CVE-2023-0590

A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 ("net: sched: fix race condition in qdisc_graft()") not applied yet, then kernel could be affected.

The Linux Kernel, the operating system core itself.

Security Fix(es):

A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could allow a local user to crash the system.(CVE-2022-3707)

A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash.(CVE-2023-0394)

A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem leading to a denial-of-service problem.

Reference: https://lore.kernel.org/all/[email protected]/

Crash: BUG: KASAN: use-after-free in __tcf_qdisc_find.part.0+0xa3a/0xac0 net/sched/cls_api.c:1066 Read of size 4 at addr ffff88802065e038 by task syz-executor.4/21027

CPU: 0 PID: 21027 Comm: syz-executor.4 Not tainted 6.0.0-rc3-syzkaller-00363-g7726d4c3e60b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:317 [inline]
print_report.cold+0x2ba/0x719 mm/kasan/report.c:433
kasan_report+0xb1/0x1e0 mm/kasan/report.c:495
__tcf_qdisc_find.part.0+0xa3a/0xac0 net/sched/cls_api.c:1066
__tcf_qdisc_find net/sched/cls_api.c:1051 [inline]
tc_new_tfilter+0x34f/0x2200 net/sched/cls_api.c:2018
rtnetlink_rcv_msg+0x955/0xca0 net/core/rtnetlink.c:6081
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2482
___sys_sendmsg+0x110/0x1b0 net/socket.c:2536
__sys_sendmsg+0xf3/0x1c0 net/socket.c:2565
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f5efaa89279(CVE-2023-0590)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could allow a local user to crash the system.(CVE-2022-3707)

A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash.(CVE-2023-0394)

A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem leading to a denial-of-service problem.

Reference: https://lore.kernel.org/all/[email protected]/

Crash: BUG: KASAN: use-after-free in __tcf_qdisc_find.part.0+0xa3a/0xac0 net/sched/cls_api.c:1066 Read of size 4 at addr ffff88802065e038 by task syz-executor.4/21027

CPU: 0 PID: 21027 Comm: syz-executor.4 Not tainted 6.0.0-rc3-syzkaller-00363-g7726d4c3e60b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:317 [inline]
print_report.cold+0x2ba/0x719 mm/kasan/report.c:433
kasan_report+0xb1/0x1e0 mm/kasan/report.c:495
__tcf_qdisc_find.part.0+0xa3a/0xac0 net/sched/cls_api.c:1066
__tcf_qdisc_find net/sched/cls_api.c:1051 [inline]
tc_new_tfilter+0x34f/0x2200 net/sched/cls_api.c:2018
rtnetlink_rcv_msg+0x955/0xca0 net/core/rtnetlink.c:6081
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2482
___sys_sendmsg+0x110/0x1b0 net/socket.c:2536
__sys_sendmsg+0xf3/0x1c0 net/socket.c:2565
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f5efaa89279(CVE-2023-0590)

A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 ("net: sched: fix race condition in qdisc_graft()") not applied yet, then kernel could be affected.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)
• net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)
• hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)
• malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)
• possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)
• KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)
• use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882)
• KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)
• netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)
• race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)
• out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435)
• race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)
• memory leak in ipv6_renew_options() (CVE-2022-3524)
• data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)
• data races around sk->sk_prot (CVE-2022-3567)
• memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)
• denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)
• use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)
• USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)
• use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640)
• Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)
• mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128)
• l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)
• igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)
• lockdown bypass using IMA (CVE-2022-21505)
• double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)
• network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743)
• unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)
• TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189)
• u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)
• use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)
• use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)
• BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)
• Denial of service in beacon protection for P2P-device (CVE-2022-42722)
• memory corruption in usbmon driver (CVE-2022-43750)
• NULL pointer dereference in traffic control subsystem (CVE-2022-47929)
• NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)
• use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)
• use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)
• denial of service in tipc_conn_close (CVE-2023-1382)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)
• net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)
• cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)
• malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)
• possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)
• KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)
• use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882)
• KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)
• netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)
• race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)
• out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435)
• race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)
• memory leak in ipv6_renew_options() (CVE-2022-3524)
• data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)
• data races around sk->sk_prot (CVE-2022-3567)
• memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)
• denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)
• use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)
• USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)
• use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640)
• Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)
• mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128)
• l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)
• igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)
• lockdown bypass using IMA (CVE-2022-21505)
• double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)
• network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743)
• unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)
• TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189)
• u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)
• use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)
• use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)
• BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)
• Denial of service in beacon protection for P2P-device (CVE-2022-42722)
• memory corruption in usbmon driver (CVE-2022-43750)
• NULL pointer dereference in traffic control subsystem (CVE-2022-47929)
• NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)
• use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)
• use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)
• denial of service in tipc_conn_close (CVE-2023-1382)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)
• kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)
• kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)
• kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975)
• kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)
• kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640)
• kernel: double free in usb_8dev_start_xmit (CVE-2022-28388)
• kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951, CVE-2023-33952)
• hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)
• kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895)
• kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456)
• kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887)
• kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458)
• kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590)
• kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)
• kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073)
• kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)
• kernel: hid: Use After Free in asus_remove (CVE-2023-1079)
• kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118)
• kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)
• kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)
• kernel: denial of service in tipc_conn_close (CVE-2023-1382)
• kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989)
• kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)
• kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513)
• kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161)
• kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)
• kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772)
• kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132)
• kernel: Race between task migrating pages and another task calling exit_mmap (CVE-2023-4732)
• Kernel: denial of service in atm_tc_enqueue due to type confusion (CVE-2023-23455)
• kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)
• kernel: Denial of service issue in az6027 driver (CVE-2023-28328)
• kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)
• kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)
• kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203)
• kernel: saa7134: race condition leading to use-after-free in saa7134_finidev (CVE-2023-35823)
• kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c (CVE-2023-35824)
• kernel: r592: race condition leading to use-after-free in r592_remove (CVE-2023-35825)
• kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)
• kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)
• kernel: Use after free bug in r592_remove (CVE-2023-3141)
• kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• Jammy update: v5.15.86 upstream stable release (LP: #2005113) // CVE-url: https://ubuntu.com/security/CVE-2022-3606
  • libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
• Jammy update: v5.15.87 upstream stable release (LP: #2007441) // CVE-url: https://ubuntu.com/security/CVE-2023-23454
  • net: sched: cbq: dont intepret cls results when asked to drop
• Jammy update: v5.15.76 upstream stable release (LP: #1997113) // CVE-url: https://ubuntu.com/security/CVE-2023-0590
  • net: sched: fix race condition in qdisc_graft()
• Jammy update: v5.15.91 upstream stable release (LP: #2011467) // CVE-url: https://ubuntu.com/security/CVE-2022-4129
  • l2tp: Serialize access to sk_user_data with sk_callback_lock
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-30772
  • power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-2194
  • i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
• CVE-2023-31084 // CVE-2023-31084 was assigned to this bug. // CVE-url: https://ubuntu.com/security/CVE-2023-31084
  • media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-2985
  • fs: hfsplus: fix UAF issue in hfsplus_put_super
• Jammy update: v5.15.111 upstream stable release (LP: #2025095) // CVE-url: https://ubuntu.com/security/CVE-2023-2269
  • dm ioctl: fix nested locking in table_clear() to remove deadlock concern

