CVE-2022-50409

net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory

Fixes the below NULL pointer dereference:

[...] [ 14.471200] Call Trace: [ 14.471562] <TASK> [ 14.471882] lock_acquire+0x245/0x2e0 [ 14.472416] ? remove_wait_queue+0x12/0x50 [ 14.473014] ? _raw_spin_lock_irqsave+0x17/0x50 [ 14.473681] _raw_spin_lock_irqsave+0x3d/0x50 [ 14.474318] ? remove_wait_queue+0x12/0x50 [ 14.474907] remove_wait_queue+0x12/0x50 [ 14.475480] sk_stream_wait_memory+0x20d/0x340 [ 14.476127] ? do_wait_intr_irq+0x80/0x80 [ 14.476704] do_tcp_sendpages+0x287/0x600 [ 14.477283] tcp_bpf_push+0xab/0x260 [ 14.477817] tcp_bpf_sendmsg_redir+0x297/0x500 [ 14.478461] ? __local_bh_enable_ip+0x77/0xe0 [ 14.479096] tcp_bpf_send_verdict+0x105/0x470 [ 14.479729] tcp_bpf_sendmsg+0x318/0x4f0 [ 14.480311] sock_sendmsg+0x2d/0x40 [ 14.480822] ____sys_sendmsg+0x1b4/0x1c0 [ 14.481390] ? copy_msghdr_from_user+0x62/0x80 [ 14.482048] ___sys_sendmsg+0x78/0xb0 [ 14.482580] ? vmf_insert_pfn_prot+0x91/0x150 [ 14.483215] ? __do_fault+0x2a/0x1a0 [ 14.483738] ? do_fault+0x15e/0x5d0 [ 14.484246] ? __handle_mm_fault+0x56b/0x1040 [ 14.484874] ? lock_is_held_type+0xdf/0x130 [ 14.485474] ? find_held_lock+0x2d/0x90 [ 14.486046] ? __sys_sendmsg+0x41/0x70 [ 14.486587] __sys_sendmsg+0x41/0x70 [ 14.487105] ? intel_pmu_drain_pebs_core+0x350/0x350 [ 14.487822] do_syscall_64+0x34/0x80 [ 14.488345] entry_SYSCALL_64_after_hwframe+0x63/0xcd [...]

The test scenario has the following flow:

thread1 thread2

tcp_bpf_sendmsg tcp_bpf_send_verdict tcp_bpf_sendmsg_redir sock_close tcp_bpf_push_locked __sock_release tcp_bpf_push //inet_release do_tcp_sendpages sock->ops->release sk_stream_wait_memory // tcp_close sk_wait_event sk->sk_prot->close release_sock(__sk); *** lock_sock(sk); __tcp_close sock_orphan(sk) sk->sk_wq = NULL release_sock **** lock_sock(__sk); remove_wait_queue(sk_sleep(sk), &wait); sk_sleep(sk) //NULL pointer dereference &rcu_dereference_raw(sk->sk_wq)->wait

While waiting for memory in thread1, the socket is released with its wait queue because thread2 has closed it. This caused by tcp_bpf_send_verdict didn't increase the f_count of psock->sk_redir->sk_socket->file in thread1.

We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory before accessing the wait queue.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.16%Up 0.1 points since Sep 19, 2025

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory

Fixes the below NULL pointer dereference:

The test scenario has the following flow:

thread1 thread2

We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory before accessing the wait queue.

Record: CVE-2022-50409
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-05

CVE List No score

net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory

In the Linux kernel, the following vulnerability has been resolved:

net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory

Fixes the below NULL pointer dereference:

The test scenario has the following flow:

thread1 thread2

We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory before accessing the wait queue.

Record: CVE-2022-50409
Updated: 2026-11-05

EUVDEUVD-2025-29886 No score

In the Linux kernel, the following vulnerability has been resolved:

net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory

Fixes the below NULL pointer dereference:

The test scenario has the following flow:

thread1 thread2

We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory before accessing the wait queue.

