CVE-2022-49850

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix use after free in hci_send_acl

This fixes the following trace caused by receiving HCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without first checking if conn->type is in fact AMP_LINK and in case it is do properly cleanup upper layers with hci_disconn_cfm:

================================================================== BUG: KASAN: use-after-free in hci_send_acl+0xaba/0xc50 Read of size 8 at addr ffff88800e404818 by task bluetoothd/142

CPU: 0 PID: 142 Comm: bluetoothd Not tainted
5.17.0-rc5-00006-gda4022eeac1a #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x45/0x59
 print_address_description.constprop.0+0x1f/0x150
 kasan_report.cold+0x7f/0x11b
 hci_send_acl+0xaba/0xc50
 l2cap_do_send+0x23f/0x3d0
 l2cap_chan_send+0xc06/0x2cc0
 l2cap_sock_sendmsg+0x201/0x2b0
 sock_sendmsg+0xdc/0x110
 sock_write_iter+0x20f/0x370
 do_iter_readv_writev+0x343/0x690
 do_iter_write+0x132/0x640
 vfs_writev+0x198/0x570
 do_writev+0x202/0x280
 do_syscall_64+0x38/0x90
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RSP: 002b:00007ffce8a099b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3
0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 14 00 00 00 0f 05
<48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
RDX: 0000000000000001 RSI: 00007ffce8a099e0 RDI: 0000000000000015
RAX: ffffffffffffffda RBX: 00007ffce8a099e0 RCX: 00007f788fc3cf77
R10: 00007ffce8af7080 R11: 0000000000000246 R12: 000055e4ccf75580
RBP: 0000000000000015 R08: 0000000000000002 R09: 0000000000000001
</TASK>
R13: 000055e4ccf754a0 R14: 000055e4ccf75cd0 R15: 000055e4ccf4a6b0

Allocated by task 45:
    kasan_save_stack+0x1e/0x40
    __kasan_kmalloc+0x81/0xa0
    hci_chan_create+0x9a/0x2f0
    l2cap_conn_add.part.0+0x1a/0xdc0
    l2cap_connect_cfm+0x236/0x1000
    le_conn_complete_evt+0x15a7/0x1db0
    hci_le_conn_complete_evt+0x226/0x2c0
    hci_le_meta_evt+0x247/0x450
    hci_event_packet+0x61b/0xe90
    hci_rx_work+0x4d5/0xc50
    process_one_work+0x8fb/0x15a0
    worker_thread+0x576/0x1240
    kthread+0x29d/0x340
    ret_from_fork+0x1f/0x30

Freed by task 45:
    kasan_save_stack+0x1e/0x40
    kasan_set_track+0x21/0x30
    kasan_set_free_info+0x20/0x30
    __kasan_slab_free+0xfb/0x130
    kfree+0xac/0x350
    hci_conn_cleanup+0x101/0x6a0
    hci_conn_del+0x27e/0x6c0
    hci_disconn_phylink_complete_evt+0xe0/0x120
    hci_event_packet+0x812/0xe90
    hci_rx_work+0x4d5/0xc50
    process_one_work+0x8fb/0x15a0
    worker_thread+0x576/0x1240
    kthread+0x29d/0x340
    ret_from_fork+0x1f/0x30

The buggy address belongs to the object at ffff88800c0f0500
The buggy address is located 24 bytes inside of
which belongs to the cache kmalloc-128 of size 128
The buggy address belongs to the page:
128-byte region [ffff88800c0f0500, ffff88800c0f0580)
flags: 0x100000000000200(slab|node=0|zone=1)
page:00000000fe45cd86 refcount:1 mapcount:0
mapping:0000000000000000 index:0x0 pfn:0xc0f0
raw: 0000000000000000 0000000080100010 00000001ffffffff
0000000000000000
raw: 0100000000000200 ffffea00003a2c80 dead000000000004
ffff8880078418c0
page dumped because: kasan: bad access detected
ffff88800c0f0400: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
Memory state around the buggy address:
>ffff88800c0f0500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88800c0f0480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