• Jammy update: v5.15.86 upstream stable release (LP: #2005113) // CVE-url: https://ubuntu.com/security/CVE-2022-3606
  • libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
• Jammy update: v5.15.87 upstream stable release (LP: #2007441) // CVE-url: https://ubuntu.com/security/CVE-2023-23454
  • net: sched: cbq: dont intepret cls results when asked to drop
• Jammy update: v5.15.76 upstream stable release (LP: #1997113) // CVE-url: https://ubuntu.com/security/CVE-2023-0590
  • net: sched: fix race condition in qdisc_graft()
• Jammy update: v5.15.91 upstream stable release (LP: #2011467) // CVE-url: https://ubuntu.com/security/CVE-2022-4129
  • l2tp: Serialize access to sk_user_data with sk_callback_lock
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-30772
  • power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-2194
  • i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
• CVE-2023-31084 // CVE-2023-31084 was assigned to this bug. // CVE-url: https://ubuntu.com/security/CVE-2023-31084
  • media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-2985
  • fs: hfsplus: fix UAF issue in hfsplus_put_super
• Jammy update: v5.15.111 upstream stable release (LP: #2025095) // CVE-url: https://ubuntu.com/security/CVE-2023-2269
  • dm ioctl: fix nested locking in table_clear() to remove deadlock concern

• Jammy update: v5.15.86 upstream stable release (LP: #2005113) // CVE-url: https://ubuntu.com/security/CVE-2022-3606
  • libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
• Jammy update: v5.15.87 upstream stable release (LP: #2007441) // CVE-url: https://ubuntu.com/security/CVE-2023-23454
  • net: sched: cbq: dont intepret cls results when asked to drop
• Jammy update: v5.15.76 upstream stable release (LP: #1997113) // CVE-url: https://ubuntu.com/security/CVE-2023-0590
  • net: sched: fix race condition in qdisc_graft()
• Jammy update: v5.15.104 upstream stable release (LP: #2023225) // CVE-url: https://ubuntu.com/security/CVE-2023-1855
  • hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
• Jammy update: v5.15.91 upstream stable release (LP: #2011467) // CVE-url: https://ubuntu.com/security/CVE-2022-4129
  • l2tp: Serialize access to sk_user_data with sk_callback_lock
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-30772
  • power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-2194
  • i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-33203
  • net: qcom/emac: Fix use after free bug in emac_remove due to race condition
• CVE-2023-31084 // CVE-2023-31084 was assigned to this bug. // CVE-url: https://ubuntu.com/security/CVE-2023-31084
  • media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-2985
  • fs: hfsplus: fix UAF issue in hfsplus_put_super
• Jammy update: v5.15.111 upstream stable release (LP: #2025095) // CVE-url: https://ubuntu.com/security/CVE-2023-2269
  • dm ioctl: fix nested locking in table_clear() to remove deadlock concern

• Jammy update: v5.15.86 upstream stable release (LP: #2005113) // CVE-url: https://ubuntu.com/security/CVE-2022-3606
  • libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
• Jammy update: v5.15.87 upstream stable release (LP: #2007441) // CVE-url: https://ubuntu.com/security/CVE-2023-23454
  • net: sched: cbq: dont intepret cls results when asked to drop
• Jammy update: v5.15.76 upstream stable release (LP: #1997113) // CVE-url: https://ubuntu.com/security/CVE-2023-0590
  • net: sched: fix race condition in qdisc_graft()
• Jammy update: v5.15.104 upstream stable release (LP: #2023225) // CVE-url: https://ubuntu.com/security/CVE-2023-1855
  • hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
• Jammy update: v5.15.91 upstream stable release (LP: #2011467) // CVE-url: https://ubuntu.com/security/CVE-2022-4129
  • l2tp: Serialize access to sk_user_data with sk_callback_lock
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-30772
  • power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-2194
  • i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-33203
  • net: qcom/emac: Fix use after free bug in emac_remove due to race condition
• CVE-2023-31084 // CVE-2023-31084 was assigned to this bug. // CVE-url: https://ubuntu.com/security/CVE-2023-31084
  • media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-2985
  • fs: hfsplus: fix UAF issue in hfsplus_put_super
• Jammy update: v5.15.111 upstream stable release (LP: #2025095) // CVE-url: https://ubuntu.com/security/CVE-2023-2269
  • dm ioctl: fix nested locking in table_clear() to remove deadlock concern

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23454: Fixed denial or service in cbq_classify in net/sched/sch_cbq.c (bnc#1207036).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0266: Fixed a use-after-free vulnerability inside the ALSA PCM package. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 was missing locks that could have been used in a use-after-free that could have resulted in a priviledge escalation to gain ring0 access from the system user (bsc#1207134).
• CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bnc#1207050).
• CVE-2022-4382: Fixed a use-after-free flaw that was caused by a race condition among the superblock operations inside the gadgetfs code (bsc#1206258).
• CVE-2020-24588: Fixed injection of arbitrary network packets against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n) (bsc#1199701).

