647: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133).
• CVE-2025-21690: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service (bsc#1237025).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
• CVE-2025-21699: gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (bsc#1237139).

The following non-security bugs were fixed:

• cpufreq/amd-pstate: Only print supported EPP values for performance governor (bsc#1236777).
• iavf: fix the waiting time for initial reset (bsc#1235111).
• ice: add ice_adapter for shared data across PFs on the same NIC (bsc#1235111).
• ice: avoid the PTP hardware semaphore in gettimex64 path (bsc#1235111).
• ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (bsc#1235111).
• idpf: call set_real_num_queues in idpf_open (bsc#1236661 bsc#1237316).
• ipv4/tcp: do not use per netns ctl sockets (bsc#1237693).
• kabi: hide adding RCU head into struct netdev_name_node (bsc#1233749).
• net: Fix undefined behavior in netdev name allocation (bsc#1233749).
• net: avoid UAF on deleted altname (bsc#1233749).
• net: check for altname conflicts when changing netdev's netns (bsc#1233749).
• net: core: Use the bitmap API to allocate bitmaps (bsc#1233749).
• net: do not send a MOVE event when netdev changes netns (bsc#1233749).
• net: do not use input buffer of __dev_alloc_name() as a scratch space (bsc#1233749).
• net: fix ifname in netlink ntf during netns move (bsc#1233749).
• net: fix removing a namespace with conflicting altnames (bsc#1233749).
• net: free altname using an RCU callback (bsc#1233749).
• net: introduce a function to check if a netdev name is in use (bsc#1233749).
• net: make dev_alloc_name() call dev_prep_valid_name() (bsc#1233749).
• net: mana: Add get_link and get_link_ksettings in ethtool (bsc#1236761).
• net: mana: Cleanup 'mana' debugfs dir after cleanup of all children (bsc#1236760).
• net: mana: Enable debugfs files for MANA device (bsc#1236758).
• net: minor __dev_alloc_name() optimization (bsc#1233749).
• net: move altnames together with the netdevice (bsc#1233749).
• net: netvsc: Update default VMBus channels (bsc#1236757).
• net: reduce indentation of __dev_alloc_name() (bsc#1233749).
• net: remove dev_valid_name() check from __dev_alloc_name() (bsc#1233749).
• net: remove else after return in dev_prep_valid_name() (bsc#1233749).
• net: trust the bitmap in __dev_alloc_name() (bsc#1233749).
• nfsd: use explicit lock/unlock for directory ops (bsc#1234650 bsc#1233701 bsc#1232472).
• rcu: Remove rcu_is_idle_cpu() (bsc#1236289).
• scsi: storvsc: Set correct data length for sending SCSI command without payload (git-fixes).
• x86/aperfmperf: Dont wake idle CPUs in arch_freq_get_on_cpu() (bsc#1236289).
• x86/aperfmperf: Integrate the fallback code from show_cpuinfo() (bsc#1236289).
• x86/aperfmperf: Make parts of the frequency invariance code unconditional (bsc#1236289).
• x86/aperfmperf: Put frequency invariance aperf/mperf data into a struct (bsc#1236289).
• x86/aperfmperf: Replace aperfmperf_get_khz() (bsc#1236289).
• x86/aperfmperf: Replace arch_freq_get_on_cpu() (bsc#1236289).
• x86/aperfmperf: Restructure arch_scale_freq_tick() (bsc#1236289).
• x86/aperfmperf: Separate AP/BP frequency invariance init (bsc#1236289).
• x86/aperfmperf: Store aperf/mperf data for cpu frequency reads (bsc#1236289).
• x86/aperfmperf: Untangle Intel and AMD frequency invariance init (bsc#1236289). -…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238033).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-53226: RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() (bsc#1236576)
• CVE-2024-57948: mac802154: check local interfaces before deleting sdata list (bsc#1236677).
• CVE-2025-21647: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133).
• CVE-2025-21690: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service (bsc#1237025).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
• CVE-2025-21699: gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (bsc#1237139).

The following non-security bugs were fixed:

• cpufreq/amd-pstate: Only print supported EPP values for performance governor (bsc#1236777).
• iavf: fix the waiting time for initial reset (bsc#1235111).
• ice: add ice_adapter for shared data across PFs on the same NIC (bsc#1235111).
• ice: avoid the PTP hardware semaphore in gettimex64 path (bsc#1235111).
• ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (bsc#1235111).
• idpf: call set_real_num_queues in idpf_open (bsc#1236661 bsc#1237316).
• ipv4/tcp: do not use per netns ctl sockets (bsc#1237693).
• kabi: hide adding RCU head into struct netdev_name_node (bsc#1233749).
• net: Fix undefined behavior in netdev name allocation (bsc#1233749).
• net: avoid UAF on deleted altname (bsc#1233749).
• net: check for altname conflicts when changing netdev's netns (bsc#1233749).
• net: core: Use the bitmap API to allocate bitmaps (bsc#1233749).
• net: do not send a MOVE event when netdev changes netns (bsc#1233749).
• net: do not use input buffer of __dev_alloc_name() as a scratch space (bsc#1233749).
• net: fix ifname in netlink ntf during netns move (bsc#1233749).
• net: fix removing a namespace with conflicting altnames (bsc#1233749).
• net: free altname using an RCU callback (bsc#1233749).
• net: introduce a function to check if a netdev name is in use (bsc#1233749).
• net: make dev_alloc_name() call dev_prep_valid_name() (bsc#1233749).
• net: mana: Add get_link and get_link_ksettings in ethtool (bsc#1236761).
• net: mana: Cleanup 'mana' debugfs dir after cleanup of all children (bsc#1236760).
• net: mana: Enable debugfs files for MANA device (bsc#1236758).
• net: minor __dev_alloc_name() optimization (bsc#1233749).
• net: move altnames together with the netdevice (bsc#1233749).
• net: netvsc: Update default VMBus channels (bsc#1236757).
• net: reduce indentation of __dev_alloc_name() (bsc#1233749).
• net: remove dev_valid_name() check from __dev_alloc_name() (bsc#1233749).
• net: remove else after return in dev_prep_valid_name() (bsc#1233749).
• net: trust the bitmap in __dev_alloc_name() (bsc#1233749).
• nfsd: use explicit lock/unlock for directory ops (bsc#1234650 bsc#1233701 bsc#1232472).
• rcu: Remove rcu_is_idle_cpu() (bsc#1236289).
• scsi: storvsc: Set correct data length for sending SCSI command without payload (git-fixes).
• x86/aperfmperf: Dont wake idle CPUs in arch_freq_get_on_cpu() (bsc#1236289).
• x86/aperfmperf: Integrate the fallback code from show_cpuinfo() (bsc#1236289).
• x86/aperfmperf: Make parts of the frequency invariance code unconditional (bsc#1236289).
• x86/aperfmperf: Put frequency invariance aperf/mperf data into a struct (bsc#1236289).
• x86/aperfmperf: Replace aperfmperf_get_khz() (bsc#1236289).
• x86/aperfmperf: Replace arch_freq_get_on_cpu() (bsc#1236289).
• x86/aperfmperf: Restructure arch_scale_freq_tick() (bsc#1236289).
• x86/aperfmperf: Separate AP/BP frequency invariance init (bsc#1236289).
• x86/aperfmperf: Store aperf/mperf data for cpu frequency reads (bsc#1236289).
• x86/aperfmperf: Untangle Intel and AMD frequency invariance init (bsc#1236289). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM (bsc#1186482).
• CVE-2021-47634: ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl (bsc#1237758).
• CVE-2021-47644: media: staging: media: zoran: move videodev alloc (bsc#1237766).
• CVE-2022-48953: rtc: cmos: fix build on non-ACPI platforms (bsc#1231941).
• CVE-2022-48975: gpiolib: fix memory leak in gpiochip_setup_dev() (bsc#1231885).
• CVE-2022-49006: tracing: Free buffers when a used dynamic event is removed (bsc#1232163).
• CVE-2022-49076: RDMA/hfi1: Fix use-after-free bug for mm struct (bsc#1237738).
• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238033).
• CVE-2022-49089: IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition (bsc#1238041).
• CVE-2022-49124: x86/mce: Work around an erratum on fast string copy instructions (bsc#1238148).
• CVE-2022-49134: mlxsw: spectrum: Guard against invalid local ports (bsc#1237982).
• CVE-2022-49135: drm/amd/display: Fix memory leak (bsc#1238006).
• CVE-2022-49151: can: mcba_usb: properly check endpoint type (bsc#1237778).
• CVE-2022-49178: memstick/mspro_block: fix handling of read-only devices (bsc#1238107).
• CVE-2022-49182: net: hns3: add vlan list lock to protect vlan list (bsc#1238260).
• CVE-2022-49201: ibmvnic: fix race between xmit and reset (bsc#1238256).
• CVE-2022-49247: media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED (bsc#1237783).
• CVE-2022-49490: drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is (bsc#1238275).
• CVE-2022-49626: sfc: fix use after free when disabling sriov (bsc#1238270).
• CVE-2022-49661: can: gs_usb: gs_usb_open/close(): fix memory leak (bsc#1237788).
• CVE-2023-52572: Fixed UAF in cifs_demultiplex_thread() in cifs (bsc#1220946).
• CVE-2023-52853: hid: cp2112: Fix duplicate workqueue initialization (bsc#1224988).
• CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).
• CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).
• CVE-2024-49963: mailbox: bcm2835: Fix timeout during suspend mode (bsc#1232147).
• CVE-2024-49975: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1232104).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50067: uprobe: avoid out-of-bounds memory access of fetching args (bsc#1232416).
• CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
• CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
• CVE-2024-53217: nfsd: restore callback functionality for NFSv4.0 (bsc#1234999).
• CVE-2024-56633: bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data (bsc#1235485).
• CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
• CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
• CVE-2024-56688: sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (bsc#1235538).
• CVE-2025-21638: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115).
• CVE-2025-21639: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122).
• CVE-2025-21640: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123).
• CVE-2025-21673: smb: client: fix double free of TCP_Server_Info::hostname (bsc#1236689).
• CVE-2025-21689: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() (bsc#1237017).
• CVE-2025-21690: scsi: storvsc:…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238033).
• CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
• CVE-2024-50128: net: wwan: fix global oob in wwan_rtnl_policy (bsc#1232905).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-57948: mac802154: check local interfaces before deleting sdata list (bsc#1236677).
• CVE-2025-21690: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service (bsc#1237025).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
• CVE-2025-21699: gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (bsc#1237139).

The following non-security bugs were fixed:

• idpf: call set_real_num_queues in idpf_open (bsc#1236661 bsc#1237316).
• ipv4/tcp: do not use per netns ctl sockets (bsc#1237693).
• net: mana: Add get_link and get_link_ksettings in ethtool (bsc#1236761).
• net: mana: Cleanup 'mana' debugfs dir after cleanup of all children (bsc#1236760).
• net: mana: Enable debugfs files for MANA device (bsc#1236758).
• net: netvsc: Update default VMBus channels (bsc#1236757).
• scsi: storvsc: Use scsi_cmd_to_rq() instead of scsi_cmnd.request (git-fixes).
• x86/kvm: fix is_stale_page_fault() (bsc#1236675).
• x86/xen: add FRAME_END to xen_hypercall_hvm() (git-fixes).
• x86/xen: fix xen_hypercall_hvm() to not clobber %rbx (git-fixes).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238033).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-53226: RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() (bsc#1236576)
• CVE-2024-57948: mac802154: check local interfaces before deleting sdata list (bsc#1236677).
• CVE-2025-21647: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133).
• CVE-2025-21690: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service (bsc#1237025).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
• CVE-2025-21699: gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (bsc#1237139).

The following non-security bugs were fixed:

• NFSD: use explicit lock/unlock for directory ops (bsc#1234650 bsc#1233701 bsc#1232472).
• cpufreq/amd-pstate: Only print supported EPP values for performance governor (bsc#1236777).
• iavf: fix the waiting time for initial reset (bsc#1235111).
• ice: add ice_adapter for shared data across PFs on the same NIC (bsc#1235111).
• ice: avoid the PTP hardware semaphore in gettimex64 path (bsc#1235111).
• ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (bsc#1235111).
• idpf: call set_real_num_queues in idpf_open (bsc#1236661 bsc#1237316).
• ipv4/tcp: do not use per netns ctl sockets (bsc#1237693).
• kabi: hide adding RCU head into struct netdev_name_node (bsc#1233749).
• net: Fix undefined behavior in netdev name allocation (bsc#1233749).
• net: avoid UAF on deleted altname (bsc#1233749).
• net: check for altname conflicts when changing netdev's netns (bsc#1233749).
• net: core: Use the bitmap API to allocate bitmaps (bsc#1233749).
• net: do not send a MOVE event when netdev changes netns (bsc#1233749).
• net: do not use input buffer of __dev_alloc_name() as a scratch space (bsc#1233749).
• net: fix ifname in netlink ntf during netns move (bsc#1233749).
• net: fix removing a namespace with conflicting altnames (bsc#1233749).
• net: free altname using an RCU callback (bsc#1233749).
• net: introduce a function to check if a netdev name is in use (bsc#1233749).
• net: make dev_alloc_name() call dev_prep_valid_name() (bsc#1233749).
• net: mana: Add get_link and get_link_ksettings in ethtool (bsc#1236761).
• net: mana: Cleanup 'mana' debugfs dir after cleanup of all children (bsc#1236760).
• net: mana: Enable debugfs files for MANA device (bsc#1236758).
• net: minor __dev_alloc_name() optimization (bsc#1233749).
• net: move altnames together with the netdevice (bsc#1233749).
• net: netvsc: Update default VMBus channels (bsc#1236757).
• net: reduce indentation of __dev_alloc_name() (bsc#1233749).
• net: remove dev_valid_name() check from __dev_alloc_name() (bsc#1233749).
• net: remove else after return in dev_prep_valid_name() (bsc#1233749).
• net: trust the bitmap in __dev_alloc_name() (bsc#1233749).
• rcu: Remove rcu_is_idle_cpu() (bsc#1236289).
• scsi: storvsc: Set correct data length for sending SCSI command without payload (git-fixes).
• x86/aperfmperf: Dont wake idle CPUs in arch_freq_get_on_cpu() (bsc#1236289).
• x86/aperfmperf: Integrate the fallback code from show_cpuinfo() (bsc#1236289).
• x86/aperfmperf: Make parts of the frequency invariance code unconditional (bsc#1236289).
• x86/aperfmperf: Put frequency invariance aperf/mperf data into a struct (bsc#1236289).
• x86/aperfmperf: Replace aperfmperf_get_khz() (bsc#1236289).
• x86/aperfmperf: Replace arch_freq_get_on_cpu() (bsc#1236289).
• x86/aperfmperf: Restructure arch_scale_freq_tick() (bsc#1236289).
• x86/aperfmperf: Separate AP/BP frequency invariance init (bsc#1236289).
• x86/aperfmperf: Store aperf/mperf data for cpu frequency reads (bsc#1236289).
• x86/aperfmperf: Untangle Intel and AMD frequency invariance init (bsc#1236289). -…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47633: ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 (bsc#1237768).
• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238033).
• CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
• CVE-2025-21690: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service (bsc#1237025).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
• CVE-2025-21699: gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (bsc#1237139).

The following non-security bugs were fixed:

• net: mana: Add get_link and get_link_ksettings in ethtool (bsc#1236761).
• net: netvsc: Update default VMBus channels (bsc#1236757).
• scsi: storvsc: Handle SRB status value 0x30 (git-fixes).

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47633: ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 (bsc#1237768).
• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238033).
• CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
• CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
• CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unuse_vma (bsc#1233112).
• CVE-2024-53104: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (bsc#1234025).
• CVE-2024-56600: net: inet6: do not leave a dangling sk pointer in inet6_create() (bsc#1235217).
• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235230).
• CVE-2024-56623: scsi: qla2xxx: Fix use after free on unload (bsc#1235466).
• CVE-2024-56650: netfilter: x_tables: fix LED ID check in led_tg_check() (bsc#1235430).
• CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
• CVE-2024-56664: bpf, sockmap: Fix race between element replace and close() (bsc#1235249).
• CVE-2024-56759: btrfs: fix use-after-free when COWing tree bock and tracing is enabled (bsc#1235645).
• CVE-2024-57791: net/smc: check return value of sock_recvmsg when draining clc data (bsc#1235759).
• CVE-2024-57798: drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() (bsc#1235818).
• CVE-2024-57849: s390/cpum_sf: Handle CPU hotplug remove during sampling (bsc#1235814).
• CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages (bsc#1235920).
• CVE-2025-21690: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service (bsc#1237025).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
• CVE-2025-21699: gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (bsc#1237139).

The following non-security bugs were fixed:

• net: mana: Add get_link and get_link_ksettings in ethtool (bsc#1236761).
• net: netvsc: Update default VMBus channels (bsc#1236757).
• NFS: Adjust the amount of readahead performed by NFS readdir (bsc#1231847).
• NFS: Do not flush the readdir cache in nfs_dentry_iput() (bsc#1231847).
• NFS: Improve heuristic for readdirplus -revert (bsc#1237160).
• NFS: Improve heuristic for readdirplus (bsc#1231847).
• NFS: Reduce readdir stack usage (bsc#1231847).
• NFS: Trigger the 'ls -l' readdir heuristic sooner (bsc#1231847).
• NFS: Use kmemdup_nul() in nfs_readdir_make_qstr() (bsc#1231847).
• scsi: storvsc: Handle SRB status value 0x30 (git-fixes).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238033).
• CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
• CVE-2024-50128: net: wwan: fix global oob in wwan_rtnl_policy (bsc#1232905).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-57948: mac802154: check local interfaces before deleting sdata list (bsc#1236677).
• CVE-2025-21690: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service (bsc#1237025).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
• CVE-2025-21699: gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (bsc#1237139).

The following non-security bugs were fixed:

• idpf: call set_real_num_queues in idpf_open (bsc#1236661 bsc#1237316).
• ipv4/tcp: do not use per netns ctl sockets (bsc#1237693).
• net: mana: Add get_link and get_link_ksettings in ethtool (bsc#1236761).
• net: mana: Cleanup 'mana' debugfs dir after cleanup of all children (bsc#1236760).
• net: mana: Enable debugfs files for MANA device (bsc#1236758).
• net: netvsc: Update default VMBus channels (bsc#1236757).
• scsi: storvsc: Use scsi_cmd_to_rq() instead of scsi_cmnd.request (git-fixes).
• x86/kvm: fix is_stale_page_fault() (bsc#1236675).
• x86/xen: add FRAME_END to xen_hypercall_hvm() (git-fixes).
• x86/xen: fix xen_hypercall_hvm() to not clobber %rbx (git-fixes).

This update for the SUSE Linux Enterprise kernel 4.12.14-122.231 fixes various security issues

The following security issues were fixed:

• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1232637).
• CVE-2022-49014: net: tun: Fix use-after-free in tun_detach() (bsc#1232818).
• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237930).
• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2022-49179: block, bfq: don't move oom_bfqq (bsc#1241331).
• CVE-2022-49465: blk-throttle: set BIO_THROTTLED when bio has been throttled (bsc#1238920).
• CVE-2022-49545: ALSA: usb-audio: cancel pending work at closing a MIDI substream (bsc#1238730).
• CVE-2022-49563: crypto: qat - add param check for RSA (bsc#1238788).
• CVE-2022-49564: crypto: qat - add param check for DH (bsc#1238790).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249847).
• CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250302).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230998).
• CVE-2024-46818: drm/amd/display: check gpio_id before used as array index (bsc#1231204).
• CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231676).
• CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231993).
• CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231943).
• CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231862).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1233019).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2024-50154: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink() (bsc#1233072).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233712).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233679).
• CVE-2024-53104: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (bsc#1236783).
• CVE-2024-53146: NFSD: prevent a potential integer overflow (bsc#1234854).
• CVE-2024-53156: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() (bsc#1234847).
• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
• CVE-2024-56600: net: inet6: do not leave a dangling sk pointer in inet6_create() (bsc#1235218).
• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-56650: netfilter: x_tables: fix LED ID check in led_tg_check() (bsc#1235431).
• CVE-2024-56664: bpf, sockmap: fix race between element replace and close() (bsc#1235250).
• CVE-2024-57893: ALSA: seq: oss: fix races at processing SysEx messages (bsc#1235921).
• CVE-2024-57996: net_sched: sch_sfq: don't allow 1 packet limit (bsc#1239077).
• CVE-2024-8805: BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability (bsc#1240840).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1245797).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).
• CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1245794).
• CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1245776).
• CVE-2025-37797:…