CVE-2022-49519

In the Linux kernel, the following vulnerability has been resolved: ath10k: skip ath10k_halt during suspend for driver state RESTARTING Double free crash is observed when FW recovery(caused by wmi timeout/crash) is followed by immediate suspend event. The FW recovery is triggered by ath10k_core_restart() which calls driver clean up via ath10k_halt(). When the suspend event occurs between the FW recovery, the restart worker thread is put into frozen state until suspend completes. The suspend event triggers ath10k_stop() which again triggers ath10k_halt() The double invocation of ath10k_halt() causes ath10k_htt_rx_free() to be called twice(Note: ath10k_htt_rx_alloc was not called by restart worker thread because of its frozen state), causing the crash. To fix this, during the suspend flow, skip call to ath10k_halt() in ath10k_stop() when the current driver state is ATH10K_STATE_RESTARTING. Also, for driver state ATH10K_STATE_RESTARTING, call ath10k_wait_for_suspend() in ath10k_stop(). This is because call to ath10k_wait_for_suspend() is skipped later in [ath10k_halt() > ath10k_core_stop()] for the driver state ATH10K_STATE_RESTARTING. The frozen restart worker thread will be cancelled during resume when the device comes out of suspend. Below is the crash stack for reference: [ 428.469167] ------------[ cut here ]------------ [ 428.469180] kernel BUG at mm/slub.c:4150! [ 428.469193] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 428.469219] Workqueue: events_unbound async_run_entry_fn [ 428.469230] RIP: 0010:kfree+0x319/0x31b [ 428.469241] RSP: 0018:ffffa1fac015fc30 EFLAGS: 00010246 [ 428.469247] RAX: ffffedb10419d108 RBX: ffff8c05262b0000 [ 428.469252] RDX: ffff8c04a8c07000 RSI: 0000000000000000 [ 428.469256] RBP: ffffa1fac015fc78 R08: 0000000000000000 [ 428.469276] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 428.469285] Call Trace: [ 428.469295] ? dma_free_attrs+0x5f/0x7d [ 428.469320] ath10k_core_stop+0x5b/0x6f [ 428.469336] ath10k_halt+0x126/0x177 [ 428.469352] ath10k_stop+0x41/0x7e [ 428.469387] drv_stop+0x88/0x10e [ 428.469410] __ieee80211_suspend+0x297/0x411 [ 428.469441] rdev_suspend+0x6e/0xd0 [ 428.469462] wiphy_suspend+0xb1/0x105 [ 428.469483] ? name_show+0x2d/0x2d [ 428.469490] dpm_run_callback+0x8c/0x126 [ 428.469511] ? name_show+0x2d/0x2d [ 428.469517] __device_suspend+0x2e7/0x41b [ 428.469523] async_suspend+0x1f/0x93 [ 428.469529] async_run_entry_fn+0x3d/0xd1 [ 428.469535] process_one_work+0x1b1/0x329 [ 428.469541] worker_thread+0x213/0x372 [ 428.469547] kthread+0x150/0x15f [ 428.469552] ? pr_cont_work+0x58/0x58 [ 428.469558] ? kthread_blkcg+0x31/0x31 Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1

• media: bttv: fix use after free error due to btv->timeout timer {CVE-2023-52847} {CVE-2023-52847}
• firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails {CVE-2022-50087} {CVE-2022-50087}
• wifi: mwifiex: Fix OOB and integer underflow when rx packets {CVE-2023-53226} {CVE-2023-53226}
• vsock: Fix transport_* TOCTOU {CVE-2025-38461} {CVE-2025-38461}
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757} {CVE-2025-39757}
• locking/ww_mutex/test: Fix potential workqueue corruption {CVE-2023-52836} {CVE-2023-52836}
• media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621} {CVE-2024-38621}
• ath10k: skip ath10k_halt during suspend for driver state RESTARTING {CVE-2022-49519} {CVE-2022-49519}
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() {CVE-2022-48738} {CVE-2022-48738}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772} {CVE-2025-21772}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292} {CVE-2022-49292}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704} {CVE-2025-21704}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214} {CVE-2024-53214}
• ppdev: Add an error check in register_device {CVE-2024-36015} {CVE-2024-36015}
• scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675} {CVE-2023-53675}
• enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659} {CVE-2024-38659}
• dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929} {CVE-2024-57929}
• dlm: fix plock invalid read {CVE-2022-49407} {CVE-2022-49407}
• rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev {CVE-2022-48759} {CVE-2022-48759}
• bpf: Don't use tnum_range on array range checking for poke descriptors {CVE-2022-49985} {CVE-2022-49985}
• net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001} {CVE-2025-38001}
• wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes {CVE-2023-53185} {CVE-2023-53185}
• dm integrity: fix memory corruption when tag_size is less than digest size {CVE-2022-49044} {CVE-2022-49044}
• drm/radeon: possible buffer overflow {CVE-2023-52867} {CVE-2023-52867}
• ata: sata_dwc_460ex: Fix crash due to OOB write {CVE-2022-49073} {CVE-2022-49073}
• fs/jfs: Add validity check for db_maxag and db_agpref {CVE-2023-52804} {CVE-2023-52804}
• net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581} {CVE-2023-53581}
• thermal: core: prevent potential string overflow {CVE-2023-52868} {CVE-2023-52868}
• ACPI: CPPC: Avoid out of bounds access when parsing _CPC data {CVE-2022-49145} {CVE-2022-49145}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817} {CVE-2025-39817}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332} {CVE-2024-52332}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498} {CVE-2025-38498}
• drm/amd/display: Skip finding free audio for unknown engine_id {CVE-2024-42119} {CVE-2024-42119}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408} {CVE-2022-50408}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014} {CVE-2024-58014}
• wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229} {CVE-2023-53229}
• ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570} {CVE-2024-56570}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125} {CVE-2023-53125}
• net: stmmac: fix dma queue left shift overflow issue {CVE-2022-49592} {CVE-2022-49592}
• iio: adc: at91: call input_free_device() on allocated iio_dev {CVE-2024-57904} {CVE-2024-57904}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373} {CVE-2023-53373}
• sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718} {CVE-2025-38718}
• KVM: SVM: Don't BUG if userspace…

• media: bttv: fix use after free error due to btv->timeout timer {CVE-2023-52847}
• firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails {CVE-2022-50087}
• wifi: mwifiex: Fix OOB and integer underflow when rx packets {CVE-2023-53226}
• vsock: Fix transport_* TOCTOU {CVE-2025-38461}
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
• perf/aux: Fix AUX buffer serialization {CVE-2024-46713}
• locking/ww_mutex/test: Fix potential workqueue corruption {CVE-2023-52836}
• media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621}
• ath10k: skip ath10k_halt during suspend for driver state RESTARTING {CVE-2022-49519}
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() {CVE-2022-48738}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
• ppdev: Add an error check in register_device {CVE-2024-36015}
• scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
• enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659}
• dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929}
• dlm: fix plock invalid read {CVE-2022-49407}
• rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev {CVE-2022-48759}
• bpf: Don't use tnum_range on array range checking for poke descriptors {CVE-2022-49985}
• net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001}
• wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes {CVE-2023-53185}
• dm integrity: fix memory corruption when tag_size is less than digest size {CVE-2022-49044}
• drm/radeon: possible buffer overflow {CVE-2023-52867}
• ata: sata_dwc_460ex: Fix crash due to OOB write {CVE-2022-49073}
• fs/jfs: Add validity check for db_maxag and db_agpref {CVE-2023-52804}
• net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581}
• thermal: core: prevent potential string overflow {CVE-2023-52868}
• ACPI: CPPC: Avoid out of bounds access when parsing _CPC data {CVE-2022-49145}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
• drm/amd/display: Skip finding free audio for unknown engine_id {CVE-2024-42119}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229}
• ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
• net: stmmac: fix dma queue left shift overflow issue {CVE-2022-49592}
• iio: adc: at91: call input_free_device() on allocated iio_dev {CVE-2024-57904}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
• sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
• KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 {CVE-2022-50228}
• soundwire: cadence: fix invalid PDI offset {CVE-2024-38635}
• wifi: at76c50x: fix use after free access in at76_disconnect {CVE-2025-37796}
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans {CVE-2023-53034}
• Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297}
• scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
• smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527}
• NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730}
• scsi:…

• CVE-url: https://ubuntu.com/security/CVE-2025-38352
  • posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
• CVE-url: https://ubuntu.com/security/CVE-2022-25265
  • x86/elf: Add table to document READ_IMPLIES_EXEC
  • x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK
  • x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit
• CVE-url: https://ubuntu.com/security/CVE-2022-49170
  • f2fs: fix to do sanity check on curseg->alloc_type
• CVE-url: https://ubuntu.com/security/CVE-2021-47479
  • staging: rtl8712: fix use-after-free in rtl8712_dl_fw
• CVE-url: https://ubuntu.com/security/CVE-2022-49519
  • ath10k: skip ath10k_halt during suspend for driver state RESTARTING
• CVE-url: https://ubuntu.com/security/CVE-2024-46713
  • perf/aux: Fix AUX buffer serialization
• CVE-url: https://ubuntu.com/security/CVE-2024-36914
  • drm/amd/display: Skip on writeback when it's not applicable
• CVE-url: https://ubuntu.com/security/CVE-2024-36880
  • Bluetooth: qca: add missing firmware sanity checks
• Miscellaneous upstream changes
  • net: openvswitch: fix nested key length validation in the set() action
  • isofs: Prevent the use of too small fid
  • ext4: ignore xattrs past end
  • net: ppp: Add bound checking for skb data on ppp_sync_txmung
  • media: venus: hfi: add check to handle incorrect queue size
  • media: venus: hfi_parser: add check to avoid out of bound access
  • sctp: detect and prevent references to a freed transport in sendmsg
  • ext4: improve xattr consistency checking and error reporting
  • ext4: introduce ITAIL helper
  • ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
  • ibmvnic: create send_control_ip_offload
  • ibmvnic: Use strscpy() instead of strncpy()
  • ibmvnic: Use kernel helpers for hex dumps
  • wifi: at76c50x: fix use after free access in at76_disconnect
  • wifi: cfg80211: fix use-after-free in cmp_bss()

• Focal update: v5.4.291 upstream stable release (LP: #2106002) // CVE-2024-58072
  • wifi: rtlwifi: remove unused check_buddy_priv
• Focal update: v5.4.291 upstream stable release (LP: #2106002)
  • wifi: rtlwifi: remove unused timer and related code
  • wifi: rtlwifi: remove unused dualmac control leftovers
• Focal update: v5.4.237 upstream stable release (LP: #2023420)
  • ext4: move where set the MAY_INLINE_DATA flag is set
• CVE-url: https://ubuntu.com/security/CVE-2024-58014
  • wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
• CVE-url: https://ubuntu.com/security/CVE-2025-38352
  • posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
• CVE-url: https://ubuntu.com/security/CVE-2022-25265
  • x86/elf: Add table to document READ_IMPLIES_EXEC
  • x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK
  • x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit
• Focal update: v5.4.279 upstream stable release (LP: #2073621) // CVE-url: https://ubuntu.com/security/CVE-2024-37078
  • nilfs2: fix potential kernel bug due to lack of writeback flag waiting
• CVE-url: https://ubuntu.com/security/CVE-2022-49170
  • f2fs: fix to do sanity check on curseg->alloc_type
• CVE-url: https://ubuntu.com/security/CVE-2021-47479
  • staging: rtl8712: fix use-after-free in rtl8712_dl_fw
• Focal update: v5.4.279 upstream stable release (LP: #2073621) // CVE-url: https://ubuntu.com/security/CVE-2024-39469
  • nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
• CVE-url: https://ubuntu.com/security/CVE-2022-49519
  • ath10k: skip ath10k_halt during suspend for driver state RESTARTING
• CVE-url: https://ubuntu.com/security/CVE-2024-46713
  • perf/aux: Fix AUX buffer serialization
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52804
  • fs/jfs: Add check for negative db_l2nbperpage
  • fs/jfs: Add validity check for db_maxag and db_agpref
• Focal update: v5.4.251 upstream stable release (LP: #2034918) // CVE-url: https://ubuntu.com/security/CVE-2023-52804
  • jfs: jfs_dmap: Validate db_l2nbperpage while mounting
• CVE-url: https://ubuntu.com/security/CVE-2024-36880
  • Bluetooth: qca: add missing firmware sanity checks
• Miscellaneous upstream changes
  • net: openvswitch: fix nested key length validation in the set() action