The following non-security bugs were fixed:

• ACPI: EC: Fix EC address space handler unregistration (bsc#1207149).
• ACPI: EC: Fix ECDT probe ordering issues (bsc#1207149).
• ACPI: PRM: Check whether EFI runtime is available (git-fixes).
• ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps (bsc#1207149).
• ACPICA: include/acpi/acpixf.h: Fix indentation (bsc#1207149).
• ALSA: control-led: use strscpy in set_led_id() (git-fixes).
• ALSA: hda - Enable headset mic on another Dell laptop with ALC3254 (git-fixes).
• ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list (git-fixes).
• ALSA: hda/realtek - Turn on power early (git-fixes).
• ALSA: hda/realtek: Add Acer Predator PH315-54 (git-fixes).
• ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs do not work for a HP platform (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs, speaker do not work for a HP platform (git-fixes).
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() (git-fixes).
• ALSA: hda: cs35l41: Check runtime suspend capability at runtime_idle (git-fixes).
• ALSA: hda: cs35l41: Do not return -EINVAL from system suspend/resume (git-fixes).
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (git-fixes).
• ALSA: usb-audio: Make sure to stop endpoints before closing EPs (git-fixes).
• ALSA: usb-audio: Relax hw constraints for implicit fb sync (git-fixes).
• ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60 (git-fixes).
• ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' (git-fixes).
• ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency' (git-fixes).
• ARM: dts: imx7d-pico: Use 'clock-frequency' (git-fixes).
• ARM: dts: imx: Fix pca9547 i2c-mux node name (git-fixes).
• ARM: dts: vf610: Fix pca9548 i2c-mux node names (git-fixes).
• ARM: imx: add missing of_node_put() (git-fixes).
• ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use (git-fixes).
• ASoC: Intel: bytcr_wm5102: Drop reference count of ACPI device after use (git-fixes).
• ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets (git-fixes).
• ASoC: fsl_micfil: Correct the number of steps on SX controls (git-fixes).
• ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC (git-fixes).
• ASoC: qcom: lpass-cpu: Fix fallback SD line index handling (git-fixes).
• ASoC: wm8904: fix wrong outputs…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36280: Fixed an out-of-bounds memory access in vmwgfx driver causing denial of service (bsc#1203332).
• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bsc#1207237).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0266: Fixed use-after-free in SNDRV that could have resulted in a priviledge escalation (bsc#1207134).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).

The following non-security bugs were fixed:

• Added support for enabling livepatching related packages on -RT (jsc#PED-1706).
• Added suse-kernel-rpm-scriptlets to kmp buildreqs (boo#1205149).
• Reverted 'scsi: smartpqi: set force_blk_mq=1.(bsc#1205397)'.
• amiflop: clean up on errors during setup (git-fixes).
• audit: ensure userspace is penalized the same as the kernel when under pressure (bsc#1204514).
• audit: improve robustness of the audit queue handling (bsc#1204514).
• bcache: fix super block seq numbers comparision in register_cache_set() (git-fixes).
• blk-cgroup: Fix memleak on error path (git-fixes).
• blk-cgroup: Pre-allocate tree node on blkg_conf_prep (git-fixes).
• blk-cgroup: fix missing put device in error path from blkg_conf_pref() (git-fixes).
• blk-mq: fix possible memleak when register 'hctx' failed (git-fixes).
• blk-mq: insert request not through ->queue_rq into sw/scheduler queue (git-fixes).
• blk-mq: move cancel of requeue_work into blk_mq_release (git-fixes).
• blk-throttle: fix UAF by deleteing timer in blk_throtl_exit() (git-fixes).
• blktrace: Fix output non-blktrace event when blk_classic option enabled (git-fixes).
• blktrace: break out of blktrace setup on concurrent calls (git-fixes).
• blktrace: ensure our debugfs dir exists (git-fixes).
• blktrace: fix endianness for blk_log_remap() (git-fixes).
• blktrace: fix endianness in get_pdu_int() (git-fixes).
• blktrace: use errno instead of bi_status (git-fixes).
• block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() (bsc#1175995,jsc#SLE-15608).
• block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() (git-fixes).
• block, bfq: increase idling for weight-raised queues (git-fixes).
• block, bfq: protect 'bfqd->queued' by 'bfqd->lock' (bsc#1207102).
• block, bfq: protect 'bfqd->queued' by 'bfqd->lock' (git-fixes).
• block/bio-integrity: do not free 'buf' if bio_integrity_add_page() failed (git-fixes).
• block/bio-integrity: fix a memory leak bug (git-fixes).
• block/swim: Check drive type (git-fixes).
• block/swim: Do not log an error message for an invalid ioctl (git-fixes).
• block/swim: Fix IO error at end of medium (git-fixes).
• block/swim: Rename macros to avoid inconsistent inverted logic (git-fixes).
• block/swim: Select appropriate drive on device open (git-fixes).
• block: Fix use-after-free issue accessing struct io_cq (git-fixes).
• block: add a lower-level bio_add_page interface (git-fixes).
• block: fix memleak when __blk_rq_map_user_iov() is failed (git-fixes).
• block: only update parent bi_status when bio fail (git-fixes).
• block: sed-opal: fix IOC_OPAL_ENABLE_DISABLE_MBR (git-fixes).
• brd: check and limit max_part par (git-fixes).
• ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty (bsc#1207195).
• compat_ioctl: block: handle BLKGETZONESZ/BLKGETNRZONES (git-fixes).
• constraints: increase disk space for all architectures (bsc#1203693)
• cryptoloop: add a deprecation warning (git-fixes).
• dm bio record: save/restore bi_end_io and bi_integrity (git-fixes).
• dm btree: add a defensive bounds check to insert_at() (git-fixes).
• dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort (git-fixes).
• dm cache: Fix UAF in destroy() (git-fixes).
• dm cache: set needs_check flag after…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36280: Fixed an out-of-bounds memory access vulnerability that was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c (bnc#1203332).
• CVE-2023-0045: Fixed flush IBP in ib_prctl_set() (bsc#1207773).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bnc#1207050).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23454: Fixed denial or service in cbq_classify in net/sched/sch_cbq.c (bnc#1207036).
• CVE-2020-24588: Fixed injection of arbitrary network packets against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n) (bsc#1199701).
• CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
• CVE-2022-4382: Fixed a use-after-free flaw that was caused by a race condition among the superblock operations inside the gadgetfs code (bsc#1206258).
• CVE-2023-0266: Fixed a use-after-free vulnerability inside the ALSA PCM package. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 was missing locks that could have been used in a use-after-free that could have resulted in a priviledge escalation to gain ring0 access from the system user (bsc#1207134).
• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bnc#1207237).

