CVE-2022-50410

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Protect against send buffer overflow in NFSv2 READ

Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same time.

Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large.

A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full maximum payload size cannot be constructed in that case.(CVE-2022-50410)

In the Linux kernel, the following vulnerability has been resolved:

media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()

In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach az6007_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash.

Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")(CVE-2023-53220)

In the Linux kernel, the following vulnerability has been resolved:

kobject: Add sanity check for kset->kobj.ktype in kset_register()

When I register a kset in the following way: static struct kset my_kset; kobject_set_name(&my_kset.kobj, "my_kset"); ret = kset_register(&my_kset);

A null pointer dereference exception is occurred: [ 4453.568337] Unable to handle kernel NULL pointer dereference at
virtual address 0000000000000028 ... ... [ 4453.810361] Call trace: [ 4453.813062] kobject_get_ownership+0xc/0x34 [ 4453.817493] kobject_add_internal+0x98/0x274 [ 4453.822005] kset_register+0x5c/0xb4 [ 4453.825820] my_kobj_init+0x44/0x1000 [my_kset] ... ...

Because I didn't initialize my_kset.kobj.ktype.

According to the description in Documentation/core-api/kobject.rst:

• A ktype is the type of object that embeds a kobject. Every structure that embeds a kobject needs a corresponding ktype.

So add sanity check to make sure kset->kobj.ktype is not NULL.(CVE-2023-53480)

In the Linux kernel, the following vulnerability has been resolved:

virtio-mmio: don't break lifecycle of vm_dev

vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct.

Allocating the vm_dev struct with devres totally breaks this protection, though. Instead of waiting for the vm_dev release callback, the memory is freed when the platform_device is removed. Resulting in a use-after-free when finally the callback is to be called.

To easily see the problem, compile the kernel with CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs.

The fix is easy, don't use devres in this case.

Found during my research about object lifetime problems.(CVE-2023-53515)

In the Linux kernel, the following vulnerability has been resolved:

net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb

The syzbot fuzzer identified a problem in the usbnet driver:

usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 754 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 754 Comm: kworker/0:2 Not tainted 6.4.0-rc7-syzkaller-00014-g692b7dc87ca6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Workqueue: mld mld_ifc_work RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 2c b4 5b…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Protect against send buffer overflow in NFSv2 READ

Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same time.

Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large.

A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full maximum payload size cannot be constructed in that case.(CVE-2022-50410)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Limit access to parser->buffer when trace_get_user failed

When the length of the string written to set_ftrace_filter exceeds FTRACE_BUFF_MAX, the following KASAN alarm will be triggered:

BUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0 Read of size 1 at addr ffff0000d00bd5ba by task ash/165

CPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x34/0x50 (C) dump_stack_lvl+0xa0/0x158 print_address_description.constprop.0+0x88/0x398 print_report+0xb0/0x280 kasan_report+0xa4/0xf0 __asan_report_load1_noabort+0x20/0x30 strsep+0x18c/0x1b0 ftrace_process_regex.isra.0+0x100/0x2d8 ftrace_regex_release+0x484/0x618 __fput+0x364/0xa58 ____fput+0x28/0x40 task_work_run+0x154/0x278 do_notify_resume+0x1f0/0x220 el0_svc+0xec/0xf0 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1ac/0x1b0

The reason is that trace_get_user will fail when processing a string longer than FTRACE_BUFF_MAX, but not set the end of parser->buffer to 0. Then an OOB access will be triggered in ftrace_regex_release-> ftrace_process_regex->strsep->strpbrk. We can solve this problem by limiting access to parser->buffer when trace_get_user failed.(CVE-2025-39683)

In the Linux kernel, the following vulnerability has been resolved:

vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects

When the "proxy" option is enabled on a VXLAN device, the device will suppress ARP requests and IPv6 Neighbor Solicitation messages if it is able to reply on behalf of the remote host. That is, if a matching and valid neighbor entry is configured on the VXLAN device whose MAC address is not behind the "any" remote (0.0.0.0 / ::).

