CVE-2023-0386

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)

• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266)

• kernel: FUSE filesystem low-privileged user privileges escalation (CVE-2023-0386)

• kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel panic on reboot due to a bug in mei_wdt module (BZ#2139770)

• Rocky Linux8: Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142170)

• AMDSERVER 8.7: amdpstate driver incorrectly designed to load as default for Genoa (BZ#2151275)

• Rocky Linux-8.8: Update RDMA core to Linux v6.0 (BZ#2161750)

• Kernel panic observed during VxFS module unload (BZ#2162763)

• Client not able to connect to rhel server: SYN is answered by chalange ACK and RST is ignored (BZ#2165587)

• Rocky Linux8.4: s390/kexec: fix ipl report address for kdump (BZ#2166296)

• kvm-unit-test reports unhandled exception on AMD (BZ#2166362)

• Windows Server 2019 guest randomly pauses with "KVM: entry failed, hardware error 0x80000021" (BZ#2166368)

• Unable to get QinQ working with ConnectX-4 Lx in SR-IOV scenario (BZ#2166665)

• panic in fib6_rule_suppress+0x22 with custom xdp prog involved in (BZ#2167602)

• net/mlx5e: Fix use-after-free when reverting termination table (BZ#2167640)

• Rocky Linux 8.7: EEH injection failed to recover on Mellanox adapter. (BZ#2167645)

• mlx5: lag and sriov fixes (BZ#2167647)

• Rocky Linux8.4: dasd: fix no record found for raw_track_access (BZ#2167776)

• GSS: Set of fixes in ceph kernel module to prevent OCS node kernel crash - blocklist the kclient when receiving corrupted snap trace (BZ#2168896)

• Azure Rocky Linux8 scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM (BZ#2170228)

• fast_isolate_freepages scans out of target zone (BZ#2170576)

• Backport Request for locking/rwsem commits (BZ#2170939)

• ipv6 traffic stop when an sriov vf have ipv6 address (BZ#2172550)

• Hyper-V Rocky Linux8.8: Update MANA driver (BZ#2173103)

Enhancement(s):

• Intel 8.8 FEAT SPR CPU: AMX: Improve the init_fpstate setup code (BZ#2168384)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)

• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266)

• kernel: FUSE filesystem low-privileged user privileges escalation (CVE-2023-0386)

• kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel panic on reboot due to a bug in mei_wdt module (BZ#2139770)

• Rocky Linux SIG Cloud8: Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142170)

• AMDSERVER 8.7: amdpstate driver incorrectly designed to load as default for Genoa (BZ#2151275)

• Rocky Linux SIG Cloud-8.8: Update RDMA core to Linux v6.0 (BZ#2161750)

• Kernel panic observed during VxFS module unload (BZ#2162763)

• Client not able to connect to rhel server: SYN is answered by chalange ACK and RST is ignored (BZ#2165587)

• Rocky Linux SIG Cloud8.4: s390/kexec: fix ipl report address for kdump (BZ#2166296)

• kvm-unit-test reports unhandled exception on AMD (BZ#2166362)

• Windows Server 2019 guest randomly pauses with "KVM: entry failed, hardware error 0x80000021" (BZ#2166368)

• Unable to get QinQ working with ConnectX-4 Lx in SR-IOV scenario (BZ#2166665)

• panic in fib6_rule_suppress+0x22 with custom xdp prog involved in (BZ#2167602)

• net/mlx5e: Fix use-after-free when reverting termination table (BZ#2167640)

• Rocky Linux SIG Cloud 8.7: EEH injection failed to recover on Mellanox adapter. (BZ#2167645)

• mlx5: lag and sriov fixes (BZ#2167647)

• Rocky Linux SIG Cloud8.4: dasd: fix no record found for raw_track_access (BZ#2167776)

• GSS: Set of fixes in ceph kernel module to prevent OCS node kernel crash - blocklist the kclient when receiving corrupted snap trace (BZ#2168896)

• Azure Rocky Linux SIG Cloud8 scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM (BZ#2170228)

• fast_isolate_freepages scans out of target zone (BZ#2170576)

• Backport Request for locking/rwsem commits (BZ#2170939)

• ipv6 traffic stop when an sriov vf have ipv6 address (BZ#2172550)

• Hyper-V Rocky Linux SIG Cloud8.8: Update MANA driver (BZ#2173103)

Enhancement(s):

• Intel 8.8 FEAT SPR CPU: AMX: Improve the init_fpstate setup code (BZ#2168384)

