CVE-2022-49508

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

drm/plane: Move range check for format_count earlier

While the check for format_count > 64 in __drm_universal_plane_init() shouldn't be hit (it's a WARN_ON), in its current position it will then leak the plane->format_types array and fail to call drm_mode_object_unregister() leaking the modeset identifier. Move it to the start of the function to avoid allocating those resources in the first place.(CVE-2021-47659)

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: tcmu: Fix possible page UAF

tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data_page() returns, the returned page may have been freed by tcmu_blocks_release().

We need to get_page() under cmdr_lock to avoid concurrent tcmu_blocks_release().(CVE-2022-49053)

In the Linux kernel, the following vulnerability has been resolved:

ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe

This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak.(CVE-2022-49243)

In the Linux kernel, the following vulnerability has been resolved:

ALSA: oss: Fix PCM OSS buffer allocation overflow

We've got syzbot reports hitting INT_MAX overflow at vmalloc() allocation that is called from snd_pcm_plug_alloc(). Although we apply the restrictions to input parameters, it's based only on the hw_params of the underlying PCM device. Since the PCM OSS layer allocates a temporary buffer for the data conversion, the size may become unexpectedly large when more channels or higher rates is given; in the reported case, it went over INT_MAX, hence it hits WARN_ON().

This patch is an attempt to avoid such an overflow and an allocation for too large buffers. First off, it adds the limit of 1MB as the upper bound for period bytes. This must be large enough for all use cases, and we really don't want to handle a larger temporary buffer than this size. The size check is performed at two places, where the original period bytes is calculated and where the plugin buffer size is calculated.

In addition, the driver uses array_size() and array3_size() for multiplications to catch overflows for the converted period size and buffer bytes.(CVE-2022-49292)

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.

Submitting a cs with 0 chunks, causes an oops later, found trying to execute the wrong userspace driver.

MESA_LOADER_DRIVER_OVERRIDE=v3d glxinfo

[172536.665184] BUG: kernel NULL pointer dereference, address: 00000000000001d8 [172536.665188] #PF: supervisor read access in kernel mode [172536.665189] #PF: error_code(0x0000) - not-present page [172536.665191] PGD 6712a0067 P4D 6712a0067 PUD 5af9ff067 PMD 0 [172536.665195] Oops: 0000 [#1] SMP NOPTI [172536.665197] CPU: 7 PID: 2769838 Comm: glxinfo Tainted: P O 5.10.81 #1-NixOS [172536.665199] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CROSSHAIR V FORMULA-Z, BIOS 2201 03/23/2015 [172536.665272] RIP: 0010:amdgpu_cs_ioctl+0x96/0x1ce0 [amdgpu] [172536.665274] Code: 75 18 00 00 4c 8b b2 88 00 00 00 8b 46 08 48 89 54 24 68 49 89 f7 4c 89 5c 24 60 31 d2 4c 89 74 24 30 85 c0 0f 85 c0 01 00 00 <48> 83 ba d8 01 00 00 00 48 8b b4 24 90 00 00 00 74 16 48 8b 46 10 [172536.665276] RSP: 0018:ffffb47c0e81bbe0 EFLAGS: 00010246 [172536.665277] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [172536.665278] RDX: 0000000000000000 RSI: ffffb47c0e81be28 RDI: ffffb47c0e81bd68 [172536.665279] RBP: ffff936524080010 R08: 0000000000000000 R09: ffffb47c0e81be38 [172536.665281] R10: ffff936524080010 R11: ffff936524080000 R12: ffffb47c0e81bc40…

In the Linux kernel, the following vulnerability has been resolved: HID: elan: Fix potential double free in elan_input_configured 'input' is a managed resource allocated with devm_input_allocate_device(), so there is no need to call input_free_device() explicitly or there will be a double free. According to the doc of devm_input_allocate_device(): * Managed input devices do not need to be explicitly unregistered or * freed as it will be done automatically when owner device unbinds from * its driver (or binding fails).