The following non-security bugs were fixed:

• ACPI: EC: Fix EC address space handler unregistration (bsc#1207149).
• ACPI: EC: Fix ECDT probe ordering issues (bsc#1207149).
• ACPI: PM: s2idle: Add support for upcoming AMD uPEP HID AMDI008 (bsc#1206224).
• ACPI: PM: s2idle: Use LPS0 idle if ACPI_FADT_LOW_POWER_S0 is unset (bsc#1206224).
• ACPI: PRM: Check whether EFI runtime is available (git-fixes).
• ACPI: x86: s2idle: Add a quirk for ASUS ROG Zephyrus G14 (bsc#1206224).
• ACPI: x86: s2idle: Add a quirk for ASUS TUF Gaming A17 FA707RE (bsc#1206224).
• ACPI: x86: s2idle: Add a quirk for ASUSTeK COMPUTER INC. ROG Flow X13 (bsc#1206224).
• ACPI: x86: s2idle: Add a quirk for Lenovo Slim 7 Pro 14ARH7 (bsc#1206224).
• ACPI: x86: s2idle: Add another ID to s2idle_dmi_table (bsc#1206224).
• ACPI: x86: s2idle: Add module parameter to prefer Microsoft GUID (bsc#1206224).
• ACPI: x86: s2idle: Fix a NULL pointer dereference (bsc#1206224).
• ACPI: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865 (bsc#1206224).
• ACPI: x86: s2idle: If a new AMD _HID is missing assume Rembrandt (bsc#1206224).
• ACPI: x86: s2idle: Move _HID handling for AMD systems into structures (bsc#1206224).
• ACPI: x86: s2idle: Stop using AMD specific codepath for Rembrandt+ (bsc#1206224).
• ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps (bsc#1207149).
• ACPICA: include/acpi/acpixf.h: Fix indentation (bsc#1207149).
• ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() (git-fixes).
• ALSA: hda/realtek: Add Acer Predator PH315-54 (git-fixes).
• ALSA: hda/realtek: Add Positivo N14KP6-TG (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS UM3402 using CS35L41 (git-fixes).
• ALSA: hda/realtek: Enable mute/micmute LEDs on HP Elitebook, 645 G9 (git-fixes).
• ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs do not work for a HP platform (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs, speaker do not work for a HP platform (git-fixes).
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() (git-fixes).
• ALSA: pci: lx6464es: fix a debug loop (git-fixes). -…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-23454: Fixed denial or service in cbq_classify in net/sched/sch_cbq.c (bnc#1207036).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2023-0266: Fixed a use-after-free vulnerability inside the ALSA PCM package. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 was missing locks that could have been used in a use-after-free that could have resulted in a priviledge escalation to gain ring0 access from the system user (bsc#1207134).
• CVE-2023-0045: Fixed flush IBP in ib_prctl_set() (bsc#1207773).
• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bnc#1207237).
• CVE-2022-4662: Fixed incorrect access control in the USB core subsystem that could lead a local user to crash the system (bnc#1206664).
• CVE-2022-36280: Fixed an out-of-bounds memory access vulnerability that was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c (bnc#1203332).
• CVE-2022-3564: Fixed use-after-free in l2cap_core.c of the Bluetooth component (bnc#1206073).
• CVE-2022-3108: Fixed missing check of return value of kmemdup() (bnc#1206389).
• CVE-2022-3107: Fixed missing check of return value of kvmalloc_array() (bnc#1206395).

The following non-security bugs were fixed:

• Bluetooth: hci_qca: Fix the teardown problem for real (git-fixes).
• CDC-NCM: remove 'connected' log message (git-fixes).
• HID: betop: check shape of output reports (git-fixes, bsc#1207186).
• HID: betop: fix slab-out-of-bounds Write in betop_probe (git-fixes, bsc#1207186).
• HID: check empty report_list in hid_validate_values() (git-fixes, bsc#1206784).
• Input: convert autorepeat timer to use timer_setup() (git-fixes).
• Input: do not use WARN() in input_alloc_absinfo() (git-fixes).
• Input: i8042 - Add quirk for Fujitsu Lifebook T725 (git-fixes).
• Input: iforce - reformat the packet dump output (git-fixes).
• Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag (git-fixes).
• Input: replace hard coded string with func in pr_err() (git-fixes).
• Input: switch to using sizeof(*type) when allocating memory (git-fixes).
• Input: use seq_putc() in input_seq_print_bitmap() (git-fixes).
• Input: use seq_puts() in input_devices_seq_show() (git-fixes).
• Makefile: link with -z noexecstack --no-warn-rwx-segments (bsc#1203200).
• NFS Handle missing attributes in OPEN reply (bsc#1203740).
• NFS: Correct size calculation for create reply length (git-fixes).
• NFS: Fix an Oops in nfs_d_automount() (git-fixes).
• NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup (git-fixes).
• NFS: Fix memory leaks in nfs_pageio_stop_mirroring() (git-fixes).
• NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails (git-fixes).
• NFS: nfs_compare_mount_options always compare auth flavors (git-fixes).
• NFS: nfs_find_open_context() may only select open files (git-fixes).
• NFS: swap IO handling is slightly different for O_DIRECT IO (git-fixes).
• NFS: swap-out must always use STABLE writes (git-fixes).
• NFSD: Keep existing listeners on portlist error (git-fixes).
• NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data (git-fixes).
• NFSv2: Fix eof handling (git-fixes).
• NFSv2: Fix write regression (git-fixes).
• NFSv4 expose nfs_parse_server_name function (git-fixes).
• NFSv4 only print the label when its queried (git-fixes).
• NFSv4 remove zero number of fs_locations entries error check (git-fixes).
• NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation recall (git-fixes).
• NFSv4.1: Fix uninitialised variable in devicenotify (git-fixes).
• NFSv4.1: Handle RECLAIM_COMPLETE trunking errors (git-fixes).
• NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot (git-fixes). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bsc#1194535).
• CVE-2017-5754: Fixed speculative side channel attacks on various CPU platforms (bsc#1068032).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2022-4662: Fixed incorrect access control in the USB core subsystem that could lead a local user to crash the system (bsc#1206664).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2022-2991: Fixed an heap-based overflow in the lightnvm implemenation (bsc#1201420).
• CVE-2023-0266: Fixed a use-after-free vulnerability inside the ALSA PCM package. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 was missing locks that could have been used in a use-after-free that could have resulted in a priviledge escalation to gain ring0 access from the system user (bsc#1207134).
• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bsc#1207237).

