CVE-2022-49530

• vsock: Keep the binding until socket destruction {CVE-2025-21756}
• mt76: fix use-after-free by removing a non-RCU wcid pointer {CVE-2022-49328}
• bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• net: sched: Fix use after free in red_enqueue() {CVE-2022-49921}
• udf: Fix a slab-out-of-bounds write bug in udf_find_entry() {CVE-2022-49846}
• ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892}
• dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• mac80211: fix potential double free on mesh join {CVE-2022-49290}
• wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416}
• ext4: fix OOB read when checking dotdot dir {CVE-2025-37785}
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
• tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
• wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}
• mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths {CVE-2022-48991}
• cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}
• media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init {CVE-2022-49478}
• HID: elan: Fix potential double free in elan_input_configured {CVE-2022-49508}
• bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers {CVE-2023-52621}
• drm/amd/pm: fix double free in si_parse_power_table() {CVE-2022-49530}
• drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() {CVE-2025-21780}
• crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612}
• sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168}
• net: make sock_inuse_add() available {CVE-2024-53168}

• vsock: Keep the binding until socket destruction {CVE-2025-21756}
• mt76: fix use-after-free by removing a non-RCU wcid pointer {CVE-2022-49328}
• bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• net: sched: Fix use after free in red_enqueue() {CVE-2022-49921}
• udf: Fix a slab-out-of-bounds write bug in udf_find_entry() {CVE-2022-49846}
• ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892}
• dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• mac80211: fix potential double free on mesh join {CVE-2022-49290}
• wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416}
• ext4: fix OOB read when checking dotdot dir {CVE-2025-37785}
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
• tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
• wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}
• mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths {CVE-2022-48991}
• cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}
• media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init {CVE-2022-49478}
• HID: elan: Fix potential double free in elan_input_configured {CVE-2022-49508}
• bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers {CVE-2023-52621}
• drm/amd/pm: fix double free in si_parse_power_table() {CVE-2022-49530}
• drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() {CVE-2025-21780}
• crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612}
• sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168}
• net: make sock_inuse_add() available {CVE-2024-53168}

• media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init {CVE-2022-49478}
• x86/kvm: Disable kvmclock on all CPUs on shutdown {CVE-2021-47110}
• cifs: fix potential double free during failed mount {CVE-2022-49541}
• drm/amd/pm: fix double free in si_parse_power_table() {CVE-2022-49530}

• media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init {CVE-2022-49478}
• x86/kvm: Disable kvmclock on all CPUs on shutdown {CVE-2021-47110}
• cifs: fix potential double free during failed mount {CVE-2022-49541}
• drm/amd/pm: fix double free in si_parse_power_table() {CVE-2022-49530}

• Focal update: v5.4.292 upstream stable release (LP: #2109357) // CVE-url: https://ubuntu.com/security/CVE-2025-37937
  • objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
• Focal update: v5.4.287 upstream stable release (LP: #2095145) // CVE-url: https://ubuntu.com/security/CVE-2024-53197
  • ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
• Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596) // CVE- url: https://ubuntu.com/security/CVE-2022-49909
  • Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
• Bionic update: upstream stable patchset 2022-07-25 (LP: #1982782) // CVE- url: https://ubuntu.com/security/CVE-2022-49530
  • drm/amd/pm: fix double free in si_parse_power_table()
• CVE-url: https://ubuntu.com/security/CVE-2025-39688
  • nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid()
• CVE-url: https://ubuntu.com/security/CVE-2024-50106
  • nfsd: simplify nfs4_put_deleg_lease calls
  • nfsd: factor out common delegation-destruction code
  • nfsd: Fix race to FREE_STATEID and cl_revoked
  • nfsd: don't call functions with side-effecting inside WARN_ON()
  • nfsd: remove fault injection code
  • nfsd: avoid race after unhash_delegation_locked()
  • nfsd: split sc_status out of sc_type
  • nfsd: fix race between laundromat and free_stateid
• CVE-url: https://ubuntu.com/security/CVE-2024-35937
  • wifi: cfg80211: check A-MSDU format more carefully
• CVE-url: https://ubuntu.com/security/CVE-2024-49966
  • ocfs2: cancel dqi_sync_work before freeing oinfo
• CVE-url: https://ubuntu.com/security/CVE-2023-52588
  • f2fs: fix to tag gcing flag on page during block migration
• CVE-url: https://ubuntu.com/security/CVE-2024-57798
  • drm/dp-mst-helper: Remove hotplug callback
  • drm/dp_mst: Remove huge conditional in drm_dp_mst_handle_up_req()
  • drm/dp_mst: Refactor drm_dp_mst_handle_up_req()
  • drm/dp_mst: Rename drm_dp_add_port and drm_dp_update_port
  • drm/dp_mst: Handle UP requests asynchronously
  • drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()
• Miscellaneous Ubuntu changes
  • [Config] updateconfigs for NFSD_FAULT_INJECTION

