CVE-2022-50367

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300)

• kernel: mm: fix zswap writeback race condition (CVE-2023-53178)

• kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300)

• kernel: mm: fix zswap writeback race condition (CVE-2023-53178)

• kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and leads to crashes(e.g., UAF/GPF). Fix this by moving security_inode_alloc just prior to this_cpu_inc(nr_inodes)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)
• kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)
• kernel: crypto: xts - Handle EBUSY correctly (CVE-2023-53494)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300)
• kernel: mm: fix zswap writeback race condition (CVE-2023-53178)
• kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300)
• kernel: mm: fix zswap writeback race condition (CVE-2023-53178)
• kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• wifi: mwifiex: Fix OOB and integer underflow when rx packets {CVE-2023-53226} {CVE-2023-53226}
• wifi: mac80211: check S1G action frame size {CVE-2023-53257} {CVE-2023-53257}
• wifi: cfg80211: fix use-after-free in cmp_bss() {CVE-2025-39864} {CVE-2025-39864}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772} {CVE-2025-21772}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014} {CVE-2024-58014}
• wifi: at76c50x: fix use after free access in at76_disconnect {CVE-2025-37796} {CVE-2025-37796}
• dma-direct: Leak pages on dma_set_decrypted() failure {CVE-2024-35939} {CVE-2024-35939}
• Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386} {CVE-2022-50386}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817} {CVE-2025-39817}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937} {CVE-2024-35937}
• nfs: fix UAF in direct writes {CVE-2024-26958} {CVE-2024-26958}
• wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921} {CVE-2024-36921}
• net/smc: avoid data corruption caused by decline {CVE-2023-52775} {CVE-2023-52775}
• bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() {CVE-2024-39487} {CVE-2024-39487}
• scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978} {CVE-2024-40978}
• mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961} {CVE-2024-26961}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864} {CVE-2023-52864}
• net/sched: act_mirred: don't override retval if we already lost the skb {CVE-2024-26739} {CVE-2024-26739}
• drm/dp_mst: Fix resetting msg rx state after topology removal {CVE-2024-57876} {CVE-2024-57876}
• net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556} {CVE-2024-38556}
• of: Fix double free in of_parse_phandle_with_args_map {CVE-2023-52679} {CVE-2023-52679}
• xhci: Handle TD clearing for multiple streams case {CVE-2024-40927} {CVE-2024-40927}
• wifi: mac80211: fix potential key use-after-free {CVE-2023-52530} {CVE-2023-52530}
• net: openvswitch: Fix Use-After-Free in ovs_ct_exit {CVE-2024-27395} {CVE-2024-27395}
• r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586} {CVE-2024-38586}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764} {CVE-2023-52764}
• media: bttv: fix use after free error due to btv->timeout timer {CVE-2023-52847} {CVE-2023-52847}
• vsock: Fix transport_* TOCTOU {CVE-2025-38461} {CVE-2025-38461}
• ppdev: Add an error check in register_device {CVE-2024-36015} {CVE-2024-36015}
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556} {CVE-2025-38556}
• iio: adc: at91: call input_free_device() on allocated iio_dev {CVE-2024-57904} {CVE-2024-57904}
• perf/aux: Fix AUX buffer serialization {CVE-2024-46713} {CVE-2024-46713}
• net_sched: hfsc: Fix a UAF vulnerability in class handling {CVE-2025-37797} {CVE-2025-37797}
• wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072} {CVE-2024-58072}
• wifi: rtlwifi: remove unused dualmac control leftovers {CVE-2024-58072} {CVE-2024-58072}
• wifi: rtlwifi: remove unused timer and related code {CVE-2024-58072} {CVE-2024-58072}
• ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() {CVE-2025-22121} {CVE-2025-22121}
• ext4: move where set the MAY_INLINE_DATA flag is set {CVE-2025-22121} {CVE-2025-22121}
• ext4: introduce ITAIL helper {CVE-2025-22121} {CVE-2025-22121}
• ext4: improve xattr consistency checking and error reporting {CVE-2025-22121} {CVE-2025-22121}
• mm: fix zswap writeback race condition {CVE-2023-53178} {CVE-2023-53178}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-50367} {CVE-2022-50367}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757} {CVE-2025-39757}
• smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527} {CVE-2025-38527} -…