…

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix deadlock in nilfs_count_free_blocks() A semaphore deadlock can occur if nilfs_get_block() detects metadata corruption while locating data blocks and a superblock writeback occurs at the same time: task 1 task 2 ------ ------ * A file operation * nilfs_truncate() nilfs_get_block() down_read(rwsem A) <-- nilfs_bmap_lookup_contig() ... generic_shutdown_super() nilfs_put_super() * Prepare to write superblock * down_write(rwsem B) <-- nilfs_cleanup_super() * Detect b-tree corruption * nilfs_set_log_cursor() nilfs_bmap_convert_error() nilfs_count_free_blocks() __nilfs_error() down_read(rwsem A) <-- nilfs_set_error() down_write(rwsem B) <-- *** DEADLOCK *** Here, nilfs_get_block() readlocks rwsem A (= NILFS_MDT(dat_inode)->mi_sem) and then calls nilfs_bmap_lookup_contig(), but if it fails due to metadata corruption, __nilfs_error() is called from nilfs_bmap_convert_error() inside the lock section. Since __nilfs_error() calls nilfs_set_error() unless the filesystem is read-only and nilfs_set_error() attempts to writelock rwsem B (= nilfs->ns_sem) to write back superblock exclusively, hierarchical lock acquisition occurs in the order rwsem A -> rwsem B. Now, if another task starts updating the superblock, it may writelock rwsem B during the lock sequence above, and can deadlock trying to readlock rwsem A in nilfs_count_free_blocks(). However, there is actually no need to take rwsem A in nilfs_count_free_blocks() because it, within the lock section, only reads a single integer data on a shared struct with nilfs_sufile_get_ncleansegs(). This has been the case after commit aa474a220180 ("nilfs2: add local variable to cache the number of clean segments"), that is, even before this bug was introduced. So, this resolves the deadlock problem by just not taking the semaphore in nilfs_count_free_blocks().