Record: EUVD-2025-29886
Updated: 2026-11-05

GitHub AdvisoriesGHSA-jv66-mppc-fxjf 5.5

In the Linux kernel, the following vulnerability has been resolved: net: If sock is dead don't...

In the Linux kernel, the following vulnerability has been resolved:

net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory

Fixes the below NULL pointer dereference:

The test scenario has the following flow:

thread1 thread2

We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory before accessing the wait queue.

Record: GHSA-jv66-mppc-fxjf
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-50409 5.5

In the Linux kernel, the following vulnerability has been resolved: net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory Fixes the below NULL pointer dereference: [...] [ 14.471200] Call Trace: [ 14.471562] <TASK> [ 14.471882] lock_acquire+0x245/0x2e0 [ 14.472416] ? remove_wait_queue+0x12/0x50 [ 14.473014] ? _raw_spin_lock_irqsave+0x17/0x50 [ 14.473681] _raw_spin_lock_irqsave+0x3d/0x50 [ 14.474318] ? remove_wait_queue+0x12/0x50 [ 14.474907] remove_wait_queue+0x12/0x50 [ 14.475480] sk_stream_wait_memory+0x20d/0x340 [ 14.476127] ? do_wait_intr_irq+0x80/0x80 [ 14.476704] do_tcp_sendpages+0x287/0x600 [ 14.477283] tcp_bpf_push+0xab/0x260 [ 14.477817] tcp_bpf_sendmsg_redir+0x297/0x500 [ 14.478461] ? __local_bh_enable_ip+0x77/0xe0 [ 14.479096] tcp_bpf_send_verdict+0x105/0x470 [ 14.479729] tcp_bpf_sendmsg+0x318/0x4f0 [ 14.480311] sock_sendmsg+0x2d/0x40 [ 14.480822] ____sys_sendmsg+0x1b4/0x1c0 [ 14.481390] ? copy_msghdr_from_user+0x62/0x80 [ 14.482048] ___sys_sendmsg+0x78/0xb0 [ 14.482580] ? vmf_insert_pfn_prot+0x91/0x150 [ 14.483215] ? __do_fault+0x2a/0x1a0 [ 14.483738] ? do_fault+0x15e/0x5d0 [ 14.484246] ? __handle_mm_fault+0x56b/0x1040 [ 14.484874] ? lock_is_held_type+0xdf/0x130 [ 14.485474] ? find_held_lock+0x2d/0x90 [ 14.486046] ? __sys_sendmsg+0x41/0x70 [ 14.486587] __sys_sendmsg+0x41/0x70 [ 14.487105] ? intel_pmu_drain_pebs_core+0x350/0x350 [ 14.487822] do_syscall_64+0x34/0x80 [ 14.488345] entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] The test scenario has the following flow: thread1 thread2 ----------- --------------- tcp_bpf_sendmsg tcp_bpf_send_verdict tcp_bpf_sendmsg_redir sock_close tcp_bpf_push_locked __sock_release tcp_bpf_push //inet_release do_tcp_sendpages sock->ops->release sk_stream_wait_memory // tcp_close sk_wait_event sk->sk_prot->close release_sock(__sk); *** lock_sock(sk); __tcp_close sock_orphan(sk) sk->sk_wq = NULL release_sock **** lock_sock(__sk); remove_wait_queue(sk_sleep(sk), &wait); sk_sleep(sk) //NULL pointer dereference &rcu_dereference_raw(sk->sk_wq)->wait While waiting for memory in thread1, the socket is released with its wait queue because thread2 has closed it. This caused by tcp_bpf_send_verdict didn't increase the f_count of psock->sk_redir->sk_socket->file in thread1. We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory before accessing the wait queue.