  • isofs: Prevent the use of too small fid
  • ext4: ignore xattrs past end
  • net: ppp: Add bound checking for skb data on ppp_sync_txmung
  • media: venus: hfi: add check to handle incorrect queue size
  • sctp: detect and prevent references to a freed transport in sendmsg
  • ext4: improve xattr consistency checking and error reporting
  • ext4: introduce ITAIL helper
  • ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
  • ibmvnic: Do not attempt to login if RX or TX queues are not allocated
  • ibmvnic: Enable GRO
  • ibmvnic: Fix netdev feature clobbering during a reset
  • ibmvnic: create send_control_ip_offload
  • ibmvnic: Define vnic_login_client_data name field as unsized array
  • ibmvnic: Use strscpy() instead of strncpy()
  • ibmvnic: Use kernel helpers for hex dumps
  • wifi: at76c50x: fix use after free access in at76_disconnect

• Focal update: v5.4.291 upstream stable release (LP: #2106002) // CVE-2025-21772
  • partitions: mac: fix handling of bogus partition table
• CVE-url: https://ubuntu.com/security/CVE-2025-22079
  • ocfs2: validate l_tree_depth to avoid out-of-bounds access
• CVE-url: https://ubuntu.com/security/CVE-2024-58014
  • wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
• CVE-url: https://ubuntu.com/security/CVE-2024-41042
  • netfilter: nf_tables: prefer nft_chain_validate
• CVE-url: https://ubuntu.com/security/CVE-2024-46713
  • perf/aux: Fix AUX buffer serialization
• CVE-url: https://ubuntu.com/security/CVE-2025-38352
  • posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
• CVE-url: https://ubuntu.com/security/CVE-2025-38477
  • net/sched: sch_qfq: Fix race condition on qfq_aggregate
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52804
  • fs/jfs: Add check for negative db_l2nbperpage
  • fs/jfs: Add validity check for db_maxag and db_agpref
• Focal update: v5.4.251 upstream stable release (LP: #2034918) // CVE-url: https://ubuntu.com/security/CVE-2023-52804
  • jfs: jfs_dmap: Validate db_l2nbperpage while mounting
• Bionic update: upstream stable patchset 2023-02-06 (LP: #2006403) // CVE- url: https://ubuntu.com/security/CVE-2023-52804
  • fs: jfs: fix shift-out-of-bounds in dbAllocAG
• CVE-url: https://ubuntu.com/security/CVE-2022-25265
  • x86/elf: Add table to document READ_IMPLIES_EXEC
  • x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK
  • x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit
• Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740) // CVE- url: https://ubuntu.com/security/CVE-2021-47153
  • i2c: i801: Don't generate an interrupt on bus reset
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48757
  • net: fix information leakage in /proc/net/ptype
• Focal update: v5.4.279 upstream stable release (LP: #2073621) // CVE-url: https://ubuntu.com/security/CVE-2024-37078
  • nilfs2: fix potential kernel bug due to lack of writeback flag waiting
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48760
  • USB: core: Fix hang in usb_kill_urb by adding memory barriers
• Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE- url: https://ubuntu.com/security/CVE-2021-47383
  • tty: Fix out-of-bound vmalloc access in imageblit
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE- url: https://ubuntu.com/security/CVE-2022-49145
  • ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
• Bionic update: upstream stable patchset 2021-11-23 (LP: #1951997) // CVE- url: https://ubuntu.com/security/CVE-2021-47458
  • ocfs2: mount fails with buffer overflow in strlen
• CVE-url: https://ubuntu.com/security/CVE-2022-49170
  • f2fs: fix to do sanity check on curseg->alloc_type
• CVE-url: https://ubuntu.com/security/CVE-2021-47479
  • staging: rtl8712: fix use-after-free in rtl8712_dl_fw
• Bionic update: upstream stable patchset 2021-12-03 (LP: #1953202) // CVE- url: https://ubuntu.com/security/CVE-2021-47477
  • comedi: dt9812: fix DMA buffers on stack
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE- url: https://ubuntu.com/security/CVE-2021-47642
  • video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
• Bionic update: upstream stable patchset 2022-01-06 (LP: #1956614) // CVE- url: https://ubuntu.com/security/CVE-2021-47565
  • scsi: mpt3sas: Fix kernel panic during drive powercycle test
• Bionic update: upstream stable patchset 2022-01-06…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• initcall_blacklist: Does not allow kernel_lockdown be blacklisted (bsc#1237521).
