CVE-2023-50756

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50347: mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() (bsc#1249928).
• CVE-2022-50580: blk-throttle: prevent overflow while calculating wait time (bsc#1252542).
• CVE-2022-50676: net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() (bsc#1254689).
• CVE-2022-50697: mrp: introduce active flags to prevent UAF when applicant uninit (bsc#1255594).
• CVE-2022-50709: wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() (bsc#1255565).
• CVE-2022-50716: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out (bsc#1255839).
• CVE-2022-50717: nvmet-tcp: add bounds check on Transfer Tag (bsc#1255844).
• CVE-2022-50719: ALSA: line6: fix stack overflow in line6_midi_transmit (bsc#1255939).
• CVE-2022-50740: wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() (bsc#1256155).
• CVE-2022-50744: scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs (bsc#1256165).
• CVE-2022-50749: acct: fix potential integer overflow in encode_comp_t() (bsc#1256191).
• CVE-2022-50751: configfs: fix possible memory leak in configfs_create_dir() (bsc#1256184).
• CVE-2022-50760: drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() (bsc#1255983).
• CVE-2022-50770: ocfs2: fix memory leak in ocfs2_mount_volume() (bsc#1256221).
• CVE-2022-50777: net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe (bsc#1256320).
• CVE-2022-50780: net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed (bsc#1256305).
• CVE-2022-50782: ext4: fix bug_on in __es_tree_search caused by bad quota inode (bsc#1256282).
• CVE-2022-50786: media: s5p-mfc: Clear workbit to handle error condition (bsc#1256258).
• CVE-2022-50816: ipv6: ensure sane device mtu in tunnels (bsc#1256038).
• CVE-2022-50834: nfc: Fix potential resource leaks (bsc#1256219).
• CVE-2022-50865: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (bsc#1256168).
• CVE-2022-50868: hwrng: amd - Fix PCI device refcount leak (bsc#1256386).
• CVE-2022-50880: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() (bsc#1256132).
• CVE-2022-50881: ath9k: Fix typo in function name (bsc#1256130).
• CVE-2022-50884: drm: Prevent drm_copy_field() to attempt copying a NULL pointer (bsc#1256127).
• CVE-2022-50885: RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed (bsc#1256122).
• CVE-2022-50887: regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() (bsc#1256125).
• CVE-2023-50756: nvme-pci: fix mempool alloc size (bsc#1256216).
• CVE-2023-53685: tun: Fix memory leak for detached NAPI queue (bsc#1251770).
• CVE-2023-53747: vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (bsc#1254572).
• CVE-2023-53751: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (bsc#1254986).
• CVE-2023-53825: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg() (bsc#1254707).
• CVE-2023-53853: netlink: annotate accesses to nlk->cb_running (bsc#1254673).
• CVE-2023-53863: netlink: do not hard code device address lenth in fdb dumps (bsc#1254657).
• CVE-2023-53992: wifi: cfg80211: ocb: don't leave if not joined (bsc#1256058).
• CVE-2023-54012: net: fix stack overflow when LRO is disabled for virtual interfaces (bsc#1255571).
• CVE-2023-54047: drm/rockchip: dw_hdmi: cleanup drm encoder during unbind (bsc#1256398).
• CVE-2023-54048: RDMA/bnxt_re: Prevent handling any completions after qp destroy (bsc#1256395).
• CVE-2023-54067: btrfs: fix race when deleting free space root from the dirty cow roots list (bsc#1256369).
• CVE-2023-54111: pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups (bsc#1256149).
• CVE-2023-54112: kcm: Fix memory leak in error path of kcm_sendmsg() (bsc#1256354).
• CVE-2023-54118: serial: sc16is7xx: setup GPIO controller later in probe (bsc#1256131).
• CVE-2023-54121: btrfs: fix incorrect splitting in btrfs_drop_extent_map_range (bsc#1256267).
• CVE-2023-54134: autofs: fix memory leak of waitqueues in autofs_catatonic_mode (bsc#1256106).
• CVE-2023-54198: tty: fix out-of-bounds access in tty_driver_lookup_tty() (bsc#1255970).
• CVE-2023-54202: drm/i915: fix race condition UAF in i915_perf_add_config_ioctl (bsc#1255880).
• CVE-2023-54207: HID: uclogic: Correct devm device reference for hidinput input_dev name (bsc#1255961).
• CVE-2023-54218: sock: Make sock->sk_stamp thread-safe (bsc#1256229).
• CVE-2023-54230: amba: bus: fix refcount leak (bsc#1255925).
• CVE-2023-54243: netfilter: ebtables: fix table blob use-after-free (bsc#1255908).
• CVE-2023-54265: ipv6: Fix an uninit variable access bug in __ip6_make_skb() (bsc#1255874).
• CVE-2023-54274: RDMA/srpt: Add a check for valid 'mad_agent' pointer (bsc#1255905).
• CVE-2023-54282: media: tuners: qt1010: replace BUG_ON with a regular error (bsc#1255810).
• CVE-2023-54287: tty: serial: imx: disable Ageing Timer interrupt request irq (bsc#1255804).
• CVE-2023-54311: ext4: fix deadlock when converting an inline directory in nojournal mode (bsc#1255773).
• CVE-2023-54321: driver core: fix potential null-ptr-deref in device_add() (bsc#1255762).
• CVE-2024-41007: tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (bsc#1227863).
• CVE-2025-40115: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (bsc#1253318).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
• CVE-2025-40323: fbcon: Set fb_display[i]->mode to NULL when the mode is released (bsc#1255094).
• CVE-2025-40339: drm/amdgpu: fix nullptr err of vm_handle_moved (bsc#1255428).
• CVE-2025-40345: usb: storage: sddr55: Reject out-of-bound new_pba (bsc#1255279).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68190: drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (bsc#1255131).
• CVE-2025-68192: net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (bsc#1255246).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68264: ext4: refresh inline data size before write operations (bsc#1255380).
• CVE-2025-68286: drm/amd/display: Check NULL before accessing (bsc#1255351).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68303: platform/x86: intel: punit_ipc: fix memory corruption (bsc#1255122).
• CVE-2025-68305: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (bsc#1255169).
• CVE-2025-68312: usbnet: Prevents free active kevent (bsc#1255171).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68354: regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (bsc#1255553).
• CVE-2025-68362: wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (bsc#1255611).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68740: ima: Handle error code returned by ima_filter_rule_match() (bsc#1255812).
• CVE-2025-68757: drm/vgem-fence: Fix potential deadlock on release (bsc#1255943).
• CVE-2025-68767: hfsplus: Verify inode mode when loading from disk (bsc#1256580).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68774: hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (bsc#1256585).
• CVE-2025-68783: ALSA: usb-mixer: us16x08: validate meter packet indices (bsc#1256650).
• CVE-2025-68788: fsnotify: do not generate ACCESS/MODIFY events on child for special files (bsc#1256638).
• CVE-2025-68795: ethtool: Avoid overflowing userspace buffer on stats query (bsc#1256688).
• CVE-2025-68797: char: applicom: fix NULL pointer dereference in ac_ioctl (bsc#1256660).
• CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).
• CVE-2025-68816: net/mlx5: fw_tracer, Validate format string parameters (bsc#1256674).
• CVE-2025-71064: net: hns3: using the num_tqps in the vf driver to apply for resources (bsc#1256654).
• CVE-2025-71082: Bluetooth: btusb: revert use of devm_kzalloc in btusb (bsc#1256611).
• CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256623).
• CVE-2025-71087: iavf: fix off-by-one issues in iavf_config_rss_reg() (bsc#1256628).
• CVE-2025-71091: team: fix check for port enabled in team_queue_override_port_prio_changed() (bsc#1256773).
• CVE-2025-71093: e1000: fix OOB in e1000_tbi_should_accept() (bsc#1256777).
• CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (bsc#1256606).
• CVE-2025-71098: ip6_gre: make ip6gre_header() robust (bsc#1256591).
• CVE-2025-71108: usb: typec: ucsi: Handle incorrect num_connectors capability (bsc#1256774).
• CVE-2025-71112: net: hns3: add VLAN id validation before using (bsc#1256726).
• CVE-2025-71119: powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1205462).
• CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).
• CVE-2026-22976: net_sched: qfq: Fix double list add in class with netem as child qdisc (bsc#1257035).
• CVE-2026-22978: wifi: avoid kernel-infoleak from struct iw_point (bsc#1257227).
• CVE-2026-22999: net/sched: sch_qfq: do not free existing class in qfq_change_class() (bsc#1257236).
• CVE-2026-23001: macvlan: Use 'hash' iterators to simplify code (bsc#1257232).
• CVE-2026-23011: ipv4: ip_gre: make ipgre_header() robust (bsc#1257207).

The following non security issues were fixed:

• RDMA/rxe: Fix the error caused by qp->sk (bsc#1256122).
• RDMA/srpt: Fix disabling device management (bsc#1255905).
• RDMA/srpt: Fix handling of SR-IOV and iWARP ports (bsc#1255905).
• configfs: factor dirent removal into helpers (bsc#1256184).
• drm/amdgpu: Remove explicit wait after VM validate (bsc#1255428).
• drm/amdgpu: update mappings not managed by KFD (bsc#1255428).
• hwrng: amd - Convert PCIBIOS_* return codes to errnos (bsc#1256386).
• nvmet-tcp: Fix NULL dereference when a connect data comes in h2cdata pdu (bsc#1255844).