The following non-security bugs were fixed:

• add 00f3ca2c2d66 ('mm: memcontrol: per-lruvec stats infrastructure')
• add 0b3d6e6f2dd0 mm: writeback: use exact memcg dirty counts
• add 168e06f7937d kernel/hung_task.c: force console verbose before panic
• add 1f4aace60b0e ('fs/seq_file.c: simplify seq_file iteration code and interface')
• add 304ae42739b1 kernel/hung_task.c: break RCU locks based on jiffies
• add 401c636a0eeb kernel/hung_task.c: show all hung tasks before panic
• add Tegra repository to git_sort.
• add a1c6ca3c6de7 kernel: hung_task.c: disable on suspend
• add c3cc39118c36 mm: memcontrol: fix NR_WRITEBACK leak in memcg and system stats
• add c892fd82cc06 mm: memcg: add __GFP_NOWARN in __memcg_schedule_kmem_cache_create()
• add e27be240df53 mm: memcg: make sure memory.events is uptodate when waking pollers
• add support for enabling livepatching related packages on -RT (jsc#PED-1706)
• add suse-kernel-rpm-scriptlets to kmp buildreqs (boo#1205149)
• amiflop: clean up on errors during setup (git-fixes).
• audit: ensure userspace is penalized the same as the kernel when under pressure (bsc#1204514).
• audit: improve robustness of the audit queue handling (bsc#1204514).
• bcache: fix super block seq numbers comparision in register_cache_set() (git-fixes).
• blk-cgroup: Fix memleak on error path (git-fixes).
• blk-cgroup: Pre-allocate tree node on blkg_conf_prep (git-fixes).
• blk-cgroup: fix missing put device in error path from blkg_conf_pref() (git-fixes).
• blk-mq: fix possible memleak when register 'hctx' failed (git-fixes).
• blk-mq: insert request not through ->queue_rq into sw/scheduler queue (git-fixes).
• blk-mq: move cancel of requeue_work into blk_mq_release (git-fixes).
• blktrace: Fix output non-blktrace event when blk_classic option enabled (git-fixes).
• blktrace: break out of blktrace setup on concurrent calls (git-fixes).
• blktrace: ensure our debugfs dir exists (git-fixes).
• blktrace: fix endianness for blk_log_remap() (git-fixes).
• blktrace: fix endianness in get_pdu_int() (git-fixes).
• blktrace: use errno instead of bi_status (git-fixes).
• block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() (bsc#1175995,jsc#SLE-15608).
• block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() (git-fixes).
• block, bfq: increase idling for weight-raised queues (git-fixes).
• block, bfq: protect 'bfqd->queued' by 'bfqd->lock' (bsc#1207102).
• block, bfq: protect 'bfqd->queued' by 'bfqd->lock' (git-fixes).
• block/bio-integrity: do not free 'buf' if bio_integrity_add_page() failed (git-fixes).
• block/bio-integrity: fix a memory leak bug (git-fixes).
• block/swim: Check drive type (git-fixes).
• block/swim: Do not log an…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bsc#1194535).
• CVE-2022-2991: Fixed an heap-based overflow in the lightnvm implemenation (bsc#1201420).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. (bsc#1205711)
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed a lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).

The following non-security bugs were fixed:

• kabi/severities: add l2tp local symbols
• module: Do not wait for GOING modules (bsc#1196058, bsc#1186449, bsc#1204356, bsc#1204662).
• net: mana: Fix IRQ name - add PCI and queue number (bsc#1207875).

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

• CVE-2022-3523: Fixed use after free related to device private page handling (bsc#1204363).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-22995: Fixed lacks of certain platform_device_put and kfree in drivers/usb/dwc3/dwc3-qcom.c (bsc#1208741).
• CVE-2023-22998: Fixed misinterpretatino of the irtio_gpu_object_shmem_init() return value (bsc#1208776).
• CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function (bsc#1208816).
• CVE-2023-23004: Fixed misinterpretatino of the get_sg_table return value in arm/malidp_planes.c (bsc#1208843).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).

The following non-security bugs were fixed:

• acpi / x86: Add support for LPS0 callback handler (git-fixes).
• acpi: NFIT: fix a potential deadlock during NFIT teardown (git-fixes).
• acpi: PM: s2idle: Add support for upcoming AMD uPEP HID AMDI008 (bsc#1206224).
• acpi: PM: s2idle: Use LPS0 idle if ACPI_FADT_LOW_POWER_S0 is unset (bsc#1206224).
• acpi: battery: Fix missing NUL-termination with large strings (git-fixes).
• acpi: x86: s2idle: Add a quirk for ASUS ROG Zephyrus G14 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUS TUF Gaming A17 FA707RE (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUSTeK COMPUTER INC. ROG Flow X13 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for Lenovo Slim 7 Pro 14ARH7 (bsc#1206224).
• acpi: x86: s2idle: Add another ID to s2idle_dmi_table (bsc#1206224).
• acpi: x86: s2idle: Add module parameter to prefer Microsoft GUID (bsc#1206224).
• acpi: x86: s2idle: Fix a NULL pointer dereference (bsc#1206224).
• acpi: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865 (bsc#1206224).
• acpi: x86: s2idle: If a new AMD _HID is missing assume Rembrandt (bsc#1206224).
• acpi: x86: s2idle: Move _HID handling for AMD systems into structures (bsc#1206224).
• acpi: x86: s2idle: Stop using AMD specific codepath for Rembrandt+ (bsc#1206224).
• acpica: Drop port I/O validation for some regions (git-fixes).
• acpica: nsrepair: handle cases without a return value correctly (git-fixes).
• alsa: emux: Avoid potential array out-of-bound in snd_emux_xg_control() (git-fixes).
• alsa: hda/ca0132: minor fix for allocation size (git-fixes).
• alsa: hda/conexant: add a new hda codec SN6180 (git-fixes).
• alsa: hda/realtek - fixed wrong gpio assigned (git-fixes).
• alsa: hda/realtek: Add Positivo N14KP6-TG (git-fixes).
• alsa: hda/realtek: Add quirk for ASUS UM3402 using CS35L41 (git-fixes).
• alsa: hda/realtek: Enable mute/micmute LEDs on HP Elitebook, 645 G9 (git-fixes).
• alsa: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360 (git-fixes).
• alsa: hda/realtek: fix mute/micmute LEDs…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-22995: Fixed lacks of certain platform_device_put and kfree in drivers/usb/dwc3/dwc3-qcom.c (bsc#1208741).
• CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function phy/tegra (bsc#1208816).
• CVE-2023-23006: Fixed NULL vs IS_ERR checking in dr_domain_init_resources (bsc#120884).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).

The following non-security bugs were fixed:

• cifs: fix use-after-free caused by invalid pointer hostname (bsc#1208971).
• genirq: Provide new interfaces for affinity hints (bsc#1208153).
• mm/slub: fix panic in slab_alloc_node() (bsc#1208023).
• module: Do not wait for GOING modules (bsc#1196058, bsc#1186449, bsc#1204356, bsc#1204662).
• net: mana: Assign interrupts to CPUs based on NUMA nodes (bsc#1208153).
• net: mana: Fix IRQ name - add PCI and queue number (bsc#1207875).
• net: mana: Fix accessing freed irq affinity_hint (bsc#1208153).
• nfsd: fix use-after-free due to delegation race (bsc#1208813).
• rdma/core: Fix ib block iterator counter overflow (bsc#1207878).
• vmxnet3: move rss code block under eop descriptor (bsc#1208212).

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3606: Fixed a null pointer dereference inside the function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF (bsc#1204502).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2022-47929: Fixed a NULL pointer dereference bug in the traffic control subsystem (bsc#1207237).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
• CVE-2023-0266: Fixed a use-after-free vulnerability inside the ALSA PCM package. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 was missing locks that could have been used in a use-after-free that could have resulted in a priviledge escalation to gain ring0 access from the system user (bsc#1207134).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1076: Fixed incorrect initialization of socket ui in tap_open() (bsc#1208599).
• CVE-2023-1095: Fixed fix null deref due to zeroed list head in nf_tables (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-1195: Fixed a use-after-free caused by invalid pointer hostname in cifs (bsc#1208971).
• CVE-2023-22995: Fixed lacks of certain platform_device_put and kfree in drivers/usb/dwc3/dwc3-qcom.c (bsc#1208741).
• CVE-2023-22998: Fixed NULL vs IS_ERR checking in virtio_gpu_object_shmem_init (bsc#1208776).
• CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function phy/tegra (bsc#1208816).
• CVE-2023-23004: Fixed NULL vs IS_ERR() checking in malidp (bsc#1208843).
• CVE-2023-23006: Fixed NULL vs IS_ERR checking in dr_domain_init_resources (bsc#1208845).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-25012: Fixed a use-after-eree in bigben_set_led() in hid (bsc#1207560).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).

The following non-security bugs were fixed:

• add support for enabling livepatching related packages on -RT (jsc#PED-1706)
• add suse-kernel-rpm-scriptlets to kmp buildreqs (boo#1205149)
• bcache: fix set_at_max_writeback_rate() for multiple attached devices (git-fixes).
• blktrace: Fix output non-blktrace event when blk_classic option enabled (git-fixes).
• blktrace: ensure our debugfs dir exists (git-fixes).
• ceph: avoid putting the realm twice when decoding snaps fails (bsc#1207198).
• ceph: do not update snapshot context when there is no new snapshot (bsc#1207218).
• config.conf: Drop armv7l, Leap 15.3 is EOL.
• constraints: increase disk space for all architectures References: bsc#1203693 aarch64 is already suffering. SLE15-SP5 x86_64 stats show that it is very close to the limit.
• delete config/armv7hl/default.
• delete config/armv7hl/lpae.
• dm btree: add a defensive bounds check to insert_at() (git-fixes).
• dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort (git-fixes).
• dm cache: Fix UAF in destroy() (git-fixes).
• dm cache: set needs_check flag after aborting metadata (git-fixes).
• dm clone: Fix UAF in clone_dtr() (git-fixes).
• dm integrity: Fix UAF in dm_integrity_dtr() (git-fixes).
• dm integrity: fix flush with external metadata device (git-fixes).
• dm integrity: flush the journal on suspend (git-fixes).
• dm integrity: select CRYPTO_SKCIPHER (git-fixes).
• dm ioctl: fix misbehavior if list_versions races with module loading (git-fixes).
• dm ioctl: prevent potential spectre v1 gadget (git-fixes).
• dm space map common: add bounds check to sm_ll_lookup_bitmap()…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-22995: Fixed lacks of certain platform_device_put and kfree in drivers/usb/dwc3/dwc3-qcom.c (bsc#1208741).
• CVE-2023-22998: Fixed NULL vs IS_ERR checking in virtio_gpu_object_shmem_init (bsc#1208776).
• CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function phy/tegra (bsc#1208816).
• CVE-2023-23006: Fixed NULL vs IS_ERR checking in dr_domain_init_resources (bsc#1208845).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).