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix double free in si_parse_power_table() In function si_parse_power_table(), array adev->pm.dpm.ps and its member is allocated. If the allocation of each member fails, the array itself is freed and returned with an error code. However, the array is later freed again in si_dpm_fini() function which is called when the function returns an error. This leads to potential double free of the array adev->pm.dpm.ps, as well as leak of its array members, since the members are not freed in the allocation function and the array is not nulled when freed. In addition adev->pm.dpm.num_ps, which keeps track of the allocated array member, is not updated until the member allocation is successfully finished, this could also lead to either use after free, or uninitialized variable access in si_dpm_fini(). Fix this by postponing the free of the array until si_dpm_fini() and increment adev->pm.dpm.num_ps everytime the array member is allocated.

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239095).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• Revert 'gfs2: Fix inode height consistency check (git-fixes).
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• cifs: Add a laundromat thread for cached directories (git-fixes).
• cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path (git-fixes).
• gfs2: Fix inode height consistency check (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• sched/membarrier: Fix redundant load of membarrier_state (bsc#1232743).
• smb3: allow controlling length of time directory entries are cached with dir leases (git-fixes).
• smb3: do not start laundromat thread when dir leases disabled (git-fixes).
• smb3: retrying on failed server close (git-fixes).
• smb: client: destroy cfid_put_wq on module exit (git-fixes).
• smb: client: disable directory caching when dir_cache_timeout is zero (git-fixes).
• smb: client: do not start laundromat thread on nohandlecache (git-fixes).
• smb: client: make laundromat a delayed worker (git-fixes).
• smb: client: properly close cfids on umount (bsc#1231432, bsc#1232299, bsc#1235599, bsc#1234896).
• tpm: send_data: Wait longer for the TPM to become ready (bsc#1235870).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239095).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• cifs: Add a laundromat thread for cached directories (git-fixes).
• cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path (git-fixes).
• gfs2: Fix inode height consistency check (git-fixes).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• sched/membarrier: Fix redundant load of membarrier_state (bsc#1232743).
• smb: client: destroy cfid_put_wq on module exit (git-fixes).
• smb: client: disable directory caching when dir_cache_timeout is zero (git-fixes).
• smb: client: do not start laundromat thread on nohandlecache (git-fixes).
• smb: client: make laundromat a delayed worker (git-fixes).
• smb: client: properly close cfids on umount (bsc#1231432, bsc#1232299, bsc#1235599, bsc#1234896).
• smb3: allow controlling length of time directory entries are cached with dir leases (git-fixes).
• smb3: do not start laundromat thread when dir leases disabled (git-fixes).
• smb3: retrying on failed server close (git-fixes).
• tpm: send_data: Wait longer for the TPM to become ready (bsc#1235870).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-47645: media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com (bsc#1237767).
