CVE-2022-49715

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions of_find_node_by_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.

• net/sched: serialize qdisc_rtab_list against concurrent get/put {CVE-2026-68138}
• static_call: Replace pointless WARN_ON() in static_call_module_notify() {CVE-2024-49954}
• static_call: Handle module init failure correctly in static_call_del_module() {CVE-2024-50002}
• smb: client: require a full NFS mode SID before reading mode bits {CVE-2026-43350}
• octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() {CVE-2025-39978}
• scsi: core: Fix refcount leak for tagset_refcnt {CVE-2026-23296}
• wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() {CVE-2026-23336}
• smb: client: fix memory leak in cifs_construct_tcon() {CVE-2025-68295}
• sched/deadline: Fix warning in migrate_enable for boosted tasks {CVE-2024-56583}
• nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() {CVE-2025-40261}
• usbnet: Prevents free active kevent {CVE-2025-68312}
• libceph: bound get_version reply decode to front len {CVE-2026-68433}
• neigh: let neigh_xmit take skb ownership {CVE-2026-52981}
• gve: prevent ethtool ops after shutdown {CVE-2025-38735}
• vfs: Don't leak disconnected dentries on umount {CVE-2025-40105}
• NFSD: NFSv4 file creation neglects setting ACL {CVE-2025-68803}
• thermal: intel: int340x: processor: Fix warning during module unload {CVE-2024-50093}
• quota: fix warning in dqgrab() {CVE-2023-54177}
• mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] {CVE-2026-31458}
• net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change {CVE-2025-71066}
• bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue {CVE-2024-36938}
• net: hv_netvsc: reject RSS hash key programming without RX indirection table {CVE-2026-23054}
• xsk: tighten UMEM headroom validation to account for tailroom and min frame {CVE-2026-43093}
• drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) {CVE-2024-39497}
• bpf: Fix OOB in pcpu_init_value {CVE-2026-53076}
• ftrace: Clean up hash direct_functions on register failures {CVE-2022-49402}
• binfmt_misc: restore write access before closing files opened by open_exec() {CVE-2025-68239}
• smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path {CVE-2025-39929}
• wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() {CVE-2026-53102}
• xen: Add support for XenServer 6.1 platform device {CVE-2025-38046}
• i2c: tegra: Do not mark ACPI devices as irq safe {CVE-2024-45029}
• bpf: Add preempt_count_{sub,add} into btf id deny list {CVE-2023-54086}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose() {CVE-2025-68291}
• net/mlx5: Fix missing lock on sync reset reload {CVE-2024-42268}
• vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432}
• netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels {CVE-2026-23274}
• drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async {CVE-2026-64219}
• mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations {CVE-2026-31394}
• bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path {CVE-2026-53096}
• scsi: mpi3mr: Fix possible crash when setting up bsg fails {CVE-2025-21723}
• net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup {CVE-2025-68192}
• net: stream: purge sk_error_queue in sk_stream_kill_queues() {CVE-2022-50838}
• clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context {CVE-2025-21767}
• net: netpoll: fix incorrect refcount handling causing incorrect cleanup {CVE-2025-68245}
• drm/amd/display: Check link_res->hpo_dp_link_enc before using it {CVE-2024-47704}
• crypto: qat - flush misc workqueue during device shutdown {CVE-2025-39721}
• crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed {CVE-2026-31698}
• smb: client: split cached_fid bitfields to avoid…