The following non-security bugs were fixed:

• cifs: fix use-after-free caused by invalid pointer hostname (bsc#1208971).
• genirq: Provide new interfaces for affinity hints (bsc#1208153).
• mm/slub: fix panic in slab_alloc_node() (bsc#1208023).
• module: Do not wait for GOING modules (bsc#1196058, bsc#1186449, bsc#1204356, bsc#1204662).
• net: mana: Assign interrupts to CPUs based on NUMA nodes (bsc#1208153).
• net: mana: Fix IRQ name - add PCI and queue number (bsc#1207875).
• net: mana: Fix accessing freed irq affinity_hint (bsc#1208153).
• refresh patches.kabi/scsi-kABI-fix-for-eh_should_retry_cmd (bsc#1206351). The former kABI fix only move the newly added member to scsi_host_template to the end of the struct. But that is usually allocated statically, even by 3rd party modules relying on kABI. Before we use the member we need to signalize that it is to be expected. As we only expect it to be allocated by in-tree modules that we can control, we can use a space in the bitfield to signalize that.
• s390/kexec: fix ipl report address for kdump (bsc#1207575).
• scsi: qla2xxx: Add option to disable FC2 Target support (bsc#1198438 bsc#1206103).
• update suse/net-mlx5-Allocate-individual-capability (bsc#1195175).
• update suse/net-mlx5-Dynamically-resize-flow-counters-query-buff (bsc#1195175).
• update suse/net-mlx5-Fix-flow-counters-SF-bulk-query-len (bsc#1195175).
• update suse/net-mlx5-Reduce-flow-counters-bulk-query-buffer-size (bsc#1195175).
• update suse/net-mlx5-Reorganize-current-and-maximal-capabilities (bsc#1195175).
• update suse/net-mlx5-Use-order-0-allocations-for-EQs (bsc#1195175). Fixed bugzilla reference.
• vmxnet3: move rss code block under eop descriptor (bsc#1208212).

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. (bsc#1205711)
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bsc#1194535).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2022-2991: Fixed an heap-based overflow in the lightnvm implemenation (bsc#1201420).

The following non-security bugs were fixed:

• kabi/severities: add l2tp local symbols

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

• CVE-2022-3523: Fixed use after free related to device private page handling (bsc#1204363).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-22995: Fixed lacks of certain platform_device_put and kfree in drivers/usb/dwc3/dwc3-qcom.c (bsc#1208741).
• CVE-2023-22998: Fixed misinterpretatino of the irtio_gpu_object_shmem_init() return value (bsc#1208776).
• CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function (bsc#1208816).
• CVE-2023-23001: Fixed misinterpretion of the regulator_get return value (bsc# 1208829).
• CVE-2023-23004: Fixed misinterpretatino of the get_sg_table return value in arm/malidp_planes.c (bsc#1208843).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).

The following non-security bugs were fixed:

• NFSv4.1 provide mount option to toggle trunking discovery (git-fixes).
• acpi / x86: Add support for LPS0 callback handler (git-fixes).
• acpi: Do not build ACPICA with '-Os' (git-fixes).
• acpi: NFIT: fix a potential deadlock during NFIT teardown (git-fixes).
• acpi: PM: s2idle: Add support for upcoming AMD uPEP HID AMDI008 (bsc#1206224).
• acpi: PM: s2idle: Use LPS0 idle if ACPI_FADT_LOW_POWER_S0 is unset (bsc#1206224).
• acpi: battery: Fix missing NUL-termination with large strings (git-fixes).
• acpi: resource: Add helper function acpi_dev_get_memory_resources() (git-fixes).
• acpi: video: Fix Lenovo Ideapad Z570 DMI match (git-fixes).
• acpi: x86: s2idle: Add a quirk for ASUS ROG Zephyrus G14 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUS TUF Gaming A17 FA707RE (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUSTeK COMPUTER INC. ROG Flow X13 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for Lenovo Slim 7 Pro 14ARH7 (bsc#1206224).
• acpi: x86: s2idle: Add another ID to s2idle_dmi_table (bsc#1206224).
• acpi: x86: s2idle: Add module parameter to prefer Microsoft GUID (bsc#1206224).
• acpi: x86: s2idle: Fix a NULL pointer dereference (bsc#1206224).
• acpi: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865 (bsc#1206224).
• acpi: x86: s2idle: If a new AMD _HID is missing assume Rembrandt (bsc#1206224).
• acpi: x86: s2idle: Move…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• ARM: 8702/1: head-common.S: Clear lr before jumping to start_kernel() (git-fixes)
• Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (git-fixes).
• Bluetooth: btusb: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).
• Input: atmel_mxt_ts - fix double free in mxt_read_info_block (git-fixes).
• KVM: arm64: Hide system instruction access to Trace registers (git-fixes)
• NFSv4: Fix hangs when recovering open state after a server reboot (git-fixes).
• PCI/MSI: Enforce MSI entry updates to be visible (git-fixes).
• PCI/MSI: Enforce that MSI-X table entry is masked for update (git-fixes).
• PCI/MSI: Mask all unused MSI-X entries (git-fixes).
• PCI/MSI: Skip masking MSI-X on Xen PV (git-fixes).
• PCI/PM: Always return devices to D0 when thawing (git-fixes).
• PCI/PM: Avoid using device_may_wakeup() for runtime PM (git-fixes).
• PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints (git-fixes).
• PCI: Add ACS quirk for iProc PAXB (git-fixes).
• PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0 (git-fixes).
• PCI: Avoid FLR for AMD Starship USB 3.0 (git-fixes).
• PCI: Make ACS quirk implementations more uniform (git-fixes).
• PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently (git-fixes).
• PCI: PM: Avoid skipping bus-level PM on platforms without ACPI (git-fixes).
• PCI: Unify ACS quirk desired vs provided checking (git-fixes).
• PCI: Use pci_update_current_state() in pci_enable_device_flags() (git-fixes).
• PCI: aardvark: Do not blindly enable ASPM L0s and do not write to read-only register (git-fixes).
• PCI: aardvark: Do not rely on jiffies while holding spinlock (git-fixes).
• PCI: aardvark: Do not touch PCIe registers if no card connected (git-fixes).
• PCI: aardvark: Fix a leaked reference by adding missing of_node_put() (git-fixes).
• PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes).
• PCI: aardvark: Fix kernel panic during PIO transfer (git-fixes).
• PCI: aardvark: Improve link training (git-fixes).
• PCI: aardvark: Indicate error in 'val' when config read fails (git-fixes).
• PCI: aardvark: Introduce an…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (git-fixes).
• Bluetooth: btusb: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).
• Do not sign the vanilla kernel (bsc#1209008).
• Input: atmel_mxt_ts - fix double free in mxt_read_info_block (git-fixes).
• KVM: arm64: Hide system instruction access to Trace registers (git-fixes)
• NFSv4: Fix hangs when recovering open state after a server reboot (git-fixes). [iivanov] Fix Patch-mainline to v6.3-rc5
• PCI/MSI: Enforce MSI entry updates to be visible (git-fixes).
• PCI/MSI: Enforce that MSI-X table entry is masked for update (git-fixes).
• PCI/MSI: Mask all unused MSI-X entries (git-fixes).
• PCI/MSI: Skip masking MSI-X on Xen PV (git-fixes).
• PCI/PM: Always return devices to D0 when thawing (git-fixes).
• PCI/PM: Avoid using device_may_wakeup() for runtime PM (git-fixes).
• PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints (git-fixes).
• PCI: Add ACS quirk for iProc PAXB (git-fixes).
• PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0 (git-fixes).
• PCI: Avoid FLR for AMD Starship USB 3.0 (git-fixes).
• PCI: Make ACS quirk implementations more uniform (git-fixes).
• PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently (git-fixes).
• PCI: PM: Avoid skipping bus-level PM on platforms without ACPI (git-fixes).
• PCI: Unify ACS quirk desired vs provided checking (git-fixes).
• PCI: Use pci_update_current_state() in pci_enable_device_flags() (git-fixes).
• PCI: aardvark: Do not blindly enable ASPM L0s and do not write to read-only register (git-fixes).
• PCI: aardvark: Do not rely on jiffies while holding spinlock (git-fixes).
• PCI: aardvark: Do not touch PCIe registers if no card connected (git-fixes).
• PCI: aardvark: Fix a leaked reference by adding missing of_node_put() (git-fixes).
• PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes).
• PCI: aardvark: Fix kernel panic during PIO transfer (git-fixes).
• PCI: aardvark: Improve link training (git-fixes).
• PCI: aardvark: Indicate error in 'val' when config read fails (git-fixes).
• PCI: aardvark: Introduce an…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bsc#1194535).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• Do not sign the vanilla kernel (bsc#1209008).
• PCI: hv: Add a per-bus mutex state_lock (bsc#1208811).
• PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1208811).
• PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (bsc#1208811).
• PCI: hv: fix a race condition bug in hv_pci_query_relations() (bsc#1208811).
• Revert 'PCI: hv: Fix a timing issue which causes kdump to fail occasionally' (bsc#1208811).
• cifs: fix double free in dfs mounts (bsc#1209845).
• cifs: fix nodfs mount option (bsc#1209845).
• cifs: handle reconnect of tcon when there is no cached dfs referral (bsc#1209845).
• cifs: missing null pointer check in cifs_mount (bsc#1209845).
• cifs: serialize all mount attempts (bsc#1209845).
• cred: allow get_cred() and put_cred() to be given NULL (bsc#1209887).
• ibmvnic: Process crqs after enabling interrupts (bsc#1192273 ltc#194629).
• ibmvnic: do not stop queue in xmit (bsc#1192273 ltc#194629).
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (bsc#1207168).
• kernel-module-subpackage: Fix expansion with -b parameter (bsc#1208179).

This update for the Linux Kernel 4.12.14-95_102 fixes several issues.

The following security issues were fixed:

• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2022-2991: Fixed an heap-based overflow in the lightnvm implemenation (bsc#1201420).

This update for the Linux Kernel 4.12.14-122_121 fixes several issues.

The following security issues were fixed:

• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2022-2991: Fixed an heap-based overflow in the lightnvm implemenation (bsc#1201420).

This update for the Linux Kernel 5.14.21-150400_15_5 fixes several issues.

The following security issues were fixed:

• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1652: Fixed use-after-free that could lead to DoS and information leak in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c (bsc#1209788).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).

This update for the Linux Kernel 4.12.14-150100_197_126 fixes several issues.

The following security issues were fixed:

• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).

This update for the Linux Kernel 5.3.18-150200_24_126 fixes several issues.

The following security issues were fixed:

• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2022-2991: Fixed an heap-based overflow in the lightnvm implemenation (bsc#1201420).

This update for the Linux Kernel 5.3.18-150300_59_87 fixes several issues.

The following security issues were fixed:

• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).

This update for the Linux Kernel 5.3.18-150200_24_115 fixes several issues.

The following security issues were fixed:

• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2022-2991: Fixed an heap-based overflow in the lightnvm implemenation (bsc#1201420).

This update for the Linux Kernel 5.3.18-150300_59_68 fixes several issues.

The following security issues were fixed:

• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).

This update for the Linux Kernel 4.12.14-150100_197_120 fixes several issues.

The following security issues were fixed:

• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2022-2991: Fixed an heap-based overflow in the lightnvm implemenation (bsc#1201420).

This update for the Linux Kernel 5.3.18-150300_59_112 fixes several issues.

The following security issues were fixed:

• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).

This update for the Linux Kernel 5.14.21-150400_24_38 fixes several issues.

The following security issues were fixed:

• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1652: Fixed use-after-free that could lead to DoS and information leak in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c (bsc#1209788).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).

This update for the Linux Kernel 5.14.21-150400_22 fixes several issues.

The following security issues were fixed:

• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1652: Fixed use-after-free that could lead to DoS and information leak in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c (bsc#1209788).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).

This update for the Linux Kernel 5.14.21-150400_24_18 fixes several issues.

The following security issues were fixed:

• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1652: Fixed use-after-free that could lead to DoS and information leak in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c (bsc#1209788).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).