• media: bttv: fix use after free error due to btv->timeout timer {CVE-2023-52847} {CVE-2023-52847}
• firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails {CVE-2022-50087} {CVE-2022-50087}
• wifi: mwifiex: Fix OOB and integer underflow when rx packets {CVE-2023-53226} {CVE-2023-53226}
• vsock: Fix transport_* TOCTOU {CVE-2025-38461} {CVE-2025-38461}
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757} {CVE-2025-39757}
• locking/ww_mutex/test: Fix potential workqueue corruption {CVE-2023-52836} {CVE-2023-52836}
• media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621} {CVE-2024-38621}
• ath10k: skip ath10k_halt during suspend for driver state RESTARTING {CVE-2022-49519} {CVE-2022-49519}
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() {CVE-2022-48738} {CVE-2022-48738}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772} {CVE-2025-21772}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292} {CVE-2022-49292}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704} {CVE-2025-21704}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214} {CVE-2024-53214}
• ppdev: Add an error check in register_device {CVE-2024-36015} {CVE-2024-36015}
• scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675} {CVE-2023-53675}
• enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659} {CVE-2024-38659}
• dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929} {CVE-2024-57929}
• dlm: fix plock invalid read {CVE-2022-49407} {CVE-2022-49407}
• rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev {CVE-2022-48759} {CVE-2022-48759}
• bpf: Don't use tnum_range on array range checking for poke descriptors {CVE-2022-49985} {CVE-2022-49985}
• net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001} {CVE-2025-38001}
• wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes {CVE-2023-53185} {CVE-2023-53185}
• dm integrity: fix memory corruption when tag_size is less than digest size {CVE-2022-49044} {CVE-2022-49044}
• drm/radeon: possible buffer overflow {CVE-2023-52867} {CVE-2023-52867}
• ata: sata_dwc_460ex: Fix crash due to OOB write {CVE-2022-49073} {CVE-2022-49073}
• fs/jfs: Add validity check for db_maxag and db_agpref {CVE-2023-52804} {CVE-2023-52804}
• net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581} {CVE-2023-53581}
• thermal: core: prevent potential string overflow {CVE-2023-52868} {CVE-2023-52868}
• ACPI: CPPC: Avoid out of bounds access when parsing _CPC data {CVE-2022-49145} {CVE-2022-49145}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817} {CVE-2025-39817}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332} {CVE-2024-52332}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498} {CVE-2025-38498}
• drm/amd/display: Skip finding free audio for unknown engine_id {CVE-2024-42119} {CVE-2024-42119}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408} {CVE-2022-50408}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014} {CVE-2024-58014}
• wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229} {CVE-2023-53229}
• ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570} {CVE-2024-56570}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125} {CVE-2023-53125}
• net: stmmac: fix dma queue left shift overflow issue {CVE-2022-49592} {CVE-2022-49592}
• iio: adc: at91: call input_free_device() on allocated iio_dev {CVE-2024-57904} {CVE-2024-57904}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373} {CVE-2023-53373}
• sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718} {CVE-2025-38718}
• KVM: SVM: Don't BUG if userspace…