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266)
• kernel: FUSE filesystem low-privileged user privileges escalation (CVE-2023-0386)
• kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel panic on reboot due to a bug in mei_wdt module (BZ#2139770)
• AlmaLinux8: Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142170)
• AMDSERVER 8.7: amdpstate driver incorrectly designed to load as default for Genoa (BZ#2151275)
• AlmaLinux-8.8: Update RDMA core to Linux v6.0 (BZ#2161750)
• Kernel panic observed during VxFS module unload (BZ#2162763)
• Client not able to connect to almalinux server: SYN is answered by chalange ACK and RST is ignored (BZ#2165587)
• AlmaLinux8.4: s390/kexec: fix ipl report address for kdump (BZ#2166296)
• kvm-unit-test reports unhandled exception on AMD (BZ#2166362)
• Windows Server 2019 guest randomly pauses with "KVM: entry failed, hardware error 0x80000021" (BZ#2166368)
• Unable to get QinQ working with ConnectX-4 Lx in SR-IOV scenario (BZ#2166665)
• panic in fib6_rule_suppress+0x22 with custom xdp prog involved in (BZ#2167602)
• net/mlx5e: Fix use-after-free when reverting termination table (BZ#2167640)
• AlmaLinux 8.7: EEH injection failed to recover on Mellanox adapter. (BZ#2167645)
• mlx5: lag and sriov fixes (BZ#2167647)
• AlmaLinux8.4: dasd: fix no record found for raw_track_access (BZ#2167776)
• GSS: Set of fixes in ceph kernel module to prevent OCS node kernel crash - blocklist the kclient when receiving corrupted snap trace (BZ#2168896)
• Azure AlmaLinux8 scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM (BZ#2170228)
• fast_isolate_freepages scans out of target zone (BZ#2170576)
• Backport Request for locking/rwsem commits (BZ#2170939)
• ipv6 traffic stop when an sriov vf have ipv6 address (BZ#2172550)
• Hyper-V AlmaLinux8.8: Update MANA driver (BZ#2173103)

Enhancement(s):

• Intel 8.8 FEAT SPR CPU: AMX: Improve the init_fpstate setup code (BZ#2168384)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266)
• kernel: FUSE filesystem low-privileged user privileges escalation (CVE-2023-0386)
• kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Lazy irq_work does not raise softirq on PREEMPT_RT [almalinux-8] (BZ#2172163)
• The latest AlmaLinux 8.7.z3 kernel changes need to be merged into the RT source tree to keep source parity between the two kernels. (BZ#2172278)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: FUSE filesystem low-privileged user privileges escalation (CVE-2023-0386)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel-rt: update RT source tree to the latest AlmaLinux-9.1.z3 Batch (BZ#2182066)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: FUSE filesystem low-privileged user privileges escalation (CVE-2023-0386)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Update intel_idle for Eaglestream/Sapphire Rapids support (BZ#2168361)
• AlmaLinux9: An application stopped on robust futex used via pthread_mutex_lock() (BZ#2168836)

• cgroup: Use open-time cgroup namespace for process migration perm checks {CVE-2021-4197}
• cgroup: Use open-time credentials for process migraton perm checks {CVE-2021-4197}
• cgroup: cgroup.{procs,threads} factor out common parts
• cgroup: unify attach permission checking
• vt: drop old FONT ioctls {CVE-2021-33656}
• fbmem: Check virtual screen sizes in fb_set_var() {CVE-2021-33655}
• fbcon: Prevent that screen size is smaller than font size {CVE-2021-33655}
• fbcon: Disallow setting font bigger than screen size {CVE-2021-33655}
• KVM: nVMX: add missing consistency checks for CR0 and CR4 {CVE-2023-30456}
• net: usb: ax88179_178a: Fix packet receiving {CVE-2022-2964}
• net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup {CVE-2022-2964}
• net: usb: ax88179_178a: fix packet alignment padding {CVE-2022-2964}
• ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32
• KVM: x86/mmu: do compare-and-exchange of gPTE via the user address {CVE-2022-1158}
• RDMA/cma: Do not change route.addr.src_addr.ss_family {CVE-2021-4028}
• RDMA/cma: Make the locking for automatic state transition more clear
• ath10k: Validate first subframe of A-MSDU before processing the list {CVE-2020-24588}
• ath10k: drop MPDU which has discard flag set by firmware for SDIO {CVE-2020-24588}
• mac80211: drop A-MSDUs on old ciphers {CVE-2020-24588}
• cfg80211: mitigate A-MSDU aggregation attacks {CVE-2020-24588}
• ipv4: make exception cache less predictible {CVE-2021-20322}
• ipv4: use siphash instead of Jenkins in fnhe_hashfun() {CVE-2021-20322}
• ipv6: make exception cache less predictible {CVE-2021-20322}
• ipv6: use siphash in rt6_exception_hash() {CVE-2021-20322}
• ipv6: use jhash2() in rt6_exception_hash()
• psi: Fix uaf issue when psi trigger is destroyed while being polled {CVE-2022-2938}
• psi: fix possible trigger missing in the window
• cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
• cgroup: make per-cgroup pressure stall tracking configurable
• netfilter: nf_tables_offload: incorrect flow offload action array size {CVE-2022-25636}
• netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create
• cgroup: fix psi monitor for root cgroup
• cgroup/cgroup.c: replace 'of->kn->priv' with of_cft()
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• devlink: Fix use-after-free after a failed reload {CVE-2022-3625}
• KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS {CVE-2022-2196}
• net/sched: tcindex: update imperfect hash filters respecting rcu {CVE-2023-1281}
• seq_buf: Fix overflow in seq_buf_putmem_hex() {CVE-2023-28772}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg {CVE-2023-31436}
• cgroup-v1: Require capabilities to set release_agent {CVE-2022-0492}
• net: sched: fix use-after-free in tc_new_tfilter() {CVE-2022-1055}
• SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() {CVE-2022-28893}
• net/sched: cls_u32: fix netns refcount changes in u32_change() {CVE-2022-29581}
• i2c: ismt: Fix an out-of-bounds bug in ismt_access() {CVE-2022-2873}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}