• CVE-2021-47648: gpu: host1x: Fix a memory leak in 'host1x_remove()' (bsc#1237725).
• CVE-2022-49046: i2c: dev: check return value when calling dev_set_name() (bsc#1237842).
• CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (bsc#1237903).
• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49059: nfc: nci: add flush_workqueue to prevent uaf (bsc#1238007).
• CVE-2022-49074: irqchip/gic-v3: Fix GICR_CTLR.RWP polling (bsc#1237728).
• CVE-2022-49075: btrfs: fix qgroup reserve overflow the qgroup limit (bsc#1237733).
• CVE-2022-49084: qede: confirm skb is allocated before using (bsc#1237751).
• CVE-2022-49107: ceph: fix memory leak in ceph_readdir when note_last_dentry returns error (bsc#1237973).
• CVE-2022-49109: ceph: fix inode reference leakage in ceph_get_snapdir() (bsc#1237836).
• CVE-2022-49119: scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() (bsc#1237925).
• CVE-2022-49120: scsi: pm8001: Fix task leak in pm8001_send_abort_all() (bsc#1237969).
• CVE-2022-49209: bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full (bsc#1238252).
• CVE-2022-49220: dax: make sure inodes are flushed before destroy cache (bsc#1237936).
• CVE-2022-49275: can: m_can: m_can_tx_handler(): fix use after free of skb (bsc#1238719).
• CVE-2022-49286: tpm: use try_get_ops() in tpm-space.c (bsc#1238647).
• CVE-2022-49292: ALSA: oss: Fix PCM OSS buffer allocation overflow (bsc#1238625).
• CVE-2022-49308: extcon: Modify extcon device to be created after driver data is set (bsc#1238654).
• CVE-2022-49331: nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling (bsc#1237813).
• CVE-2022-49344: af_unix: Fix a data-race in unix_dgram_peer_wake_me() (bsc#1237988).
• CVE-2022-49367: net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register (bsc#1238447).
• CVE-2022-49370: firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (bsc#1238467).
• CVE-2022-49372: tcp: tcp_rtx_synack() can be called from process context (bsc#1238251).
• CVE-2022-49388: ubi: ubi_create_volume: Fix use-after-free when volume creation failed (bsc#1237934).
• CVE-2022-49395: um: Fix out-of-bounds read in LDT setup (bsc#1237953).
• CVE-2022-49397: phy: qcom-qmp: fix struct clk leak on probe errors (bsc#1237823).
• CVE-2022-49404: RDMA/hfi1: Fix potential integer multiplication overflow errors (bsc#1238430).
• CVE-2022-49416: wifi: mac80211: fix use-after-free in chanctx code (bsc#1238293).
• CVE-2022-49433: RDMA/hfi1: Prevent use of lock before it is initialized (bsc#1238268).
• CVE-2022-49472: net: phy: micrel: Allow probing without .driver_data (bsc#1238951).
• CVE-2022-49488: drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock (bsc#1238600).
• CVE-2022-49495: drm/msm/hdmi: check return value after calling platform_get_resource_byname() (bsc#1237932).
• CVE-2022-49497: net: remove two BUG() from skb_checksum_help() (bsc#1238946).
• CVE-2022-49505: NFC: NULL out the dev->rfkill to prevent UAF (bsc#1238615).
• CVE-2022-49516: ice: always check VF VSI pointer values (bsc#1238953).
• CVE-2022-49519: ath10k: skip ath10k_halt during suspend for driver state RESTARTING (bsc#1238943).
• CVE-2022-49524: media: pci: cx23885: Fix the error handling in cx23885_initdev() (bsc#1238949).
• CVE-2022-49530: drm/amd/pm: fix double free in si_parse_power_table() (bsc#1238944).
• CVE-2022-49538: ALSA: jack: Fix mutex call in snd_jack_report() (bsc#1238843).
• CVE-2022-49544: ipw2x00: Fix potential NULL dereference in libipw_xmit() (bsc#1238721).
• CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238729). -…