• media: bttv: fix use after free error due to btv->timeout timer {CVE-2023-52847}
• firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails {CVE-2022-50087}
• wifi: mwifiex: Fix OOB and integer underflow when rx packets {CVE-2023-53226}
• vsock: Fix transport_* TOCTOU {CVE-2025-38461}
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
• perf/aux: Fix AUX buffer serialization {CVE-2024-46713}
• locking/ww_mutex/test: Fix potential workqueue corruption {CVE-2023-52836}
• media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621}
• ath10k: skip ath10k_halt during suspend for driver state RESTARTING {CVE-2022-49519}
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() {CVE-2022-48738}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
• ppdev: Add an error check in register_device {CVE-2024-36015}
• scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
• enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659}
• dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929}
• dlm: fix plock invalid read {CVE-2022-49407}
• rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev {CVE-2022-48759}
• bpf: Don't use tnum_range on array range checking for poke descriptors {CVE-2022-49985}
• net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001}
• wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes {CVE-2023-53185}
• dm integrity: fix memory corruption when tag_size is less than digest size {CVE-2022-49044}
• drm/radeon: possible buffer overflow {CVE-2023-52867}
• ata: sata_dwc_460ex: Fix crash due to OOB write {CVE-2022-49073}
• fs/jfs: Add validity check for db_maxag and db_agpref {CVE-2023-52804}
• net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581}
• thermal: core: prevent potential string overflow {CVE-2023-52868}
• ACPI: CPPC: Avoid out of bounds access when parsing _CPC data {CVE-2022-49145}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
• drm/amd/display: Skip finding free audio for unknown engine_id {CVE-2024-42119}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229}
• ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
• net: stmmac: fix dma queue left shift overflow issue {CVE-2022-49592}
• iio: adc: at91: call input_free_device() on allocated iio_dev {CVE-2024-57904}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
• sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
• KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 {CVE-2022-50228}
• soundwire: cadence: fix invalid PDI offset {CVE-2024-38635}
• wifi: at76c50x: fix use after free access in at76_disconnect {CVE-2025-37796}
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans {CVE-2023-53034}
• Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297}
• scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
• smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527}
• NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730}
• scsi:…

• perf/aux: Fix AUX buffer serialization {CVE-2024-46713}
• block: fix uaf for flush rq while iterating tags {CVE-2024-53170}
• zram: fix potential UAF of zram table {CVE-2025-21671}
• sched: sch_cake: add bounds checks to host bulk flow fairness counts {CVE-2025-21647}
• bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors {CVE-2024-56675}
• net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• sctp: detect and prevent references to a freed transport in sendmsg {CVE-2025-23142}
• ipv6: sr: Fix MAC comparison to be constant-time {CVE-2025-39702}
• RDMA/rxe: Fix incomplete state save in rxe_requester {CVE-2023-53539}
• crypto: xts - Handle EBUSY correctly {CVE-2023-53494}
• Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync {CVE-2023-53252}
• af_unix: Fix data-races around user->unix_inflight. {CVE-2023-53204}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-50367}
• wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072}
• wifi: rtlwifi: remove unused dualmac control leftovers
• wifi: rtlwifi: remove unused timer and related code
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• ipmr: do not call mr_mfc_uses_dev() for unres entries {CVE-2025-21719}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• net: mdio: validate parameter addr in mdiobus_get_phy() {CVE-2023-53019}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
• NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730}
• net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581}
• null_blk: Always check queue mode setting from configfs {CVE-2023-53576}
• ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559}
• rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic() {CVE-2023-53558}
• pstore/ram: Check start of empty przs during init {CVE-2023-53331}
• wifi: ath11k: fix memory leak in WMI firmware stats {CVE-2023-53602}
• wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229}
• net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() {CVE-2022-50486}
• RDMA/core: Make sure "ib_port" is valid when access sysfs node {CVE-2022-50475}
• RDMA/rxe: Fix mr->map double free {CVE-2022-50543}
• scsi: qla2xxx: Fix end of loop test
• scsi: qla2xxx: Fix mem access after free
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• scsi: target: Fix multiple LUN_RESET handling {CVE-2023-53586}
• scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
• scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses {CVE-2023-53675}
• scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() {CVE-2023-53675}
• scsi: lpfc: Fix buffer free/clear order in deferred receive path {CVE-2025-39841}
• nbd: fix incomplete validation of ioctl arg {CVE-2023-53513}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
• bnxt: avoid overflow in bnxt_get_nvram_directory() {CVE-2023-53661}

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and leads to crashes(e.g., UAF/GPF). Fix this by moving security_inode_alloc just prior to this_cpu_inc(nr_inodes)

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50248: wifi: iwlwifi: mvm: fix double free on tx path (bsc#1249840).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947).
• CVE-2022-50381: md: fix a crash in mempool_free (bsc#1250257).
• CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
• CVE-2022-50401: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (bsc#1250140).
• CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).

The following non-security bugs were fixed:

• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes).
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
• kernel-syms.spec: Drop old rpm release number hack (bsc#1247172).
• rpm/kernel-subpackage-spec: Skip brp-strip-debug to avoid file truncation (bsc#1246879)
• rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337)
• rpm: Configure KABI checkingness macro (bsc#1249186)
• rpm: Drop support for kabi/arch/ignore-flavor (bsc#1249186)
• rpm: Link arch-symbols script from scripts directory.
• rpm: Link guards script from scripts directory.
• use uniform permission checks for all mount propagation changes (git-fixes).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• !CONFIG & reference -> this is bug, immediate fail
• CONFIG & no reference -> OK temporarily, must be resolved eventually
• Do not self obsolete older kernel variants
• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Update config files. (bsc#1249186) Enable where we define KABI refs + rely on Kconfig deps.
• build_bug.h: Add KABI assert (bsc#1249186).
• hv_netvsc: Fix panic during namespace deletion with VF (bsc#1248111).
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
• kernel-syms.spec: Drop…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50248: wifi: iwlwifi: mvm: fix double free on tx path (bsc#1249840).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947).
• CVE-2022-50381: md: fix a crash in mempool_free (bsc#1250257).
• CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
• CVE-2022-50401: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (bsc#1250140).
• CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2022-50412: drm: bridge: adv7511: unregister cec i2c device after cec adapter (bsc#1250189).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53220: media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (bsc#1250337).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2024-53093: nvme-multipath: defer partition scanning (bsc#1233640).
• CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
• CVE-2025-38011: drm/amdgpu: csa unmap use uninterruptible lock (bsc#1244729).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).

The following non-security bugs were fixed:

• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• git_sort: Make tests independent of environment.
• hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes).
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346).
• kernel-syms.spec: Drop old rpm release number hack (bsc#1247172).
• rpm/kernel-subpackage-spec: Skip brp-strip-debug to avoid file truncation (bsc#1246879).
• rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337).
• rpm: Configure KABI checkingness macro (bsc#1249186).
• rpm: Drop support for kabi/arch/ignore-flavor (bsc#1249186).
• scripts/python/kss-dashboard: attempt getting smash data
• scripts/python/kss-dashboard: fetch into repos if stale
• scripts/python/kss-dashboard: implement CVSSv3.1 score consistency check
• scripts/python/kss-dashboard: prepare for the alternative CVE branch
• scripts/python/kss-dashboard: simplify control flow
• scripts/python/kss-dashboard: speed up patch checking a bit
• scripts/python/kss-dashboard: use…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (bsc#1247288).
• CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (bsc#1247288).
• CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Revert backported patches for bsc#1238160.
• btrfs: avoid NULL pointer dereference if…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Revert selinux patches that caused regressions (bsc#1249353).
• btrfs: avoid NULL pointer dereference if no valid extent tree (bsc#1249158).
• build_bug.h: Add KABI assert (bsc#1249186).
• hv_netvsc: Fix panic during namespace deletion with VF (bsc#1248111).
• kabi/severities: ignore kABI for atheros helper modules The symbols are used only internally by atheros drivers.
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
• kernel-syms.spec: Drop…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2021-4460: drm/amdkfd: Fix UBSAN shift-out-of-bounds warning (bsc#1250764).
• CVE-2022-48631: ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 (bsc#1223475).
• CVE-2022-50236: iommu/mediatek: Fix crash on isr after kexec() (bsc#1249702).
• CVE-2022-50249: memory: of: Fix refcount leak bug in of_get_ddr_timings() (bsc#1249747).
• CVE-2022-50280: pnode: terminate at peers of source (bsc#1249806).
• CVE-2022-50293: btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range (bsc#1249752).
• CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
• CVE-2022-50350: scsi: target: iscsi: Fix a race condition between login_work and the login thread (bsc#1250261).
• CVE-2022-50356: net: sched: sfb: fix null pointer access issue when sfb_init() fails (bsc#1250040).
• CVE-2022-50367: fs: fix UAF/GPF bug in nilfs_mdt_destroy (bsc#1250277).
• CVE-2022-50394: i2c: ismt: Fix an out-of-bounds bug in ismt_access() (bsc#1250107).
• CVE-2022-50395: integrity: Fix memory leakage in keyring allocation error path (bsc#1250211).
• CVE-2022-50423: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (bsc#1250784).
• CVE-2022-50443: drm/rockchip: lvds: fix PM usage counter unbalance in poweron (bsc#1250768).
• CVE-2022-50459: scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() (bsc#1250850).
• CVE-2022-50481: cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() (bsc#1251051).
• CVE-2022-50485: ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode (bsc#1251197).
• CVE-2022-50505: iommu/amd: Fix pci device refcount leak in ppr_notifier() (bsc#1251086).
• CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
• CVE-2022-50542: media: si470x: Fix use-after-free in si470x_int_in_callback() (bsc#1251330).
• CVE-2022-50571: btrfs: call __btrfs_remove_free_space_cache_locked on cache load failure (bsc#1252487).
• CVE-2023-53183: btrfs: exit gracefully if reloc roots don't match (bsc#1249863).
• CVE-2023-53185: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (bsc#1249820).
• CVE-2023-53188: net: openvswitch: fix race on port output (bsc#1249854).
• CVE-2023-53191: irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains (bsc#1249721).
• CVE-2023-53204: af_unix: Fix data-races around user->unix_inflight (bsc#1249682).
• CVE-2023-53271: ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (bsc#1249916).
• CVE-2023-53282: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write (bsc#1250311).
• CVE-2023-53289: media: bdisp: Add missing check for create_workqueue (bsc#1249941).
• CVE-2023-53292: blk-mq: protect q->elevator by ->sysfs_lock in blk_mq_elv_switch_none (bsc#1250163).
• CVE-2023-53338: lwt: Fix return values of BPF xmit ops (bsc#1250074).
• CVE-2023-53339: btrfs: fix BUG_ON condition in btrfs_cancel_balance (bsc#1250329).
• CVE-2023-53373: crypto: seqiv - Handle EBUSY correctly (bsc#1250137).
• CVE-2023-53433: net: add vlan_get_protocol_and_depth() helper (bsc#1250164).
• CVE-2023-53476: iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() (bsc#1250839).
• CVE-2023-53477: ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (bsc#1250840).
• CVE-2023-53484: lib: cpu_rmap: Avoid use after free on rmap->obj array entries (bsc#1250895).
• CVE-2023-53517: tipc: do not update mtu if msg_max is too small in mtu negotiation (bsc#1250919).
• CVE-2023-53519: media: v4l2-mem2mem: add lock to protect parameter num_rdy (bsc#1250964).
• CVE-2023-53540: wifi: cfg80211: reject auth/assoc to AP with our address (bsc#1251053).
• CVE-2023-53548: net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (bsc#1251066).
• CVE-2023-53556: iavf: Fix use-after-free in free_netdev (bsc#1251059). -…