Record: DEBIAN-CVE-2022-50409
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2022-50409 5.5

Record: UBUNTU-CVE-2022-50409
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

Show 25 moreShow less

OSVCLSA-2026-1778266904 No score

kernel: Fix of 189 CVEs

rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
xfrm: esp: avoid in-place decrypt on shared skb frags
clk: Fix clk_hw_get_clk() when dev is NULL {CVE-2022-49187}
x86/sgx: Add overflow check in sgx_validate_offset_length() {CVE-2022-49785}
ext4: init quota for 'old.inode' in 'ext4_rename' {CVE-2022-50346}
skbuff: Account for tail adjustment during pull operations {CVE-2022-50365}
net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory {CVE-2022-50409}
scsi: qla2xxx: Delay module unload while fabric scan in progress {CVE-2025-71235}
HID: alps: fix NULL pointer dereference in alps_raw_event() {CVE-2026-31625}
rxrpc: fix reference count leak in rxrpc_server_keyring() {CVE-2026-31634}
drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540}
ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects {CVE-2023-54010}
drm/amdgpu: fix the waring dereferencing hive {CVE-2024-46805}
drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func {CVE-2024-49911}
tracing: Prevent bad count for tracing_cpumask_write {CVE-2024-56763}
HID: wacom: fix when get product name maybe null pointer {CVE-2024-56629}
thermal: int340x: Add NULL check for adev {CVE-2025-23136}
wifi: mac80211: Purge vif txq in ieee80211_do_stop() {CVE-2025-37794}
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510}
wifi: cfg80211: ocb: don't leave if not joined {CVE-2023-53992}
mmc: core: Fix kernel panic when remove non-standard SDIO card {CVE-2022-50640}
EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() {CVE-2022-50645}
serial: amba-pl011: avoid SBSA UART accessing DMACR register {CVE-2022-50625}
inet_diag: Initialize pad field in struct inet_diag_req_v2 {CVE-2024-42106}
regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt {CVE-2022-49481}
net/core: Fix ETH_P_1588 flow dissector {CVE-2023-52580}
mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() {CVE-2023-52560}
af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg {CVE-2024-38596}
drm/amd/display: Implement bounds check for stream encoder creation in DCN301 {CVE-2024-26660}
block: prevent division by zero in blk_rq_stat_sum() {CVE-2024-35925}
netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286}
tipc: fix a possible memleak in tipc_buf_append {CVE-2024-36954}
ipv6: prevent possible NULL deref in fib6_nh_init() {CVE-2024-40961}
pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER {CVE-2024-42090}
ipv6: prevent possible NULL dereference in rt6_probe() {CVE-2024-40960}
drm/radeon: check bo_va->bo is non-NULL before using it {CVE-2024-41060}
dma: fix call order in dmam_free_coherent {CVE-2024-43856}
scsi: qla2xxx: Fix for possible memory corruption {CVE-2024-42288}
ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt {CVE-2024-26774}
netfilter: flowtable: incorrect pppoe tuple {CVE-2024-27015}
bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() {CVE-2024-40919}
Bluetooth: btintel: Fix null ptr deref in btintel_read_version {CVE-2024-35933}
netdevsim: prevent bad user input in nsim_dev_health_break_write() {CVE-2024-56716}
net/mlx5e: CT: Fix null-ptr-deref in add rule err flow {CVE-2024-53120}
EDAC/bluefield: Fix potential integer overflow {CVE-2024-53161}
NFSD: Prevent NULL dereference in nfsd4_process_cb_update() {CVE-2024-53217}
ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() {CVE-2024-50304}
blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race {CVE-2024-50082}
drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() {CVE-2025-21996}
HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
filemap: Fix bounds checking in filemap_read()…

Record: CLSA-2026-1778266904
Updated: 2026-11-02

OSV No score

net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory

In the Linux kernel, the following vulnerability has been resolved:

net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory

Fixes the below NULL pointer dereference:

The test scenario has the following flow:

thread1 thread2

We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory before accessing the wait queue.

Record: CVE-2022-50409
Updated: 2026-11-07

OSVSUSE-SU-2025:03613-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
CVE-2022-50248: wifi: iwlwifi: mvm: fix double free on tx path (bsc#1249840).
CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947).
CVE-2022-50381: md: fix a crash in mempool_free (bsc#1250257).
CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
CVE-2022-50401: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (bsc#1250140).
CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).