• x86/bhi: Avoid warning in #DB handler due to BHI mitigation (git-fixes).
• x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (git-fixes).
• x86/bugs: Fix BHI documentation (git-fixes).
• x86/bugs: Fix BHI handling of RRSBA (git-fixes).
• x86/bugs: Fix BHI retpoline check (git-fixes).
• x86/bugs: Fix return type of spectre_bhi_state() (git-fixes).
• x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (git-fixes).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239095).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• Revert 'gfs2: Fix inode height consistency check (git-fixes).
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• cifs: Add a laundromat thread for cached directories (git-fixes).
• cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path (git-fixes).
• gfs2: Fix inode height consistency check (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• sched/membarrier: Fix redundant load of membarrier_state (bsc#1232743).
• smb3: allow controlling length of time directory entries are cached with dir leases (git-fixes).
• smb3: do not start laundromat thread when dir leases disabled (git-fixes).
• smb3: retrying on failed server close (git-fixes).
• smb: client: destroy cfid_put_wq on module exit (git-fixes).
• smb: client: disable directory caching when dir_cache_timeout is zero (git-fixes).
• smb: client: do not start laundromat thread on nohandlecache (git-fixes).
• smb: client: make laundromat a delayed worker (git-fixes).
• smb: client: properly close cfids on umount (bsc#1231432, bsc#1232299, bsc#1235599, bsc#1234896).
• tpm: send_data: Wait longer for the TPM to become ready (bsc#1235870).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21714: RDMA/mlx5: Fix implicit ODP use after free (bsc#1237890).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21732: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (bsc#1237877).
• CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).
• CVE-2025-21839: kABI: Fix kABI after backport od CVE-2025-21839 (bsc#1239061).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• RDMA/mlx5: Fix implicit ODP hang on parent deregistration (git-fixes)
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• gfs2: Fix inode height consistency check (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup (bsc#1240195).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• x86/bhi: Avoid warning in #DB handler due to BHI mitigation (git-fixes).
• x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (git-fixes).
• x86/bugs: Fix BHI documentation (git-fixes).
• x86/bugs: Fix BHI handling of RRSBA (git-fixes).
• x86/bugs: Fix BHI retpoline check (git-fixes).
• x86/bugs: Fix return type of spectre_bhi_state() (git-fixes).
• x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (git-fixes).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239095).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• cifs: Add a laundromat thread for cached directories (git-fixes).
• cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path (git-fixes).
• gfs2: Fix inode height consistency check (git-fixes).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• sched/membarrier: Fix redundant load of membarrier_state (bsc#1232743).
• smb: client: destroy cfid_put_wq on module exit (git-fixes).
• smb: client: disable directory caching when dir_cache_timeout is zero (git-fixes).
• smb: client: do not start laundromat thread on nohandlecache (git-fixes).
• smb: client: make laundromat a delayed worker (git-fixes).
• smb: client: properly close cfids on umount (bsc#1231432, bsc#1232299, bsc#1235599, bsc#1234896).
• smb3: allow controlling length of time directory entries are cached with dir leases (git-fixes).
• smb3: do not start laundromat thread when dir leases disabled (git-fixes).
• smb3: retrying on failed server close (git-fixes).
• tpm: send_data: Wait longer for the TPM to become ready (bsc#1235870).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-47645: media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com (bsc#1237767).
• CVE-2021-47648: gpu: host1x: Fix a memory leak in 'host1x_remove()' (bsc#1237725).
• CVE-2022-49046: i2c: dev: check return value when calling dev_set_name() (bsc#1237842).
• CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (bsc#1237903).
• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49059: nfc: nci: add flush_workqueue to prevent uaf (bsc#1238007).
• CVE-2022-49074: irqchip/gic-v3: Fix GICR_CTLR.RWP polling (bsc#1237728).
• CVE-2022-49075: btrfs: fix qgroup reserve overflow the qgroup limit (bsc#1237733).
• CVE-2022-49084: qede: confirm skb is allocated before using (bsc#1237751).
• CVE-2022-49107: ceph: fix memory leak in ceph_readdir when note_last_dentry returns error (bsc#1237973).
• CVE-2022-49109: ceph: fix inode reference leakage in ceph_get_snapdir() (bsc#1237836).
• CVE-2022-49119: scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() (bsc#1237925).
• CVE-2022-49120: scsi: pm8001: Fix task leak in pm8001_send_abort_all() (bsc#1237969).
• CVE-2022-49209: bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full (bsc#1238252).
• CVE-2022-49220: dax: make sure inodes are flushed before destroy cache (bsc#1237936).
• CVE-2022-49275: can: m_can: m_can_tx_handler(): fix use after free of skb (bsc#1238719).
• CVE-2022-49286: tpm: use try_get_ops() in tpm-space.c (bsc#1238647).
• CVE-2022-49292: ALSA: oss: Fix PCM OSS buffer allocation overflow (bsc#1238625).
• CVE-2022-49308: extcon: Modify extcon device to be created after driver data is set (bsc#1238654).
• CVE-2022-49331: nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling (bsc#1237813).
• CVE-2022-49344: af_unix: Fix a data-race in unix_dgram_peer_wake_me() (bsc#1237988).
• CVE-2022-49367: net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register (bsc#1238447).
• CVE-2022-49370: firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (bsc#1238467).
• CVE-2022-49372: tcp: tcp_rtx_synack() can be called from process context (bsc#1238251).
• CVE-2022-49388: ubi: ubi_create_volume: Fix use-after-free when volume creation failed (bsc#1237934).
• CVE-2022-49395: um: Fix out-of-bounds read in LDT setup (bsc#1237953).
• CVE-2022-49397: phy: qcom-qmp: fix struct clk leak on probe errors (bsc#1237823).
• CVE-2022-49404: RDMA/hfi1: Fix potential integer multiplication overflow errors (bsc#1238430).
• CVE-2022-49416: wifi: mac80211: fix use-after-free in chanctx code (bsc#1238293).
• CVE-2022-49433: RDMA/hfi1: Prevent use of lock before it is initialized (bsc#1238268).
• CVE-2022-49472: net: phy: micrel: Allow probing without .driver_data (bsc#1238951).
• CVE-2022-49488: drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock (bsc#1238600).
• CVE-2022-49495: drm/msm/hdmi: check return value after calling platform_get_resource_byname() (bsc#1237932).
• CVE-2022-49497: net: remove two BUG() from skb_checksum_help() (bsc#1238946).
• CVE-2022-49505: NFC: NULL out the dev->rfkill to prevent UAF (bsc#1238615).
• CVE-2022-49516: ice: always check VF VSI pointer values (bsc#1238953).
• CVE-2022-49519: ath10k: skip ath10k_halt during suspend for driver state RESTARTING (bsc#1238943).
• CVE-2022-49524: media: pci: cx23885: Fix the error handling in cx23885_initdev() (bsc#1238949).
• CVE-2022-49530: drm/amd/pm: fix double free in si_parse_power_table() (bsc#1238944).
• CVE-2022-49538: ALSA: jack: Fix mutex call in snd_jack_report() (bsc#1238843).
• CVE-2022-49544: ipw2x00: Fix potential NULL dereference in libipw_xmit() (bsc#1238721).
• CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238729). -…