• cgroup: Use open-time cgroup namespace for process migration perm checks {CVE-2021-4197}
• cgroup: Use open-time credentials for process migraton perm checks {CVE-2021-4197}
• vt: drop old FONT ioctls {CVE-2021-33656}
• fbmem: Check virtual screen sizes in fb_set_var() {CVE-2021-33655}
• fbcon: Prevent that screen size is smaller than font size {CVE-2021-33655}
• fbcon: Disallow setting font bigger than screen size {CVE-2021-33655}
• KVM: nVMX: add missing consistency checks for CR0 and CR4 {CVE-2023-30456}
• net: usb: ax88179_178a: Fix packet receiving
• ipv4: make exception cache less predictible {CVE-2021-20322}
• ipv4: use siphash instead of Jenkins in fnhe_hashfun() {CVE-2021-20322}
• ipv6: make exception cache less predictible {CVE-2021-20322}
• ipv6: use siphash in rt6_exception_hash() {CVE-2021-20322}
• ipv6: use jhash2() in rt6_exception_hash()
• psi: Fix uaf issue when psi trigger is destroyed while being polled {CVE-2022-2938}
• psi: fix possible trigger missing in the window
• cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
• cgroup: make per-cgroup pressure stall tracking configurable
• netfilter: nf_tables_offload: incorrect flow offload action array size {CVE-2022-25636}
• netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• devlink: Fix use-after-free after a failed reload {CVE-2022-3625}
• KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS {CVE-2022-2196}
• net/sched: tcindex: update imperfect hash filters respecting rcu {CVE-2023-1281}
• seq_buf: Fix overflow in seq_buf_putmem_hex() {CVE-2023-28772}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg {CVE-2023-31436}
• cgroup-v1: Require capabilities to set release_agent {CVE-2022-0492}
• net: sched: fix use-after-free in tc_new_tfilter() {CVE-2022-1055}
• SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() {CVE-2022-28893}
• net/sched: cls_u32: fix netns refcount changes in u32_change() {CVE-2022-29581}
• i2c: ismt: Fix an out-of-bounds bug in ismt_access() {CVE-2022-2873}
• RDMA/cma: Do not change route.addr.src_addr.ss_family {CVE-2021-4028}
• net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup {CVE-2022-2964}
• KVM: x86/mmu: do compare-and-exchange of gPTE via the user address {CVE-2022-1158}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}