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions of_find_node_by_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47670: can: peak_usb: fix use after free bugs (bsc#1241407).
• CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
• CVE-2022-49145: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (bsc#1238162).
• CVE-2022-49168: btrfs: do not clean up repair bio if submit fails (bsc#1238109).
• CVE-2022-49190: kernel/resource: fix kfree() of bootmem memory again (bsc#1238130).
• CVE-2022-49212: mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init (bsc#1238331).
• CVE-2022-49216: drm/tegra: Fix reference leak in tegra_dsi_ganged_probe (bsc#1238338).
• CVE-2022-49235: ath9k_htc: fix uninit value bugs (bsc#1238333).
• CVE-2022-49248: ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction (bsc#1238284).
• CVE-2022-49253: media: usb: go7007: s2250-board: fix leak in probe() (bsc#1238420).
• CVE-2022-49320: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type (bsc#1238394).
• CVE-2022-49326: rtl818x: Prevent using not initialized queues (bsc#1238646).
• CVE-2022-49371: driver core: fix deadlock in __device_attach (bsc#1238546).
• CVE-2022-49382: soc: rockchip: Fix refcount leak in rockchip_grf_init (bsc#1238306).
• CVE-2022-49396: phy: qcom-qmp: fix reset-controller leak on probe errors (bsc#1238289).
• CVE-2022-49420: net: annotate races around sk->sk_bound_dev_if (bsc#1238887).
• CVE-2022-49441: tty: fix deadlock caused by calling printk() under tty_port->lock (bsc#1238263).
• CVE-2022-49445: pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() (bsc#1238019).
• CVE-2022-49460: PM / devfreq: rk3399_dmc: Disable edev on remove() (bsc#1238892).
• CVE-2022-49467: drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() (bsc#1238815).
• CVE-2022-49474: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout (bsc#1238071).
• CVE-2022-49491: drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() (bsc#1238539).
• CVE-2022-49503: ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix (bsc#1238868).
• CVE-2022-49592: net: stmmac: fix dma queue left shift overflow issue (bsc#1238311).
• CVE-2022-49625: sfc: fix kernel panic when creating VF (bsc#1238411).
• CVE-2022-49635: drm/i915/selftests: fix subtraction overflow bug (bsc#1238806).
• CVE-2022-49652: dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate (bsc#1238871).
• CVE-2022-49715: irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions (bsc#1238818).
• CVE-2022-49728: kABI workaround for changeing the variable length type to size_t (bsc#1239111).
• CVE-2022-49729: nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred (bsc#1239060).
• CVE-2022-49751: w1: fix WARNING after calling w1_process() (bsc#1240254).
• CVE-2022-49761: btrfs: always report error in run_one_delayed_ref() (bsc#1240261).
• CVE-2022-49772: ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (bsc#1242147).
• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2022-49776: macvlan: enforce a consistent minimal mtu (bsc#1242248).
• CVE-2022-49787: mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (bsc#1242352).
• CVE-2022-49788: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (bsc#1242353).
• CVE-2022-49813: net: ena: Fix error handling in ena_init() (bsc#1242497).
• CVE-2022-49821: mISDN: fix possible memory leak in mISDN_dsp_element_register() (bsc#1242542).
• CVE-2022-49826: ata: libata-transport: fix double ata_host_put() in ata_tport_add() (bsc#1242549).
• CVE-2022-49829: drm/scheduler: fix fence ref counting (bsc#1242691).
• CVE-2022-49832: pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (bsc#1242154).
• CVE-2022-49835: ALSA: hda: fix potential memleak in…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• initcall_blacklist: Does not allow kernel_lockdown be blacklisted (bsc#1237521).
• x86/bhi: Avoid warning in #DB handler due to BHI mitigation (git-fixes).
• x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (git-fixes).
• x86/bugs: Fix BHI documentation (git-fixes).
• x86/bugs: Fix BHI handling of RRSBA (git-fixes).
• x86/bugs: Fix BHI retpoline check (git-fixes).
• x86/bugs: Fix return type of spectre_bhi_state() (git-fixes).
• x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (git-fixes).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239095).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• Revert 'gfs2: Fix inode height consistency check (git-fixes).
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• cifs: Add a laundromat thread for cached directories (git-fixes).
• cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path (git-fixes).
• gfs2: Fix inode height consistency check (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• sched/membarrier: Fix redundant load of membarrier_state (bsc#1232743).
• smb3: allow controlling length of time directory entries are cached with dir leases (git-fixes).
• smb3: do not start laundromat thread when dir leases disabled (git-fixes).
• smb3: retrying on failed server close (git-fixes).
• smb: client: destroy cfid_put_wq on module exit (git-fixes).
• smb: client: disable directory caching when dir_cache_timeout is zero (git-fixes).
• smb: client: do not start laundromat thread on nohandlecache (git-fixes).
• smb: client: make laundromat a delayed worker (git-fixes).
• smb: client: properly close cfids on umount (bsc#1231432, bsc#1232299, bsc#1235599, bsc#1234896).
• tpm: send_data: Wait longer for the TPM to become ready (bsc#1235870).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21714: RDMA/mlx5: Fix implicit ODP use after free (bsc#1237890).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21732: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (bsc#1237877).
• CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).
• CVE-2025-21839: kABI: Fix kABI after backport od CVE-2025-21839 (bsc#1239061).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• RDMA/mlx5: Fix implicit ODP hang on parent deregistration (git-fixes)
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• gfs2: Fix inode height consistency check (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup (bsc#1240195).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• x86/bhi: Avoid warning in #DB handler due to BHI mitigation (git-fixes).
• x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (git-fixes).
• x86/bugs: Fix BHI documentation (git-fixes).
• x86/bugs: Fix BHI handling of RRSBA (git-fixes).
• x86/bugs: Fix BHI retpoline check (git-fixes).
• x86/bugs: Fix return type of spectre_bhi_state() (git-fixes).
• x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (git-fixes).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239095).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• cifs: Add a laundromat thread for cached directories (git-fixes).
• cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path (git-fixes).
• gfs2: Fix inode height consistency check (git-fixes).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• sched/membarrier: Fix redundant load of membarrier_state (bsc#1232743).
• smb: client: destroy cfid_put_wq on module exit (git-fixes).
• smb: client: disable directory caching when dir_cache_timeout is zero (git-fixes).
• smb: client: do not start laundromat thread on nohandlecache (git-fixes).
• smb: client: make laundromat a delayed worker (git-fixes).
• smb: client: properly close cfids on umount (bsc#1231432, bsc#1232299, bsc#1235599, bsc#1234896).
• smb3: allow controlling length of time directory entries are cached with dir leases (git-fixes).
• smb3: do not start laundromat thread when dir leases disabled (git-fixes).
• smb3: retrying on failed server close (git-fixes).
• tpm: send_data: Wait longer for the TPM to become ready (bsc#1235870).