The code currently assumes that the FDB entry for the neighbor's MAC address points to a valid remote destination, but this is incorrect if the entry is associated with an FDB nexthop group. This can result in a NPD [1][3] which can be reproduced using [2][4].

Fix by checking that the remote destination exists before dereferencing it.

[1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 4 UID: 0 PID: 365 Comm: arping Not tainted 6.17.0-rc2-virtme-g2a89cb21162c #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:vxlan_xmit+0xb58/0x15f0 [...] Call Trace: <TASK> dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 packet_sendmsg+0x113a/0x1850 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53

[2] #!/bin/bash

ip address add 192.0.2.1/32 dev lo

ip nexthop add id 1 via 192.0.2.2 fdb ip nexthop add id 10 group 1 fdb

ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 4789 proxy

ip neigh add 192.0.2.3 lladdr 00:11:22:33:44:55 nud perm dev vx0

…

In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same time. Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large. A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full maximum payload size cannot be constructed in that case.

• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
• drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
• Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
• net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2022-50410}
• i40e: add validation for ring_len param {CVE-2025-39973}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}

• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
• drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
• Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
• net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2022-50410}
• i40e: add validation for ring_len param {CVE-2025-39973}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}

• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
• drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
• Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
• net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2022-50410}
• i40e: add validation for ring_len param {CVE-2025-39973}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}

• crypto: algif_aead - Fix minimum RX size check for decryption
• crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
• crypto: authencesn - Fix src offset when decrypting in-place
• crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
• crypto: authenc - use memcpy_sglist() instead of null skcipher
• crypto: algif_aead - snapshot IV for async AEAD requests
• crypto: algif_aead - Revert to operating out-of-place
• crypto: algif_aead - use memcpy_sglist() instead of null skcipher
• crypto: scatterwalk - Backport memcpy_sglist()
• crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
• asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
• net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204}
• net: add skb_header_pointer_careful() helper
• ext4: lost matching-pair of trace in ext4_truncate
• usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
• net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2022-50410}
• perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
• fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• Bluetooth: hci_sock: Prevent race in socket write iter and sock bind {CVE-2025-68305}
• VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
• net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class

• CVE-2026-46113
  • KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113}
• CVE-2022-50300
  • btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300}
• CVE-2022-50082
  • ext4: fix warning in ext4_iomap_begin as race between bmap and write {CVE-2022-50082}
• CVE-2026-43052
  • wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• CVE-2026-43386
  • staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie {CVE-2026-43386}
• CVE-2026-23281
  • wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281}
• CVE-2026-43141
  • ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut {CVE-2026-43141}
• CVE-2026-23209
  • macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• CVE-2026-23001
  • macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001}
• CVE-2026-31532
  • can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}
• CVE-2026-31688
  • driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• CVE-2023-53680
  • NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
• CVE-2025-38718
  • sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
• CVE-2025-38102
  • VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• CVE-2024-42120
  • drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120}
• CVE-2022-50093
  • iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• CVE-2022-50410
  • NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-50410}
• CVE-2026-23234
  • f2fs: fix to avoid UAF in f2fs_write_end_io() {CVE-2026-23234}
• CVE-2026-43203
  • atm: fore200e: fix use-after-free in tasklets during device removal {CVE-2026-43203}
• CVE-2026-43373
  • net: ncsi: fix skb leak in error paths {CVE-2026-43373}
• CVE-2026-43450
  • netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• CVE-2026-31399
  • nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• CVE-2026-43449
  • nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449}
• CVE-2026-43427
  • usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• CVE-2026-31452
  • ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• CVE-2026-23397
  • nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• CVE-2025-71082
  • Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• CVE-2025-39955
  • tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-39955}
• CVE-2022-49770
  • ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
• CVE-2026-43283
  • net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle {CVE-2026-43283}
• Bump ABI 4.15.0-261