• CVE-url: https://ubuntu.com/security/CVE-2024-46787
  • userfaultfd: fix checks for huge PMDs
• CVE-url: https://ubuntu.com/security/CVE-2025-37798
  • sch_htb: make htb_qlen_notify() idempotent
  • sch_drr: make drr_qlen_notify() idempotent
  • sch_hfsc: make hfsc_qlen_notify() idempotent
  • sch_qfq: make qfq_qlen_notify() idempotent
  • codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
• CVE-url: https://ubuntu.com/security/CVE-2025-37803
  • udmabuf: fix a buf size overflow issue during udmabuf creation
• CVE-url: https://ubuntu.com/security/CVE-2025-37785
  • ext4: optimize __ext4_check_dir_entry()
  • ext4: fix OOB read when checking dotdot dir
• CVE-url: https://ubuntu.com/security/CVE-2025-22038
  • ksmbd: validate zero num_subauth before sub_auth is accessed
• CVE-url: https://ubuntu.com/security/CVE-2025-21927
  • nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()
• CVE-url: https://ubuntu.com/security/CVE-2025-21969
  • Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
• CVE-url: https://ubuntu.com/security/CVE-2025-21855
  • ibmvnic: Don't reference skb after sending to VIOS
• CVE-url: https://ubuntu.com/security/CVE-2025-21780
  • drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
• CVE-url: https://ubuntu.com/security/CVE-2023-0386
  • ovl: fail on invalid uid/gid mapping at copy up

• ASoC: topology: Clean up route loading {CVE-2024-41069}
• ASoC: topology: Fix references to freed memory {CVE-2024-41069}
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt() {CVE-2024-35965}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35966}
• media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621}
• net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
• sch_htb: make htb_qlen_notify() idempotent {CVE-2025-37932}
• codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-37798}
• sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38350}
• sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38350}
• sch_htb: make htb_deactivate() idempotent {CVE-2025-38350}
• sch_cbq: make cbq_qlen_notify() idempotent {CVE-2025-38000}
• inet: fully convert sk->sk_rx_dst to RCU rules {CVE-2021-47103}
• scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
• scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
• vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
• USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
• nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
• virtio-net: Add validation for used length {CVE-2021-47352}
• watchdog: Fix possible use-after-free by calling del_timer_sync() {CVE-2021-47321}
• scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978}
• wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
• wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921}
• mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
• wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
• net: fix information leakage in /proc/net/ptype {CVE-2022-48757}
• crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
• perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
• net: ti: fix UAF in tlan_remove_one {CVE-2021-47310}
• wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
• net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
• net: add atomic_long_t to net_device_stats fields {CVE-2023-52578}
• media: dvb-core: Fix use-after-free due to race at dvb_register_device() {CVE-2022-45884}
• media: dvb-core: Fix use-after-free on race condition at dvb_frontend {CVE-2022-45885}
• xen/gntalloc: don't use gnttab_query_foreign_access() {CVE-2022-23039}
• xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
• xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23038}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292}
• gfs2: Fix length of holes reported at end-of-file
• gfs2: Only do glock put in gfs2_create_inode for free inodes
• gfs2: Fix use-after-free in gfs2_logd after withdraw
• gfs2: fix use-after-free in trans_drain
• gfs2: Clean up revokes on normal withdraws
• GFS2: gfs2_free_extlen can return an extent that is too long
• gfs2: Wipe jdata and ail1 in gfs2_journal_wipe, formerly gfs2_meta_wipe
• GFS2: Refactor gfs2_remove_from_journal
• GFS2: Only set PageChecked for jdata…

• ASoC: topology: Clean up route loading {CVE-2024-41069}
• ASoC: topology: Fix references to freed memory {CVE-2024-41069}
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt() {CVE-2024-35965}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35966}
• media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621}
• net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
• sch_htb: make htb_qlen_notify() idempotent {CVE-2025-37932}
• codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-37798}
• sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38350}
• sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38350}
• sch_htb: make htb_deactivate() idempotent {CVE-2025-38350}
• sch_cbq: make cbq_qlen_notify() idempotent {CVE-2025-38000}
• inet: fully convert sk->sk_rx_dst to RCU rules {CVE-2021-47103}
• scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
• scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
• vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
• USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
• nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
• virtio-net: Add validation for used length {CVE-2021-47352}
• watchdog: Fix possible use-after-free by calling del_timer_sync() {CVE-2021-47321}
• scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978}
• wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
• wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921}
• mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
• wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
• net: fix information leakage in /proc/net/ptype {CVE-2022-48757}
• crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
• perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
• net: ti: fix UAF in tlan_remove_one {CVE-2021-47310}
• wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
• net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
• net: add atomic_long_t to net_device_stats fields {CVE-2023-52578}
• media: dvb-core: Fix use-after-free due to race at dvb_register_device() {CVE-2022-45884}
• media: dvb-core: Fix use-after-free on race condition at dvb_frontend {CVE-2022-45885}
• xen/gntalloc: don't use gnttab_query_foreign_access() {CVE-2022-23039}
• xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
• xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23038}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292}
• gfs2: Fix length of holes reported at end-of-file
• gfs2: Only do glock put in gfs2_create_inode for free inodes
• gfs2: Fix use-after-free in gfs2_logd after withdraw
• gfs2: fix use-after-free in trans_drain
• gfs2: Clean up revokes on normal withdraws
• GFS2: gfs2_free_extlen can return an extent that is too long
• gfs2: Wipe jdata and ail1 in gfs2_journal_wipe, formerly gfs2_meta_wipe
• GFS2: Refactor gfs2_remove_from_journal
• GFS2: Only set PageChecked for jdata…

• ASoC: topology: Clean up route loading {CVE-2024-41069}
• ASoC: topology: Fix references to freed memory {CVE-2024-41069}
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt() {CVE-2024-35965}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35966}
• media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621}
• inet: fully convert sk->sk_rx_dst to RCU rules {CVE-2021-47103}
• scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
• scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
• vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
• USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
• nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
• virtio-net: Add validation for used length {CVE-2021-47352}
• watchdog: Fix possible use-after-free by calling del_timer_sync() {CVE-2021-47321}
• scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978}
• wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
• wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921}
• mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
• wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
• net: fix information leakage in /proc/net/ptype {CVE-2022-48757}
• crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
• perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
• net: ti: fix UAF in tlan_remove_one {CVE-2021-47310}
• wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
• net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
• net: add atomic_long_t to net_device_stats fields {CVE-2023-52578}
• media: dvb-core: Fix use-after-free due to race at dvb_register_device() {CVE-2022-45884}
• media: dvb-core: Fix use-after-free on race condition at dvb_frontend {CVE-2022-45885}
• xen/gntalloc: don't use gnttab_query_foreign_access() {CVE-2022-23039}
• xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
• xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23038}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292}

It was discovered that the OverlayFS implementation in the Linux kernel did not properly handle copy up operation in some conditions. A local attacker could possibly use this to gain elevated privileges.(CVE-2023-0386)

It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform data buffer size validation in some situations. A physically proximate attacker could use this to craft a malicious USB device that when inserted, could cause a denial of service (system crash) or possibly expose sensitive information.(CVE-2023-1380)

It was discovered that a race condition existed in the io_uring subsystem in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-1872)

Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock).(CVE-2023-2612)

Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-31436)

Patryk Sondej and Piotr Krysiuk discovered that a race condition existed in the netfilter subsystem of the Linux kernel when processing batch requests, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-32233)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)

• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266)

• kernel: FUSE filesystem low-privileged user privileges escalation (CVE-2023-0386)

• kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Lazy irq_work does not raise softirq on PREEMPT_RT [rhel-8] (BZ#2172163)

• The latest Rocky Linux 8.7.z3 kernel changes need to be merged into the RT source tree to keep source parity between the two kernels. (BZ#2172278)

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2235: A use-after-free vulnerability in the Performance Events system can be exploited to achieve local privilege escalation (bsc#1210986).
• CVE-2022-2196: Fixed a regression related to KVM that allowed for speculative execution attacks (bsc#1206992).
• CVE-2023-23006: Fixed NULL checking against IS_ERR in dr_domain_init_resources (bsc#1208845).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-2176: A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem to crash the system or escalation of privilege (bsc#1210629).
• CVE-2023-0386: A flaw was found where unauthorized access to the execution of the setuid file with capabilities was found in the OverlayFS subsystem, when a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allowed a local user to escalate their privileges on the system (bsc#1209615).
• CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-1855: Fixed a use after free in xgene_hwmon_remove (bsc#1210202).
• CVE-2023-30772: Fixed a race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).
• CVE-2023-2019: A flaw was found in the netdevsim device driver, more specifically within the scheduling of events. This issue results from the improper management of a reference count and may lead to a denial of service (bsc#1210454).
• CVE-2023-2008: A flaw was found in the fault handler of the udmabuf device driver. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code (bsc#1210453).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
• CVE-2023-1990: Fixed a use after free in ndlc_remove (bsc#1210337).

The following non-security bugs were fixed:

• ACPI: CPPC: Disable FIE if registers in PCC regions (bsc#1210953).
• ACPI: VIOT: Initialize the correct IOMMU fwspec (git-fixes).
• ACPI: resource: Add Medion S17413 to IRQ override quirk (git-fixes).
• ALSA: emu10k1: do not create old pass-through playback device on Audigy (git-fixes).
• ALSA: emu10k1: fix capture interrupt handler unlinking (git-fixes).
• ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex() (git-fixes).
• ALSA: hda/cirrus: Add extra 10 ms delay to allow PLL settle and lock (git-fixes).
• ALSA: hda/realtek: Add quirks for Lenovo Z13/Z16 Gen2 (git-fixes).
• ALSA: hda/realtek: Enable mute/micmute LEDs and speaker support for HP Laptops (git-fixes).
• ALSA: hda/realtek: Remove specific patch for Dell Precision 3260 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook (git-fixes).
• ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP platform (git-fixes).
• ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard (git-fixes).
• ALSA: hda/sigmatel: fix S/PDIF out on Intel D45 motherboards (git-fixes).
• ALSA: hda: cs35l41: Enable Amp High Pass Filter (git-fixes).
• ALSA: hda: patch_realtek: add quirk for Asus N7601ZM (git-fixes).
• ALSA: i2c/cs8427: fix iec958 mixer control deactivation (git-fixes).
• ARM: 9290/1: uaccess: Fix KASAN false-positives (git-fixes).
• ARM: dts: exynos: fix WM8960 clock name in Itop Elite (git-fixes).
• ARM: dts: gta04: fix excess dma channel usage (git-fixes).
• ARM: dts: qcom: ipq4019: Fix the PCI I/O port range (git-fixes).
• ARM: dts: rockchip: fix a typo error for rk3288 spdif node (git-fixes).
• ARM: dts: s5pv210: correct MIPI CSIS clock name (git-fixes).
• ASN.1: Fix check for strdup() success (git-fixes).
• ASoC: cs35l41: Only disable…

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2235: A use-after-free vulnerability in the Performance Events system can be exploited to achieve local privilege escalation (bsc#1210986).
• CVE-2022-2196: Fixed a regression related to KVM that allowed for speculative execution attacks (bsc#1206992).
• CVE-2023-23006: Fixed NULL checking against IS_ERR in dr_domain_init_resources (bsc#1208845).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-2176: A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem to crash the system or escalation of privilege (bsc#1210629).
• CVE-2023-0386: A flaw was found where unauthorized access to the execution of the setuid file with capabilities was found in the OverlayFS subsystem, when a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allowed a local user to escalate their privileges on the system (bsc#1209615).
• CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-1855: Fixed a use after free in xgene_hwmon_remove (bsc#1210202).
• CVE-2023-30772: Fixed a race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).
• CVE-2023-2019: A flaw was found in the netdevsim device driver, more specifically within the scheduling of events. This issue results from the improper management of a reference count and may lead to a denial of service (bsc#1210454).
• CVE-2023-2008: A flaw was found in the fault handler of the udmabuf device driver. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code (bsc#1210453).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
• CVE-2023-1990: Fixed a use after free in ndlc_remove (bsc#1210337).

The following non-security bugs were fixed:

• ACPI: CPPC: Disable FIE if registers in PCC regions (bsc#1210953).
• ACPI: VIOT: Initialize the correct IOMMU fwspec (git-fixes).
• ACPI: resource: Add Medion S17413 to IRQ override quirk (git-fixes).
• ALSA: emu10k1: do not create old pass-through playback device on Audigy (git-fixes).
• ALSA: emu10k1: fix capture interrupt handler unlinking (git-fixes).
• ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex() (git-fixes).
• ALSA: hda/cirrus: Add extra 10 ms delay to allow PLL settle and lock (git-fixes).
• ALSA: hda/realtek: Add quirks for Lenovo Z13/Z16 Gen2 (git-fixes).
• ALSA: hda/realtek: Enable mute/micmute LEDs and speaker support for HP Laptops (git-fixes).
• ALSA: hda/realtek: Remove specific patch for Dell Precision 3260 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook (git-fixes).
• ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP platform (git-fixes).
• ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard (git-fixes).
• ALSA: hda/sigmatel: fix S/PDIF out on Intel D45 motherboards (git-fixes).
• ALSA: hda: cs35l41: Enable Amp High Pass Filter (git-fixes).
• ALSA: hda: patch_realtek: add quirk for Asus N7601ZM (git-fixes).
• ALSA: i2c/cs8427: fix iec958 mixer control deactivation (git-fixes).
• ARM: 9290/1: uaccess: Fix KASAN false-positives (git-fixes).
• ARM: dts: exynos: fix WM8960 clock name in Itop Elite (git-fixes).
• ARM: dts: gta04: fix excess dma channel usage (git-fixes).
• ARM: dts: qcom: ipq4019: Fix the PCI I/O port range (git-fixes).
• ARM: dts: rockchip: fix a typo error for rk3288 spdif node (git-fixes).
• ARM: dts: s5pv210: correct MIPI CSIS clock name (git-fixes).
• ASN.1: Fix check for strdup() success (git-fixes).
• ASoC: cs35l41: Only…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2235: A use-after-free vulnerability in the Performance Events system can be exploited to achieve local privilege escalation (bsc#1210986).
• CVE-2022-2196: Fixed a regression related to KVM that allowed for speculative execution attacks (bsc#1206992).
• CVE-2023-23006: Fixed NULL checking against IS_ERR in dr_domain_init_resources (bsc#1208845).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-2176: A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem to crash the system or escalation of privilege (bsc#1210629).
• CVE-2023-0386: A flaw was found where unauthorized access to the execution of the setuid file with capabilities was found in the OverlayFS subsystem, when a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allowed a local user to escalate their privileges on the system (bsc#1209615).
• CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-1855: Fixed a use after free in xgene_hwmon_remove (bsc#1210202).
• CVE-2023-30772: Fixed a race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).
• CVE-2023-2019: A flaw was found in the netdevsim device driver, more specifically within the scheduling of events. This issue results from the improper management of a reference count and may lead to a denial of service (bsc#1210454).
• CVE-2023-2008: A flaw was found in the fault handler of the udmabuf device driver. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code (bsc#1210453).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
• CVE-2023-1990: Fixed a use after free in ndlc_remove (bsc#1210337).

The following non-security bugs were fixed:

• ACPI: CPPC: Disable FIE if registers in PCC regions (bsc#1210953).
• ACPI: VIOT: Initialize the correct IOMMU fwspec (git-fixes).
• ACPI: resource: Add Medion S17413 to IRQ override quirk (git-fixes).
• ALSA: emu10k1: do not create old pass-through playback device on Audigy (git-fixes).
• ALSA: emu10k1: fix capture interrupt handler unlinking (git-fixes).
• ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex() (git-fixes).
• ALSA: hda/cirrus: Add extra 10 ms delay to allow PLL settle and lock (git-fixes).
• ALSA: hda/realtek: Add quirks for Lenovo Z13/Z16 Gen2 (git-fixes).
• ALSA: hda/realtek: Enable mute/micmute LEDs and speaker support for HP Laptops (git-fixes).
• ALSA: hda/realtek: Remove specific patch for Dell Precision 3260 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook (git-fixes).
• ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP platform (git-fixes).
• ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard (git-fixes).
• ALSA: hda/sigmatel: fix S/PDIF out on Intel D45 motherboards (git-fixes).
• ALSA: hda: cs35l41: Enable Amp High Pass Filter (git-fixes).
• ALSA: hda: patch_realtek: add quirk for Asus N7601ZM (git-fixes).
• ALSA: i2c/cs8427: fix iec958 mixer control deactivation (git-fixes).
• ARM: 9290/1: uaccess: Fix KASAN false-positives (git-fixes).
• ARM: dts: exynos: fix WM8960 clock name in Itop Elite (git-fixes).
• ARM: dts: gta04: fix excess dma channel usage (git-fixes).
• ARM: dts: qcom: ipq4019: Fix the PCI I/O port range (git-fixes).
• ARM: dts: rockchip: fix a typo error for rk3288 spdif node (git-fixes).
• ARM: dts: s5pv210: correct MIPI CSIS clock name (git-fixes).
• ASN.1: Fix check for strdup() success (git-fixes).
• ASoC: cs35l41: Only…

This update for the Linux Kernel 5.14.21-150400_15_23 fixes several issues.

The following security issues were fixed:

• CVE-2023-0386: Fixed privileges escalation for low-privileged users in the OverlayFS subsystem (bsc#1210499).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

This update for the Linux Kernel 5.14.21-150400_15_18 fixes several issues.

The following security issues were fixed:

• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1211111).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210500).
• CVE-2023-0386: Fixed privileges escalation for low-privileged users in the OverlayFS subsystem (bsc#1210499).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209683).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

This update for the Linux Kernel 5.14.21-150400_15_5 fixes several issues.

The following security issues were fixed:

• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1211111).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210500).
• CVE-2023-0386: Fixed privileges escalation for low-privileged users in the OverlayFS subsystem (bsc#1210499).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209683).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208911).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

This update for the Linux Kernel 5.14.21-150400_15_11 fixes several issues.

The following security issues were fixed:

• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1211111).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210500).
• CVE-2023-0386: Fixed privileges escalation for low-privileged users in the OverlayFS subsystem (bsc#1210499).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209683).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208911).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

This update for the Linux Kernel 5.14.21-150400_24_11 fixes several issues.