• vsock: Keep the binding until socket destruction {CVE-2025-21756}
• mt76: fix use-after-free by removing a non-RCU wcid pointer {CVE-2022-49328}
• bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• net: sched: Fix use after free in red_enqueue() {CVE-2022-49921}
• udf: Fix a slab-out-of-bounds write bug in udf_find_entry() {CVE-2022-49846}
• ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892}
• dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• mac80211: fix potential double free on mesh join {CVE-2022-49290}
• wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416}
• ext4: fix OOB read when checking dotdot dir {CVE-2025-37785}
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
• tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
• wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}
• mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths {CVE-2022-48991}
• cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}
• media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init {CVE-2022-49478}
• HID: elan: Fix potential double free in elan_input_configured {CVE-2022-49508}
• bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers {CVE-2023-52621}
• drm/amd/pm: fix double free in si_parse_power_table() {CVE-2022-49530}
• drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() {CVE-2025-21780}
• crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612}
• sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168}
• net: make sock_inuse_add() available {CVE-2024-53168}

• vsock: Keep the binding until socket destruction {CVE-2025-21756}
• mt76: fix use-after-free by removing a non-RCU wcid pointer {CVE-2022-49328}
• bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• net: sched: Fix use after free in red_enqueue() {CVE-2022-49921}
• udf: Fix a slab-out-of-bounds write bug in udf_find_entry() {CVE-2022-49846}
• ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892}
• dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• mac80211: fix potential double free on mesh join {CVE-2022-49290}
• wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416}
• ext4: fix OOB read when checking dotdot dir {CVE-2025-37785}
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
• tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
• wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}
• mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths {CVE-2022-48991}
• cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}
• media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init {CVE-2022-49478}
• HID: elan: Fix potential double free in elan_input_configured {CVE-2022-49508}
• bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers {CVE-2023-52621}
• drm/amd/pm: fix double free in si_parse_power_table() {CVE-2022-49530}
• drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() {CVE-2025-21780}
• crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612}
• sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168}
• net: make sock_inuse_add() available {CVE-2024-53168}

• tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• module: limit enabling module.sig_enforce {CVE-2021-35039}
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• HID: elan: Fix potential double free in elan_input_configured {CVE-2022-49508}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• scsi: qla2xxx: Fix improper freeing of purex item {CVE-2025-68741}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• kernfs: fix use-after-free in __kernfs_remove {CVE-2022-50432}
• rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails {CVE-2023-53307}
• virtio_console: Assure used length from device is limited {CVE-2021-38160}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
• wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
• cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• drm/i915/perf: add sentinel to xehp_oa_b_counters {CVE-2023-53646}
• net: mdio: validate parameter addr in mdiobus_get_phy() {CVE-2023-53019}
• wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() {CVE-2023-53570}
• vt: Clear selection before changing the font {CVE-2022-49948}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
• ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
• thermal: core: prevent potential string overflow {CVE-2023-52868}
• drm/radeon: possible buffer overflow {CVE-2023-52867}
• ftrace: Fix invalid address access in lookup_rec() when index is 0 {CVE-2023-53075}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• smb: client: reject userspace cifs.spnego descriptions
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• initcall_blacklist: Does not allow kernel_lockdown be blacklisted (bsc#1237521).
• x86/bhi: Avoid warning in #DB handler due to BHI mitigation (git-fixes).
• x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (git-fixes).
• x86/bugs: Fix BHI documentation (git-fixes).
• x86/bugs: Fix BHI handling of RRSBA (git-fixes).
• x86/bugs: Fix BHI retpoline check (git-fixes).
• x86/bugs: Fix return type of spectre_bhi_state() (git-fixes).
• x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (git-fixes).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239095).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• Revert 'gfs2: Fix inode height consistency check (git-fixes).
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• cifs: Add a laundromat thread for cached directories (git-fixes).
• cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path (git-fixes).
• gfs2: Fix inode height consistency check (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• sched/membarrier: Fix redundant load of membarrier_state (bsc#1232743).
• smb3: allow controlling length of time directory entries are cached with dir leases (git-fixes).
• smb3: do not start laundromat thread when dir leases disabled (git-fixes).
• smb3: retrying on failed server close (git-fixes).
• smb: client: destroy cfid_put_wq on module exit (git-fixes).
• smb: client: disable directory caching when dir_cache_timeout is zero (git-fixes).
• smb: client: do not start laundromat thread on nohandlecache (git-fixes).
• smb: client: make laundromat a delayed worker (git-fixes).
• smb: client: properly close cfids on umount (bsc#1231432, bsc#1232299, bsc#1235599, bsc#1234896).
• tpm: send_data: Wait longer for the TPM to become ready (bsc#1235870).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21714: RDMA/mlx5: Fix implicit ODP use after free (bsc#1237890).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21732: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (bsc#1237877).
• CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).
• CVE-2025-21839: kABI: Fix kABI after backport od CVE-2025-21839 (bsc#1239061).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• RDMA/mlx5: Fix implicit ODP hang on parent deregistration (git-fixes)
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• gfs2: Fix inode height consistency check (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup (bsc#1240195).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• x86/bhi: Avoid warning in #DB handler due to BHI mitigation (git-fixes).
• x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (git-fixes).
• x86/bugs: Fix BHI documentation (git-fixes).
• x86/bugs: Fix BHI handling of RRSBA (git-fixes).
• x86/bugs: Fix BHI retpoline check (git-fixes).
• x86/bugs: Fix return type of spectre_bhi_state() (git-fixes).
• x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (git-fixes).

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47248: udp: fix race between close() and udp_abort() (bsc#1224867).
• CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (bsc#1237903).
• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49275: can: m_can: m_can_tx_handler(): fix use after free of skb (bsc#1238719).
• CVE-2022-49413: bfq: Update cgroup information before merging bio (bsc#1238710).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238729).
• CVE-2022-49563: crypto: qat - add param check for RSA (bsc#1238787).
• CVE-2022-49564: crypto: qat - add param check for DH (bsc#1238789).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-56642: tipc: Fix use-after-free of kernel socket in cleanup_bearer() (bsc#1235433).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• btrfs: send: use btrfs_file_extent_end() in send_write_or_clone() (bsc#1239969).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239095).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• cifs: Add a laundromat thread for cached directories (git-fixes).
• cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path (git-fixes).
• gfs2: Fix inode height consistency check (git-fixes).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• sched/membarrier: Fix redundant load of membarrier_state (bsc#1232743).
• smb: client: destroy cfid_put_wq on module exit (git-fixes).
• smb: client: disable directory caching when dir_cache_timeout is zero (git-fixes).
• smb: client: do not start laundromat thread on nohandlecache (git-fixes).
• smb: client: make laundromat a delayed worker (git-fixes).
• smb: client: properly close cfids on umount (bsc#1231432, bsc#1232299, bsc#1235599, bsc#1234896).
• smb3: allow controlling length of time directory entries are cached with dir leases (git-fixes).
• smb3: do not start laundromat thread when dir leases disabled (git-fixes).
• smb3: retrying on failed server close (git-fixes).
• tpm: send_data: Wait longer for the TPM to become ready (bsc#1235870).

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47248: udp: fix race between close() and udp_abort() (bsc#1224867).
• CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (bsc#1237903).
• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49275: can: m_can: m_can_tx_handler(): fix use after free of skb (bsc#1238719).
• CVE-2022-49413: bfq: Update cgroup information before merging bio (bsc#1238710).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238729).
• CVE-2022-49563: crypto: qat - add param check for RSA (bsc#1238787).
• CVE-2022-49564: crypto: qat - add param check for DH (bsc#1238789).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-56642: tipc: Fix use-after-free of kernel socket in cleanup_bearer() (bsc#1235433).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• btrfs: send: use btrfs_file_extent_end() in send_write_or_clone() (bsc#1239969).