• CVE-2026-46113
  • KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113}
• CVE-2022-50300
  • btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300}
• CVE-2022-50082
  • ext4: fix warning in ext4_iomap_begin as race between bmap and write {CVE-2022-50082}
• CVE-2026-43052
  • wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• CVE-2026-43386
  • staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie {CVE-2026-43386}
• CVE-2026-23281
  • wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281}
• CVE-2026-43141
  • ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut {CVE-2026-43141}
• CVE-2026-23209
  • macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• CVE-2026-23001
  • macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001}
• CVE-2026-31532
  • can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}
• CVE-2026-31688
  • driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• CVE-2023-53680
  • NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
• CVE-2025-38718
  • sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
• CVE-2025-38102
  • VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• CVE-2024-42120
  • drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120}
• CVE-2022-50093
  • iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• CVE-2022-50410
  • NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-50410}
• CVE-2026-23234
  • f2fs: fix to avoid UAF in f2fs_write_end_io() {CVE-2026-23234}
• CVE-2026-43203
  • atm: fore200e: fix use-after-free in tasklets during device removal {CVE-2026-43203}
• CVE-2026-43373
  • net: ncsi: fix skb leak in error paths {CVE-2026-43373}
• CVE-2026-43450
  • netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• CVE-2026-31399
  • nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• CVE-2026-43449
  • nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449}
• CVE-2026-43427
  • usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• CVE-2026-31452
  • ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• CVE-2026-23397
  • nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• CVE-2025-71082
  • Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• CVE-2025-39955
  • tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-39955}
• CVE-2022-49770
  • ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
• CVE-2026-43283
  • net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle {CVE-2026-43283}
• Bump ABI 4.15.0-261

In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same time. Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large. A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full maximum payload size cannot be constructed in that case.

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50248: wifi: iwlwifi: mvm: fix double free on tx path (bsc#1249840).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947).
• CVE-2022-50381: md: fix a crash in mempool_free (bsc#1250257).
• CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
• CVE-2022-50401: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (bsc#1250140).
• CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).

The following non-security bugs were fixed:

• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes).
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
• kernel-syms.spec: Drop old rpm release number hack (bsc#1247172).
• rpm/kernel-subpackage-spec: Skip brp-strip-debug to avoid file truncation (bsc#1246879)
• rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337)
• rpm: Configure KABI checkingness macro (bsc#1249186)
• rpm: Drop support for kabi/arch/ignore-flavor (bsc#1249186)
• rpm: Link arch-symbols script from scripts directory.
• rpm: Link guards script from scripts directory.
• use uniform permission checks for all mount propagation changes (git-fixes).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50242: drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() (bsc#1249696).
• CVE-2022-50244: cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() (bsc#1249647).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947).
• CVE-2022-50265: kcm: annotate data-races around kcm->rx_wait (bsc#1249744).
• CVE-2022-50278: PNP: fix name memory leak in pnp_alloc_dev() (bsc#1249715).
• CVE-2022-50285: mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages (bsc#1249803).
• CVE-2022-50288: qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure (bsc#1249802).
• CVE-2022-50291: kcm: annotate data-races around kcm->rx_psock (bsc#1249798).
• CVE-2022-50294: wifi: libertas: fix memory leak in lbs_init_adapter() (bsc#1249799).
• CVE-2022-50297: wifi: ath9k: verify the expected usb_endpoints are present (bsc#1250250).
• CVE-2022-50304: mm: export bdi_unregister (bsc#1249725).
• CVE-2022-50311: cxl: Fix refcount leak in cxl_calc_capp_routing (bsc#1249720).
• CVE-2022-50312: drivers: serial: jsm: fix some leaks in probe (bsc#1249716).
• CVE-2022-50321: wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (bsc#1249706).
• CVE-2022-50330: crypto: cavium - prevent integer overflow loading firmware (bsc#1249700).
• CVE-2022-50349: misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (bsc#1249920).
• CVE-2022-50352: net: hns: fix possible memory leak in hnae_ae_register() (bsc#1249922).
• CVE-2022-50359: media: cx88: Fix a null-ptr-deref bug in buffer_prepare() (bsc#1250269).
• CVE-2022-50365: skbuff: Account for tail adjustment during pull operations (bsc#1250084).
• CVE-2022-50375: tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown (bsc#1250132).
• CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
• CVE-2022-50396: net: sched: fix memory leak in tcindex_set_parms (bsc#1250104).
• CVE-2022-50402: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() (bsc#1250363).
• CVE-2022-50405: net/tunnel: wait until all sk_user_data reader finish before releasing the sock (bsc#1250155).
• CVE-2022-50406: iomap: iomap: fix memory corruption when recording errors during writeback (bsc#1250165).
• CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2022-50419: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times (bsc#1250394).
• CVE-2023-53148: igb: Do not bring the device up after non-fatal error (bsc#1249842).
• CVE-2023-53153: wifi: cfg80211: Partial revert 'wifi: cfg80211: Fix use after free for wext' (bsc#1249877).
• CVE-2023-53176: serial: 8250: Fix oops for port->pm on uart_change_pm() (bsc#1249991).
• CVE-2023-53178: mm: zswap: fix missing folio cleanup in writeback race path (bsc#1249827 git-fix).
• CVE-2023-53199: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails (bsc#1249683).
• CVE-2023-53201: RDMA/bnxt_re: wraparound mbox producer index (bsc#1249687).
• CVE-2023-53226: wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (bsc#1249658).
• CVE-2023-53248: drm/amdgpu: install stub fence into potential unused fence pointers (bsc#1249779).
• CVE-2023-53254: drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug (bsc#1249871).
• CVE-2023-53272: net: ena: fix shift-out-of-bounds in exponential backoff (bsc#1249917).
• CVE-2023-53277: wifi: iwl3945: Add missing check for create_singlethread_workqueue…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• !CONFIG & reference -> this is bug, immediate fail
• CONFIG & no reference -> OK temporarily, must be resolved eventually
• Do not self obsolete older kernel variants
• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Update config files. (bsc#1249186) Enable where we define KABI refs + rely on Kconfig deps.
• build_bug.h: Add KABI assert (bsc#1249186).
• hv_netvsc: Fix panic during namespace deletion with VF (bsc#1248111).
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
• kernel-syms.spec: Drop…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50248: wifi: iwlwifi: mvm: fix double free on tx path (bsc#1249840).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947).
• CVE-2022-50381: md: fix a crash in mempool_free (bsc#1250257).
• CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
• CVE-2022-50401: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (bsc#1250140).
• CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2022-50412: drm: bridge: adv7511: unregister cec i2c device after cec adapter (bsc#1250189).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53220: media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (bsc#1250337).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2024-53093: nvme-multipath: defer partition scanning (bsc#1233640).
• CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
• CVE-2025-38011: drm/amdgpu: csa unmap use uninterruptible lock (bsc#1244729).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).

The following non-security bugs were fixed:

• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• git_sort: Make tests independent of environment.
• hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes).
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346).
• kernel-syms.spec: Drop old rpm release number hack (bsc#1247172).
• rpm/kernel-subpackage-spec: Skip brp-strip-debug to avoid file truncation (bsc#1246879).
• rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337).
• rpm: Configure KABI checkingness macro (bsc#1249186).
• rpm: Drop support for kabi/arch/ignore-flavor (bsc#1249186).
• scripts/python/kss-dashboard: attempt getting smash data
• scripts/python/kss-dashboard: fetch into repos if stale
• scripts/python/kss-dashboard: implement CVSSv3.1 score consistency check
• scripts/python/kss-dashboard: prepare for the alternative CVE branch
• scripts/python/kss-dashboard: simplify control flow
• scripts/python/kss-dashboard: speed up patch checking a bit
• scripts/python/kss-dashboard: use…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (bsc#1247288).
• CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (bsc#1247288).
• CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Revert backported patches for bsc#1238160.
• btrfs: avoid NULL pointer dereference if…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Revert selinux patches that caused regressions (bsc#1249353).
• btrfs: avoid NULL pointer dereference if no valid extent tree (bsc#1249158).
• build_bug.h: Add KABI assert (bsc#1249186).
• hv_netvsc: Fix panic during namespace deletion with VF (bsc#1248111).
• kabi/severities: ignore kABI for atheros helper modules The symbols are used only internally by atheros drivers.
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
• kernel-syms.spec: Drop…