The following security issues were fixed:

• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1211111).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210500).
• CVE-2023-0386: Fixed privileges escalation for low-privileged users in the OverlayFS subsystem (bsc#1210499).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209683).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208911).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

This update for the Linux Kernel 5.14.21-150400_24_60 fixes several issues.

The following security issues were fixed:

• CVE-2023-0386: Fixed privileges escalation for low-privileged users in the OverlayFS subsystem (bsc#1210499).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

This update for the Linux Kernel 5.14.21-150400_24_38 fixes several issues.

The following security issues were fixed:

• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1211111).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210500).
• CVE-2023-0386: Fixed privileges escalation for low-privileged users in the OverlayFS subsystem (bsc#1210499).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209683).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208911).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

This update for the Linux Kernel 5.14.21-150400_24_33 fixes several issues.

The following security issues were fixed:

• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1211111).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210500).
• CVE-2023-0386: Fixed privileges escalation for low-privileged users in the OverlayFS subsystem (bsc#1210499).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209683).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208911).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

This update for the Linux Kernel 5.14.21-150400_24_21 fixes several issues.

The following security issues were fixed:

• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1211111).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210500).
• CVE-2023-0386: Fixed privileges escalation for low-privileged users in the OverlayFS subsystem (bsc#1210499).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209683).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208911).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

This update for the Linux Kernel 5.14.21-150400_24_55 fixes several issues.

The following security issues were fixed:

• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1211111).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210500).
• CVE-2023-0386: Fixed privileges escalation for low-privileged users in the OverlayFS subsystem (bsc#1210499).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209683).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

This update for the Linux Kernel 5.14.21-150400_22 fixes several issues.

The following security issues were fixed:

• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1211111).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210500).
• CVE-2023-0386: Fixed privileges escalation for low-privileged users in the OverlayFS subsystem (bsc#1210499).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209683).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208911).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets (bsc#1185861).
• CVE-2022-2196: Fixed a regression related to KVM that allowed for speculative execution attacks (bsc#1206992).
• CVE-2022-3523: Fixed a use after free related to device private page handling (bsc#1204363).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
• CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
• CVE-2023-0386: A flaw was found where unauthorized access to the execution of the setuid file with capabilities was found in the OverlayFS subsystem, when a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allowed a local user to escalate their privileges on the system (bsc#1209615).
• CVE-2023-0394: Fixed a null pointer dereference in the network subcomponent. This flaw could cause system crashes (bsc#1207168).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0469: Fixed a use-after-free flaw in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent (bsc#1207521).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636). -…

It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1281)

It was discovered that the OverlayFS implementation in the Linux kernel did not properly handle copy up operation in some conditions. A local attacker could possibly use this to gain elevated privileges. (CVE-2023-0386)

Haowei Yan discovered that a race condition existed in the Layer 2 Tunneling Protocol (L2TP) implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-4129)

It was discovered that the network queuing discipline implementation in the Linux kernel contained a null pointer dereference in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-47929)

It was discovered that the NTFS file system implementation in the Linux kernel contained a null pointer dereference in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-4842)

Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference vulnerability in certain situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0394)

It was discovered that the Human Interface Device (HID) support driver in the Linux kernel contained a type confusion vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-1073)

It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

It was discovered that the NFS implementation in the Linux kernel did not properly handle pending tasks in some situations. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information (kernel memory). (CVE-2023-1652)

Lianhui Tang discovered that the MPLS implementation in the Linux kernel did not properly handle certain sysctl allocation failure conditions, leading to a double-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-26545)

It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1281)

It was discovered that the OverlayFS implementation in the Linux kernel did not properly handle copy up operation in some conditions. A local attacker could possibly use this to gain elevated privileges. (CVE-2023-0386)

Haowei Yan discovered that a race condition existed in the Layer 2 Tunneling Protocol (L2TP) implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-4129)

It was discovered that the network queuing discipline implementation in the Linux kernel contained a null pointer dereference in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-47929)

It was discovered that the NTFS file system implementation in the Linux kernel contained a null pointer dereference in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-4842)

Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference vulnerability in certain situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0394)

It was discovered that the Human Interface Device (HID) support driver in the Linux kernel contained a type confusion vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-1073)

It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

It was discovered that the NFS implementation in the Linux kernel did not properly handle pending tasks in some situations. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information (kernel memory). (CVE-2023-1652)

Lianhui Tang discovered that the MPLS implementation in the Linux kernel did not properly handle certain sysctl allocation failure conditions, leading to a double-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-26545)