• Bionic update: upstream stable patchset 2022-04-13 (LP: #1968932) // CVE- url: https://ubuntu.com/security/CVE-2022-23041
  • xen/gnttab: fix gnttab_end_foreign_access() without page specified
• Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596) // CVE- url: https://ubuntu.com/security/CVE-2022-49850
  • nilfs2: fix deadlock in nilfs_count_free_blocks()
• CVE-url: https://ubuntu.com/security/CVE-2024-42305
  • ext4: check dot and dotdot of dx_root before making dir indexed
• CVE-url: https://ubuntu.com/security/CVE-2024-53168
  • sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
• CVE-url: https://ubuntu.com/security/CVE-2024-26915
  • drm/amdgpu: Add check to prevent IH overflow
  • drm/amdgpu: Reset IH OVERFLOW_CLEAR bit
• CVE-url: https://ubuntu.com/security/CVE-2024-56770
  • net/sched: netem: account for backlog updates from child qdisc
  • netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47587
  • net: systemport: Add global locking for descriptor lifecycle
• Bionic update: upstream stable patchset 2021-06-01 (LP: #1930472) // CVE- url: https://ubuntu.com/security/CVE-2021-46959
  • spi: Fix use-after-free with devm_spi_alloc_*
• CVE-url: https://ubuntu.com/security/CVE-2024-26689
  • ceph: prevent use-after-free in encode_cap_msg()
• CVE-url: https://ubuntu.com/security/CVE-2024-53066
  • nfs: Fix KMSAN warning in decode_getfattr_attrs()
• CVE-url: https://ubuntu.com/security/CVE-2024-49944
  • sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
• CVE-url: https://ubuntu.com/security/CVE-2024-50237
  • wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
• CVE-url: https://ubuntu.com/security/CVE-2024-46780
  • nilfs2: protect references to superblock parameters exposed in sysfs
• CVE-url: https://ubuntu.com/security/CVE-2024-53063
  • media: dvbdev: prevent the risk of out of memory access
  • media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
• CVE-url: https://ubuntu.com/security/CVE-2021-47150
  • net: fec: fix the potential memory leak in fec_enet_init()
• CVE-url: https://ubuntu.com/security/CVE-2024-53140
  • netlink: terminate outstanding dump on socket close
• CVE-url: https://ubuntu.com/security/CVE-2025-21971
  • net_sched: Prevent creation of classes with TC_H_ROOT
• CVE-url: https://ubuntu.com/security/CVE-2023-52572
  • cifs: Fix UAF in cifs_demultiplex_thread()
• CVE-url: https://ubuntu.com/security/CVE-2025-37785
  • ext4: fix OOB read when checking dotdot dir
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47277
  • kvm: avoid speculation-based attacks from out-of-range memslot accesses
• CVE-url: https://ubuntu.com/security/CVE-2022-49740
  • wifi: brcmfmac: Check the count value of channel spec to prevent out-of- bounds reads
• Bionic update: upstream stable patchset 2022-07-25 (LP: #1982782) // CVE- url: https://ubuntu.com/security/CVE-2022-49404
  • RDMA/hfi1: Fix potential integer multiplication overflow errors
• Bionic update: upstream stable patchset 2023-03-03 (LP: #2009237) // CVE- url: https://ubuntu.com/security/CVE-2022-49757
  • EDAC/highbank: Fix memory leak in highbank_mc_probe()
• Bionic update: upstream stable patchset 2022-07-25 (LP: #1982782) // CVE- url: https://ubuntu.com/security/CVE-2022-49395
  • um: Fix out-of-bounds read in LDT setup
• CVE-url: https://ubuntu.com/security/CVE-2022-49738
  • f2fs: fix to do sanity check on summary info
  • f2fs: should put a page when checking the summary info
  • f2fs: fix to do sanity check on i_extra_isize in is_alive()
• CVE-url:…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49110: netfilter: conntrack: revisit gc autotuning (bsc#1237981).
• CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
• CVE-2022-49767: 9p/trans_fd: always use O_NONBLOCK read/write (bsc#1242493).
• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21888: RDMA/mlx5: Fix a WARN during dereg_mr for DM type (bsc#1240177).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
• CVE-2025-23138: watch_queue: fix pipe accounting mismatch (bsc#1241648).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).

The following non-security bugs were fixed:

• Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• Refresh fixes for cBPF issue (bsc#1242778)
• Remove debug flavor (bsc#1243919)
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• scsi: storvsc: Set correct data length for sending SCSI command without payload (git-fixes).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).

The following non-security bugs were fixed:

• Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• Remove debug flavor (bsc#1243919).
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• net :mana :Add remaining GDMA stats for MANA to ethtool (bsc#1234395).
• net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (bsc#1234395).
• net: mana: Add gdma stats to ethtool output for mana (bsc#1234395).
• nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (bsc#1223096).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• tcp: Dump bound-only sockets in inet_diag (bsc#1204562).
• tpm, tpm_tis: Workaround failed command reception on Infineon devices (bsc#1235870).
• tpm: tis: Double the timeout B to 4s (bsc#1235870).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
• CVE-2024-28956: x86/its: Add support for ITS-safe indirect thunk (bsc#1242006).
• CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).

The following non-security bugs were fixed:

• Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• Move upstreamed sched/membarrier patch into sorted section
• Remove debug flavor (bsc#1243919). This is only released in Leap, and we do not have Leap 15.4 anymore.
• Remove debug flavor (bsc#1243919). This is only released in Leap, and we do not have Leap 15.5 anymore.
• Use gcc-13 for build on SLE16 (jsc#PED-10028).
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• net :mana :Add remaining GDMA stats for MANA to ethtool (bsc#1234395).
• net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (bsc#1234395).
• net: mana: Add gdma stats to ethtool output for mana (bsc#1234395).
• nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (bsc#1223096).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• rpm/kernel-binary.spec.in: Also order against update-bootloader (boo#1228659, boo#1240785, boo#1241038).
• rpm/kernel-binary.spec.in: Fix missing 20-kernel-default-extra.conf (bsc#1239986)
• rpm/kernel-binary.spec.in: fix KMPs build on 6.13+ (bsc#1234454)
• rpm/kernel-docs.spec.in: Workaround for reproducible builds (bsc#1238303)
• rpm/release-projects: Update the ALP projects again (bsc#1231293).
• rpm/split-modules: Fix optional splitting with usrmerge (bsc#1238570)
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• tcp: Dump bound-only sockets in inet_diag (bsc#1204562).
• tpm, tpm_tis: Workaround failed command reception on Infineon devices (bsc#1235870).
• tpm: tis: Double the timeout B to 4s (bsc#1235870).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49110: netfilter: conntrack: revisit gc autotuning (bsc#1237981).
• CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
• CVE-2022-49767: 9p/trans_fd: always use O_NONBLOCK read/write (bsc#1242493).
• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2022-49858: octeontx2-pf: Fix SQE threshold checking (bsc#1242589).
• CVE-2023-53058: net/mlx5: E-Switch, Fix an Oops in error handling code (bsc#1242237).
• CVE-2023-53060: igb: revert rtnl_lock() that causes deadlock (bsc#1242241).
• CVE-2023-53064: iavf: Fix hang on reboot with ice (bsc#1242222).
• CVE-2023-53066: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info (bsc#1242227).
• CVE-2023-53079: net/mlx5: Fix steering rules cleanup (bsc#1242765).
• CVE-2023-53114: i40e: Fix kernel crash during reboot when adapter is in recovery mode (bsc#1242398).
• CVE-2023-53134: bnxt_en: Avoid order-5 memory allocation for TPA data (bsc#1242380)
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21888: RDMA/mlx5: Fix a WARN during dereg_mr for DM type (bsc#1240177).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
• CVE-2025-23138: watch_queue: fix pipe accounting mismatch (bsc#1241648).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).

The following non-security bugs were fixed:

• Refresh fixes for cBPF issue (bsc#1242778)
• Remove debug flavor (bsc#1243919).
• Update metadata and put them into the sorted part of the series
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• scsi: storvsc: Set correct data length for sending SCSI command without payload (git-fixes).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
• CVE-2024-28956: x86/its: Add support for ITS-safe indirect thunk (bsc#1242006).
• CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).

The following non-security bugs were fixed:

• Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• Move upstreamed sched/membarrier patch into sorted section
• Remove debug flavor (bsc#1243919). This is only released in Leap, and we do not have Leap 15.4 anymore.
• Remove debug flavor (bsc#1243919). This is only released in Leap, and we do not have Leap 15.5 anymore.
• Use gcc-13 for build on SLE16 (jsc#PED-10028).
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• net :mana :Add remaining GDMA stats for MANA to ethtool (bsc#1234395).
• net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (bsc#1234395).
• net: mana: Add gdma stats to ethtool output for mana (bsc#1234395).
• nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (bsc#1223096).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• rpm/kernel-binary.spec.in: Also order against update-bootloader (boo#1228659, boo#1240785, boo#1241038).
• rpm/kernel-binary.spec.in: Fix missing 20-kernel-default-extra.conf (bsc#1239986)
• rpm/kernel-binary.spec.in: fix KMPs build on 6.13+ (bsc#1234454)
• rpm/kernel-docs.spec.in: Workaround for reproducible builds (bsc#1238303)
• rpm/release-projects: Update the ALP projects again (bsc#1231293).
• rpm/split-modules: Fix optional splitting with usrmerge (bsc#1238570)
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• tcp: Dump bound-only sockets in inet_diag (bsc#1204562).
• tpm, tpm_tis: Workaround failed command reception on Infineon devices (bsc#1235870).
• tpm: tis: Double the timeout B to 4s (bsc#1235870).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).