The following non-security bugs were fixed:

Limit patch filenames to 100 characters (bsc#1249604).
Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes).
kernel-binary: Another installation ordering fix (bsc#1241353).
kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
kernel-syms.spec: Drop old rpm release number hack (bsc#1247172).
rpm/kernel-subpackage-spec: Skip brp-strip-debug to avoid file truncation (bsc#1246879)
rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337)
rpm: Configure KABI checkingness macro (bsc#1249186)
rpm: Drop support for kabi/arch/ignore-flavor (bsc#1249186)
rpm: Link arch-symbols script from scripts directory.
rpm: Link guards script from scripts directory.
use uniform permission checks for all mount propagation changes (git-fixes).

Record: SUSE-SU-2025:03613-1
Updated: 2026-11-02

OSVSUSE-SU-2025:03614-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
CVE-2022-50242: drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() (bsc#1249696).
CVE-2022-50244: cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() (bsc#1249647).
CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947).
CVE-2022-50265: kcm: annotate data-races around kcm->rx_wait (bsc#1249744).
CVE-2022-50278: PNP: fix name memory leak in pnp_alloc_dev() (bsc#1249715).
CVE-2022-50285: mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages (bsc#1249803).
CVE-2022-50288: qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure (bsc#1249802).
CVE-2022-50291: kcm: annotate data-races around kcm->rx_psock (bsc#1249798).
CVE-2022-50294: wifi: libertas: fix memory leak in lbs_init_adapter() (bsc#1249799).
CVE-2022-50297: wifi: ath9k: verify the expected usb_endpoints are present (bsc#1250250).
CVE-2022-50304: mm: export bdi_unregister (bsc#1249725).
CVE-2022-50311: cxl: Fix refcount leak in cxl_calc_capp_routing (bsc#1249720).
CVE-2022-50312: drivers: serial: jsm: fix some leaks in probe (bsc#1249716).
CVE-2022-50321: wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (bsc#1249706).
CVE-2022-50330: crypto: cavium - prevent integer overflow loading firmware (bsc#1249700).
CVE-2022-50349: misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (bsc#1249920).
CVE-2022-50352: net: hns: fix possible memory leak in hnae_ae_register() (bsc#1249922).
CVE-2022-50359: media: cx88: Fix a null-ptr-deref bug in buffer_prepare() (bsc#1250269).
CVE-2022-50365: skbuff: Account for tail adjustment during pull operations (bsc#1250084).
CVE-2022-50375: tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown (bsc#1250132).
CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
CVE-2022-50396: net: sched: fix memory leak in tcindex_set_parms (bsc#1250104).
CVE-2022-50402: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() (bsc#1250363).
CVE-2022-50405: net/tunnel: wait until all sk_user_data reader finish before releasing the sock (bsc#1250155).
CVE-2022-50406: iomap: iomap: fix memory corruption when recording errors during writeback (bsc#1250165).
CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
CVE-2022-50419: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times (bsc#1250394).
CVE-2023-53148: igb: Do not bring the device up after non-fatal error (bsc#1249842).
CVE-2023-53153: wifi: cfg80211: Partial revert 'wifi: cfg80211: Fix use after free for wext' (bsc#1249877).
CVE-2023-53176: serial: 8250: Fix oops for port->pm on uart_change_pm() (bsc#1249991).
CVE-2023-53178: mm: zswap: fix missing folio cleanup in writeback race path (bsc#1249827 git-fix).
CVE-2023-53199: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails (bsc#1249683).
CVE-2023-53201: RDMA/bnxt_re: wraparound mbox producer index (bsc#1249687).
CVE-2023-53226: wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (bsc#1249658).
CVE-2023-53248: drm/amdgpu: install stub fence into potential unused fence pointers (bsc#1249779).
CVE-2023-53254: drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug (bsc#1249871).
CVE-2023-53272: net: ena: fix shift-out-of-bounds in exponential backoff (bsc#1249917).
CVE-2023-53277: wifi: iwl3945: Add missing check for create_singlethread_workqueue…