This update for the SUSE Linux Enterprise kernel 4.12.14-122.237 fixes various security issues

The following security issues were fixed:

• CVE-2022-50233: bluetooth: device name can cause reading kernel memory by not supplying terminal \0 (bsc#1249242).
• CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1254451).
• CVE-2022-50367: fs: fix UAF/GPF bug in nilfs_mdt_destroy (bsc#1250280).
• CVE-2022-50409: net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory (bsc#1250665).
• CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251787).
• CVE-2023-53717: wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() (bsc#1252563).
• CVE-2024-57849: s390/cpum_sf: handle CPU hotplug remove during sampling (bsc#1235815).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248400).
• CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253437).

This update for the SUSE Linux Enterprise kernel 4.12.14-122.272 fixes various security issues

The following security issues were fixed:

• CVE-2022-50233: bluetooth: device name can cause reading kernel memory by not supplying terminal \0 (bsc#1249242).
• CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1254451).
• CVE-2022-50367: fs: fix UAF/GPF bug in nilfs_mdt_destroy (bsc#1250280).
• CVE-2022-50409: net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory (bsc#1250665).
• CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251787).
• CVE-2023-53717: wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() (bsc#1252563).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248400).
• CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253437).

This update for the SUSE Linux Enterprise kernel 4.12.14-122.275 fixes various security issues

The following security issues were fixed:

• CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1254451).
• CVE-2022-50367: fs: fix UAF/GPF bug in nilfs_mdt_destroy (bsc#1250280).
• CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251787).
• CVE-2023-53717: wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() (bsc#1252563).
• CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253437).