Record: SUSE-SU-2025:03614-1
Updated: 2026-11-02

OSVSUSE-SU-2025:03615-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

!CONFIG & reference -> this is bug, immediate fail
CONFIG & no reference -> OK temporarily, must be resolved eventually
Do not self obsolete older kernel variants
Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
Limit patch filenames to 100 characters (bsc#1249604).
Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
Update config files. (bsc#1249186) Enable where we define KABI refs + rely on Kconfig deps.
build_bug.h: Add KABI assert (bsc#1249186).
hv_netvsc: Fix panic during namespace deletion with VF (bsc#1248111).
kernel-binary: Another installation ordering fix (bsc#1241353).
kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
kernel-syms.spec: Drop…

Record: SUSE-SU-2025:03615-1
Updated: 2026-11-02

OSVSUSE-SU-2025:03626-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
CVE-2022-50248: wifi: iwlwifi: mvm: fix double free on tx path (bsc#1249840).
CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947).
CVE-2022-50381: md: fix a crash in mempool_free (bsc#1250257).
CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
CVE-2022-50401: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (bsc#1250140).
CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
CVE-2022-50412: drm: bridge: adv7511: unregister cec i2c device after cec adapter (bsc#1250189).
CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
CVE-2023-53220: media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (bsc#1250337).
CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
CVE-2024-53093: nvme-multipath: defer partition scanning (bsc#1233640).
CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
CVE-2025-38011: drm/amdgpu: csa unmap use uninterruptible lock (bsc#1244729).
CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).

The following non-security bugs were fixed:

Limit patch filenames to 100 characters (bsc#1249604).
Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
git_sort: Make tests independent of environment.
hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes).
kernel-binary: Another installation ordering fix (bsc#1241353).
kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346).
kernel-syms.spec: Drop old rpm release number hack (bsc#1247172).
rpm/kernel-subpackage-spec: Skip brp-strip-debug to avoid file truncation (bsc#1246879).
rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337).
rpm: Configure KABI checkingness macro (bsc#1249186).
rpm: Drop support for kabi/arch/ignore-flavor (bsc#1249186).
scripts/python/kss-dashboard: attempt getting smash data
scripts/python/kss-dashboard: fetch into repos if stale
scripts/python/kss-dashboard: implement CVSSv3.1 score consistency check
scripts/python/kss-dashboard: prepare for the alternative CVE branch
scripts/python/kss-dashboard: simplify control flow
scripts/python/kss-dashboard: speed up patch checking a bit
scripts/python/kss-dashboard: use…

Record: SUSE-SU-2025:03626-1
Updated: 2026-11-02

OSVSUSE-SU-2025:03628-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (bsc#1247288).
CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

Limit patch filenames to 100 characters (bsc#1249604).
Move pesign-obs-integration requirement from kernel-syms to…

Record: SUSE-SU-2025:03628-1
Updated: 2026-11-02

OSVSUSE-SU-2025:3716-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (bsc#1247288).
CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
Limit patch filenames to 100 characters (bsc#1249604).
Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
Revert backported patches for bsc#1238160.
btrfs: avoid NULL pointer dereference if…

Record: SUSE-SU-2025:3716-1
Updated: 2026-11-02

OSVSUSE-SU-2025:3761-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
Limit patch filenames to 100 characters (bsc#1249604).
Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
Revert selinux patches that caused regressions (bsc#1249353).
btrfs: avoid NULL pointer dereference if no valid extent tree (bsc#1249158).
build_bug.h: Add KABI assert (bsc#1249186).
hv_netvsc: Fix panic during namespace deletion with VF (bsc#1248111).
kabi/severities: ignore kABI for atheros helper modules The symbols are used only internally by atheros drivers.
kernel-binary: Another installation ordering fix (bsc#1241353).
kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
kernel-syms.spec: Drop…

Record: SUSE-SU-2025:3761-1
Updated: 2026-11-02

OSVSUSE-SU-2025:4315-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues