CVE-2023-52531

Root has patched CVE-2023-52531 in the linux package for Root:Debian:11. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory corruption issue A few lines above, space is kzalloc()'ed for: sizeof(struct iwl_nvm_data) + sizeof(struct ieee80211_channel) + sizeof(struct ieee80211_rate) 'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is fine. At the end of this structure, there is the 'channels' flex array. Each element is of type 'struct ieee80211_channel'. So only 1 element is allocated in this array. When doing: mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels; We point at the first element of the 'channels' flex array. So this is fine. However, when doing: mvm->nvm_data->bands[0].bitrates = (void *)((u8 *)mvm->nvm_data->channels + 1); because of the "(u8 *)" cast, we add only 1 to the address of the beginning of the flex array. It is likely that we want point at the 'struct ieee80211_rate' allocated just after. Remove the spurious casting so that the pointer arithmetic works as expected.

• CVE-url: https://ubuntu.com/security/CVE-2024-49992
  • drm: remove all control node code
  • drm: add managed resources tied to drm_device
  • drm: Set final_kfree in drm_dev_alloc
  • drm/plane: add drmm_universal_plane_alloc()
  • drm: Handle dev->unique with drmm_
  • drm: Use drmm_ for drm_dev_init cleanup
  • drm: manage drm_minor cleanup with drmm_
  • drm/stm: Avoid use-after-free issues with crtc and plane
• CVE-url: https://ubuntu.com/security/CVE-2023-52531
  • wifi: iwlwifi: mvm: Fix a memory corruption issue
• CVE-url: https://ubuntu.com/security/CVE-2024-35877
  • mm: introduce page_needs_cow_for_dma() for deciding whether cow
  • x86/mm/pat: fix VM_PAT handling in COW mappings
• CVE-url: https://ubuntu.com/security/CVE-2023-52578
  • net: bridge: use DEV_STATS_INC()
• CVE-url: https://ubuntu.com/security/CVE-2024-42240
  • x86/bhi: Avoid warning in #DB handler due to BHI mitigation
• CVE-url: https://ubuntu.com/security/CVE-2022-48938
  • CDC-NCM: avoid overflow in sanity checking
• CVE-url: https://ubuntu.com/security/CVE-2023-52502
  • net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
• CVE-url: https://ubuntu.com/security/CVE-2023-52614
  • time: Introduce jiffies64_to_msecs()
  • PM / devfreq: Fix buffer overflow in trans_stat_show
• CVE-url: https://ubuntu.com/security/CVE-2024-50067
  • uprobe: avoid out-of-bounds memory access of fetching args

• CVE-url: https://ubuntu.com/security/CVE-2024-49992
  • drm: remove all control node code
  • drm: add managed resources tied to drm_device
  • drm: Set final_kfree in drm_dev_alloc
  • drm/plane: add drmm_universal_plane_alloc()
  • drm: Handle dev->unique with drmm_
  • drm: Use drmm_ for drm_dev_init cleanup
  • drm: manage drm_minor cleanup with drmm_
  • drm/stm: Avoid use-after-free issues with crtc and plane
• CVE-url: https://ubuntu.com/security/CVE-2023-52531
  • wifi: iwlwifi: mvm: Fix a memory corruption issue
• CVE-url: https://ubuntu.com/security/CVE-2024-35877
  • mm: introduce page_needs_cow_for_dma() for deciding whether cow
  • x86/mm/pat: fix VM_PAT handling in COW mappings
• CVE-url: https://ubuntu.com/security/CVE-2023-52578
  • net: bridge: use DEV_STATS_INC()
• CVE-url: https://ubuntu.com/security/CVE-2024-42240
  • x86/bhi: Avoid warning in #DB handler due to BHI mitigation
• CVE-url: https://ubuntu.com/security/CVE-2022-48938
  • CDC-NCM: avoid overflow in sanity checking
• CVE-url: https://ubuntu.com/security/CVE-2023-52502
  • net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
• CVE-url: https://ubuntu.com/security/CVE-2023-52614
  • time: Introduce jiffies64_to_msecs()
  • PM / devfreq: Fix buffer overflow in trans_stat_show
• CVE-url: https://ubuntu.com/security/CVE-2024-50067
  • uprobe: avoid out-of-bounds memory access of fetching args

• CVE-url: https://ubuntu.com/security/CVE-2021-47466
  • mm, slub: fix potential memoryleak in kmem_cache_open()
• CVE-url: https://ubuntu.com/security/CVE-2024-36968
  • Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
• Bionic update: upstream stable patchset 2021-06-23 (LP: #1933375) // CVE- url: https://ubuntu.com/security/CVE-2021-47118
  • pid: take a reference when initializing cad_pid
• Bionic update: upstream stable patchset 2022-01-25 (LP: #1959033) // CVE- url: https://ubuntu.com/security/CVE-2021-47086
  • phonet/pep: refuse to enable an unbound pipe
• CVE-url: https://ubuntu.com/security/CVE-2023-52507
  • nfc: nci: assert requested protocol is valid
• CVE-url: https://ubuntu.com/security/CVE-2024-44944
  • netfilter: ctnetlink: use helper function to calculate expect ID
• CVE-url: https://ubuntu.com/security/CVE-2024-35861
  • smb: client: fix potential UAF in cifs_debug_files_proc_show()
  • smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()
• CVE-url: https://ubuntu.com/security/CVE-2024-35863
  • smb: client: fix potential UAF in smb2_is_valid_oplock_break()
• CVE-url: https://ubuntu.com/security/CVE-2024-35864
  • smb: client: fix potential UAF in smb2_is_valid_lease_break()
• CVE-url: https://ubuntu.com/security/CVE-2024-35867
  • smb: client: fix potential UAF in cifs_stats_proc_show()
• CVE-url: https://ubuntu.com/security/CVE-2024-35868
  • smb: client: fix potential UAF in cifs_stats_proc_write()
• CVE-url: https://ubuntu.com/security/CVE-2024-35896
  • netfilter: validate user input for expected length
• Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE- url: https://ubuntu.com/security/CVE-2022-48695
  • scsi: mpt3sas: Fix use-after-free warning
• Bionic update: upstream stable patchset 2021-08-03 (LP: #1938824) // CVE- url: https://ubuntu.com/security/CVE-2021-47321
  • watchdog: Fix possible use-after-free by calling del_timer_sync()
• Bionic update: upstream stable patchset 2021-08-13 (LP: #1939913) // CVE- url: https://ubuntu.com/security/CVE-2021-47310
  • net: ti: fix UAF in tlan_remove_one
• CVE-url: https://ubuntu.com/security/CVE-2024-27010
  • net/sched: Fix mirred deadlock on device recursion
• Bionic update: upstream stable patchset 2021-08-03 (LP: #1938824) // CVE- url: https://ubuntu.com/security/CVE-2021-47353
  • udf: Fix NULL pointer dereference in udf_symlink function
• CVE-url: https://ubuntu.com/security/CVE-2024-26961
  • mac802154: fix llsec key resources release in mac802154_llsec_key_del
• CVE-url: https://ubuntu.com/security/CVE-2024-26958
  • NFS: Allow multiple commit requests in flight per file
  • NFS: Fix up commit deadlocks
  • nfs: fix UAF in direct writes
• CVE-url: https://ubuntu.com/security/CVE-2024-50115
  • KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
• CVE-url: https://ubuntu.com/security/CVE-2024-50148
  • Bluetooth: bnep: fix wild-memory-access in proto_unregister
• CVE-url: https://ubuntu.com/security/CVE-2024-40910
  • ax25: Fix refcount imbalance on inbound connections
• CVE-url: https://ubuntu.com/security/CVE-2024-53057
  • net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
• CVE-url: https://ubuntu.com/security/CVE-2024-36952
  • scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
• CVE-url: https://ubuntu.com/security/CVE-2024-50142
  • xfrm: validate new SA's prefixlen using SA family when sel.family is unset
• CVE-url: https://ubuntu.com/security/CVE-2024-50256
  • netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()
• CVE-url: https://ubuntu.com/security/CVE-2021-47501
  • i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
• CVE-url: https://ubuntu.com/security/CVE-2023-52574
  • team: fix null-ptr-deref when team device type is…

• CVE-url: https://ubuntu.com/security/CVE-2021-47466
  • mm, slub: fix potential memoryleak in kmem_cache_open()
• CVE-url: https://ubuntu.com/security/CVE-2024-36968
  • Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
• Bionic update: upstream stable patchset 2021-06-23 (LP: #1933375) // CVE- url: https://ubuntu.com/security/CVE-2021-47118
  • pid: take a reference when initializing cad_pid
• Bionic update: upstream stable patchset 2022-01-25 (LP: #1959033) // CVE- url: https://ubuntu.com/security/CVE-2021-47086
  • phonet/pep: refuse to enable an unbound pipe
• CVE-url: https://ubuntu.com/security/CVE-2023-52507
  • nfc: nci: assert requested protocol is valid
• CVE-url: https://ubuntu.com/security/CVE-2024-44944
  • netfilter: ctnetlink: use helper function to calculate expect ID
• CVE-url: https://ubuntu.com/security/CVE-2024-35861
  • smb: client: fix potential UAF in cifs_debug_files_proc_show()
  • smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()
• CVE-url: https://ubuntu.com/security/CVE-2024-35863
  • smb: client: fix potential UAF in smb2_is_valid_oplock_break()
• CVE-url: https://ubuntu.com/security/CVE-2024-35864
  • smb: client: fix potential UAF in smb2_is_valid_lease_break()
• CVE-url: https://ubuntu.com/security/CVE-2024-35867
  • smb: client: fix potential UAF in cifs_stats_proc_show()
• CVE-url: https://ubuntu.com/security/CVE-2024-35868
  • smb: client: fix potential UAF in cifs_stats_proc_write()
• CVE-url: https://ubuntu.com/security/CVE-2024-35896
  • netfilter: validate user input for expected length
• Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE- url: https://ubuntu.com/security/CVE-2022-48695
  • scsi: mpt3sas: Fix use-after-free warning
• Bionic update: upstream stable patchset 2021-08-03 (LP: #1938824) // CVE- url: https://ubuntu.com/security/CVE-2021-47321
  • watchdog: Fix possible use-after-free by calling del_timer_sync()
• Bionic update: upstream stable patchset 2021-08-13 (LP: #1939913) // CVE- url: https://ubuntu.com/security/CVE-2021-47310
  • net: ti: fix UAF in tlan_remove_one
• CVE-url: https://ubuntu.com/security/CVE-2024-27010
  • net/sched: Fix mirred deadlock on device recursion
• Bionic update: upstream stable patchset 2021-08-03 (LP: #1938824) // CVE- url: https://ubuntu.com/security/CVE-2021-47353
  • udf: Fix NULL pointer dereference in udf_symlink function
• CVE-url: https://ubuntu.com/security/CVE-2024-26961
  • mac802154: fix llsec key resources release in mac802154_llsec_key_del
• CVE-url: https://ubuntu.com/security/CVE-2024-26958
  • NFS: Allow multiple commit requests in flight per file
  • NFS: Fix up commit deadlocks
  • nfs: fix UAF in direct writes
• CVE-url: https://ubuntu.com/security/CVE-2024-50115
  • KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
• CVE-url: https://ubuntu.com/security/CVE-2024-50148
  • Bluetooth: bnep: fix wild-memory-access in proto_unregister
• CVE-url: https://ubuntu.com/security/CVE-2024-40910
  • ax25: Fix refcount imbalance on inbound connections
• CVE-url: https://ubuntu.com/security/CVE-2024-53057
  • net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
• CVE-url: https://ubuntu.com/security/CVE-2024-36952
  • scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
• CVE-url: https://ubuntu.com/security/CVE-2024-50142
  • xfrm: validate new SA's prefixlen using SA family when sel.family is unset
• CVE-url: https://ubuntu.com/security/CVE-2024-50256
  • netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()
• CVE-url: https://ubuntu.com/security/CVE-2021-47501
  • i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
• CVE-url: https://ubuntu.com/security/CVE-2023-52574
  • team: fix null-ptr-deref when team device type is…

• tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006}
• ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() {CVE-2022-48951}
• ext4: fix slab-use-after-free in ext4_split_extent_at() {CVE-2024-49884}
• ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed {CVE-2024-49884}
• media: edia: dvbdev: fix a use-after-free {CVE-2024-27043}
• media: dvbdev: remove double-unlock {CVE-2024-27043}
• mptcp: pm: Fix uaf in __timer_delete_sync {CVE-2024-46858}
• Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
• x86/alternatives: Disable KASAN in apply_alternatives() {CVE-2023-52504}
• ieee802154: ca8210: Fix a potential UAF in ca8210_probe {CVE-2023-52510}
• wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
• vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans {CVE-2024-50264}
• net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT {CVE-2024-53057}
• bpf: Fix out-of-bounds write in trie_get_next_key() {CVE-2024-50262}
• KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory {CVE-2024-50115}
• KVM: nSVM: Don't strip host's C-bit from guest's CR3 when reading PDPTRs {CVE-2024-50115}
• Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950}
• drm/amd/display: Fix index out of bounds in degamma hardware format translation {CVE-2024-49894}
• drm/amd/display: Fix index out of bounds in DCN30 color transformation {CVE-2024-49969}
• drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation {CVE-2024-49895}

• tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006}
• ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() {CVE-2022-48951}
• ext4: fix slab-use-after-free in ext4_split_extent_at() {CVE-2024-49884}
• ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed {CVE-2024-49884}
• media: edia: dvbdev: fix a use-after-free {CVE-2024-27043}
• media: dvbdev: remove double-unlock {CVE-2024-27043}
• mptcp: pm: Fix uaf in __timer_delete_sync {CVE-2024-46858}
• Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
• x86/alternatives: Disable KASAN in apply_alternatives() {CVE-2023-52504}
• ieee802154: ca8210: Fix a potential UAF in ca8210_probe {CVE-2023-52510}
• wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
• vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans {CVE-2024-50264}
• net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT {CVE-2024-53057}
• bpf: Fix out-of-bounds write in trie_get_next_key() {CVE-2024-50262}
• KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory {CVE-2024-50115}
• Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950}
• drm/amd/display: Fix index out of bounds in degamma hardware format translation {CVE-2024-49894}
• drm/amd/display: Fix index out of bounds in DCN30 color transformation {CVE-2024-49969}
• drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation {CVE-2024-49895}

• smb: client: fix use-after-free of signing key {CVE-2024-53179}
• smb: client: stop flooding dmesg in smb2_calc_signature() {CVE-2024-53179}
• smb3: fix oops in calculating shash_setkey {CVE-2024-53179}
• cifs: return correct error in ->calc_signature() {CVE-2024-53179}
• cifs: secmech: use shash_desc directly, remove sdesc {CVE-2024-53179}
• cifs: replace kfree() with kfree_sensitive() for sensitive data {CVE-2024-53179}
• xsk: fix OOB map writes when deleting elements {CVE-2024-56614}
• hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer {CVE-2024-53103}
• scsi: sg: Fix slab-use-after-free read in sg_release() {CVE-2024-56631}
• EDAC/igen6: Avoid segmentation fault on module unload {CVE-2024-56708}
• acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl {CVE-2024-56662}
• net: inet: do not leave a dangling sk pointer in inet_create() {CVE-2024-56601}
• initramfs: avoid filename buffer overrun {CVE-2024-53142}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() {CVE-2024-56604}
• wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() {CVE-2024-53156}
• Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() {CVE-2024-56605}
• Bluetooth: msft: fix slab-use-after-free in msft_do_close() {CVE-2024-36012}
• Bluetooth: Fix support for Read Local Supported Codecs V2 {CVE-2024-36012}
• Bluetooth: hci_codec: Fix leaking content of local_codecs {CVE-2024-36012}
• blk-cgroup: Fix UAF in blkcg_unpin_online() {CVE-2024-56672}
• net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() {CVE-2024-56602}
• net: inet6: do not leave a dangling sk pointer in inet6_create() {CVE-2024-56600}
• NFSv4.0: Fix a use-after-free problem in the asynchronous open() {CVE-2024-53173}
• net: af_can: do not leave a dangling sk pointer in can_create() {CVE-2024-56603}
• drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 {CVE-2023-52818}
• bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
• ceph: prevent use-after-free in encode_cap_msg() {CVE-2024-26689}
• drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' {CVE-2024-56608}
• netfilter: ipset: add missing range check in bitmap_ip_uadt {CVE-2024-53141}
• HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit {CVE-2023-52519}
• tipc: Fix use-after-free of kernel socket in cleanup_bearer(). {CVE-2024-56642}
• cifs: Fix buffer overflow when parsing NFS reparse points {CVE-2024-49996}
• Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
• PM / devfreq: Fix buffer overflow in trans_stat_show {CVE-2023-52614}
• PM / devfreq: Rework freq_table to be local to devfreq struct {CVE-2023-52614}
• cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() {CVE-2024-41057}
• cachefiles: fix slab-use-after-free in fscache_withdraw_volume() {CVE-2024-41058}
• [ELSCVE-37480] netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume() {CVE-2024-41058}
• memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
• Bluetooth: ISO: Fix UAF on iso_sock_timeout {CVE-2024-50124}
• Bluetooth: SCO: Fix UAF on sco_sock_timeout {CVE-2024-50125}
• Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout {CVE-2024-50125}
• Bluetooth: Consolidate code around sk_alloc into a helper function {CVE-2024-50125}
• smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() {CVE-2024-35861}
• gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() {CVE-2024-26754}
• smb: client: fix potential UAF in cifs_stats_proc_write() {CVE-2024-35868}
• smb: client: fix potential UAF in cifs_debug_files_proc_show() {CVE-2024-35868}
• vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans {CVE-2024-50264}
• net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT {CVE-2024-53057}
• wifi:…

• tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• module: limit enabling module.sig_enforce {CVE-2021-35039}
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• HID: elan: Fix potential double free in elan_input_configured {CVE-2022-49508}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• scsi: qla2xxx: Fix improper freeing of purex item {CVE-2025-68741}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• kernfs: fix use-after-free in __kernfs_remove {CVE-2022-50432}
• rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails {CVE-2023-53307}
• virtio_console: Assure used length from device is limited {CVE-2021-38160}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
• wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
• cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• drm/i915/perf: add sentinel to xehp_oa_b_counters {CVE-2023-53646}
• net: mdio: validate parameter addr in mdiobus_get_phy() {CVE-2023-53019}
• wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() {CVE-2023-53570}
• vt: Clear selection before changing the font {CVE-2022-49948}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
• ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
• thermal: core: prevent potential string overflow {CVE-2023-52868}
• drm/radeon: possible buffer overflow {CVE-2023-52867}
• ftrace: Fix invalid address access in lookup_rec() when index is 0 {CVE-2023-53075}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• smb: client: reject userspace cifs.spnego descriptions
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}

• Bump kernel ABI to 29: ship the ELS kernel as 4.19.0-29-*, distinct from the prior 4.19.0-28.
• CVE-2021-46984
  • kyber: fix out of bounds access when preempted {CVE-2021-46984}
• CVE-2021-47049
  • Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}
• CVE-2021-47101
  • asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
• CVE-2021-47191
  • scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• CVE-2021-47352
  • virtio-net: Add validation for used length {CVE-2021-47352}
• CVE-2021-47379
  • blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd {CVE-2021-47379}
• CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests {CVE-2021-47391}
• CVE-2021-47479
  • staging: rtl8712: fix use-after-free in rtl8712_dl_fw {CVE-2021-47479}
• CVE-2022-21546
  • scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• CVE-2022-39189
  • KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• CVE-2022-43945
  • SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
  • NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2022-49026
  • e100: Fix possible use after free in e100_xmit_prepare {CVE-2022-49026}
• CVE-2022-49720
  • block: Fix handling of offline queues in blk_mq_alloc_request_hctx() {CVE-2022-49720}
• CVE-2022-49975
  • bpf: Don't redirect packets with invalid pkt_len {CVE-2022-49975}
  • bpf: Move skb->len == 0 checks into __bpf_redirect {CVE-2022-49975}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2022-50103
  • sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• CVE-2022-50129
  • RDMA/srpt: Introduce a reference count in struct srpt_device {CVE-2022-50129}
  • RDMA/srpt: Fix a use-after-free {CVE-2022-50129}
• CVE-2022-50300
  • btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300}
• CVE-2022-50406
  • iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50552
  • blk-mq: use quiesced elevator switch when reinitializing queues {CVE-2022-50552}
• CVE-2023-51779
  • Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
• CVE-2023-52434
  • smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• CVE-2023-52515
  • RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
• CVE-2023-52531
  • wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
• CVE-2023-52741
  • cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
• CVE-2023-53000
  • netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• CVE-2023-53039
  • workqueue: Add resource managed version of delayed work init {CVE-2023-53039}
  • devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc {CVE-2023-53039}
  • devm-helpers: Add resource managed version of work init {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc {CVE-2023-53039}
• CVE-2023-53111
  • loop: Fix use-after-free issues {CVE-2023-53111}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
• HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
• HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
• scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• dm array: validate array block headers on read {CVE-2026-89574}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
• net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
• vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
• net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• dmaengine: Fix possible use after free {CVE-2026-72476}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
• ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
• wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
• ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
• nvmet-rdma: handle inline…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
• HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
• HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
• scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• dm array: validate array block headers on read {CVE-2026-89574}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
• net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
• vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
• net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• dmaengine: Fix possible use after free {CVE-2026-72476}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
• ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
• wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
• ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
• nvmet-rdma: handle inline…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
• HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
• HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
• scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• dm array: validate array block headers on read {CVE-2026-89574}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
• net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
• vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
• net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• dmaengine: Fix possible use after free {CVE-2026-72476}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
• ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
• wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
• ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
• nvmet-rdma: handle inline…

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: Fix a memory corruption issue

A few lines above, space is kzalloc()'ed for: sizeof(struct iwl_nvm_data) + sizeof(struct ieee80211_channel) + sizeof(struct ieee80211_rate)

'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is fine.

At the end of this structure, there is the 'channels' flex array. Each element is of type 'struct ieee80211_channel'. So only 1 element is allocated in this array.

When doing: mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels; We point at the first element of the 'channels' flex array. So this is fine.

However, when doing: mvm->nvm_data->bands[0].bitrates = (void *)((u8 *)mvm->nvm_data->channels + 1); because of the "(u8 *)" cast, we add only 1 to the address of the beginning of the flex array.

It is likely that we want point at the 'struct ieee80211_rate' allocated just after.

Remove the spurious casting so that the pointer arithmetic works as expected.

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-6270: Fixed a use-after-free bug in aoecmd_cfg_pkts (bsc#1218562).
• CVE-2023-52559: Fixed a bug by avoiding memory allocation in iommu_suspend (bsc#1220933).
• CVE-2023-52462: Fixed a security check for attempt to corrupt spilled pointer (bsc#1220325).
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register (bsc#1220433).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2024-26591: Fixed re-attachment branch in bpf_tracing_prog_attach (bsc#1220254).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2024-23850: Fixed double free of anonymous device after snapshot creation failure (bsc#1219126).
• CVE-2023-52452: Fixed Fix accesses to uninit stack slots (bsc#1220257).
• CVE-2023-52457: Fixed skipped resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350).
• CVE-2023-52456: Fixed tx statemachine deadlock (bsc#1220364).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2021-46923: Fixed reference leakage in fs/mount_setattr (bsc#1220457).
• CVE-2024-26598: Fixed potential UAF in LPI translation cache (bsc#1220326).
• CVE-2024-26603: Fixed infinite loop via #PF handling (bsc#1220335).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2023-5197: Fixed se-after-free due to addition and removal of rules from chain bindings within the same transaction (bsc#1218216).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
• CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).

The following non-security bugs were fixed:

• ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events (git-fixes).
• ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A (git-fixes).
• ACPI: extlog: fix NULL pointer dereference check (git-fixes).
• ACPI: resource: Add ASUS model S5402ZA to quirks (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA (git-fixes).
• ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA (git-fixes).
• ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3 (git-fixes).
• ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and iMac12,2 (git-fixes).
• ACPI: video: Add backlight=native DMI quirk for…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item (bsc#1220918).
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2021-47005: Fixed a NULL pointer dereference for ->get_features() (bsc#1220660).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2021-47012: Fixed a use after free in siw_alloc_mr (bsc#1220627).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2021-46989: Fixed a bug by preventing corruption in shrinking truncate in hfsplus (bsc#1220737).
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2024-0340: Fixed information disclosure in vhost/vhost.c:vhost_new_msg() (bsc#1218689).
• CVE-2023-51042: Fixed use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (bsc#1219128).
• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item (bsc#1220918).
• CVE-2023-52482: Fixex a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2021-47083: Fixed a…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52559: Fixed a bug by avoiding memory allocation in iommu_suspend (bsc#1220933).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register (bsc#1220433).
• CVE-2024-26591: Fixed re-attachment branch in bpf_tracing_prog_attach (bsc#1220254).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2023-52484: Fixed a soft lockup triggered by arm_smmu_mm_invalidate_range (bsc#1220797).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2024-23850: Fixed double free of anonymous device after snapshot creation failure (bsc#1219126).
• CVE-2023-52452: Fixed Fix accesses to uninit stack slots (bsc#1220257).
• CVE-2023-52457: Fixed skipped resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350).
• CVE-2023-52456: Fixed tx statemachine deadlock (bsc#1220364).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2021-46923: Fixed reference leakage in fs/mount_setattr (bsc#1220457).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2024-26598: Fixed potential UAF in LPI translation cache (bsc#1220326).
• CVE-2024-26603: Fixed infinite loop via #PF handling (bsc#1220335).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2023-5197: Fixed se-after-free due to addition and removal of rules from chain bindings within the same transaction (bsc#1218216).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
• CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).

The following non-security bugs were fixed:

• bpf: Fix verification of indirect var-off stack access (git-fixes).
• bpf: Guard stack limits against 32bit overflow (git-fixes).
• KVM: VMX: Move VERW closer to VMentry for MDS mitigation (git-fixes).
• KVM: VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (git-fixes).
• NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633).
• nvme: move nvme_stop_keep_alive() back to original position (bsc#1211515).
• nvme: remove nvme_alloc_request and nvme_alloc_request_qid (bsc#1214064).
• nvme: start keep-alive after…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52559: Fixed a bug by avoiding memory allocation in iommu_suspend (bsc#1220933).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register (bsc#1220433).
• CVE-2024-26591: Fixed re-attachment branch in bpf_tracing_prog_attach (bsc#1220254).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2023-52484: Fixed a soft lockup triggered by arm_smmu_mm_invalidate_range (bsc#1220797).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2024-23850: Fixed double free of anonymous device after snapshot creation failure (bsc#1219126).
• CVE-2023-52452: Fixed Fix accesses to uninit stack slots (bsc#1220257).
• CVE-2023-52457: Fixed skipped resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350).
• CVE-2023-52456: Fixed tx statemachine deadlock (bsc#1220364).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2021-46923: Fixed reference leakage in fs/mount_setattr (bsc#1220457).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2024-26598: Fixed potential UAF in LPI translation cache (bsc#1220326).
• CVE-2024-26603: Fixed infinite loop via #PF handling (bsc#1220335).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2023-5197: Fixed se-after-free due to addition and removal of rules from chain bindings within the same transaction (bsc#1218216).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
• CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).

The following non-security bugs were fixed:

• bpf: Fix verification of indirect var-off stack access (git-fixes).
• bpf: Guard stack limits against 32bit overflow (git-fixes).
• KVM: VMX: Move VERW closer to VMentry for MDS mitigation (git-fixes).
• KVM: VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (git-fixes).
• NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633).
• nvme: move nvme_stop_keep_alive() back to original position (bsc#1211515).
• nvme: remove nvme_alloc_request and nvme_alloc_request_qid (bsc#1214064).
• nvme: start keep-alive after…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2021-47077: Fixed a NULL pointer dereference when in shost_data (bsc#1220861).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get and nfc_llcp_sock_get_sn (bsc#1220831).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval (bsc#1218915).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control (bsc#1220825).
• CVE-2021-46921: Fixed ordering in queued_write_lock_slowpath (bsc#1220468).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46953: Fixed a corruption in interrupt mappings on watchdow probe failure (bsc#1220599).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2021-47054: Fixed a bug to put child node before return (bsc#1220767).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46906: Fixed an info leak in hid_submit_ctrl (bsc#1220421).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2020-36777: Fixed a memory leak in dvb_media_device_free (bsc#1220526).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge (CVE-2023-46343).
• CVE-2021-46992: Fixed a bug to avoid overflows in nft_hash_buckets (bsc#1220638).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2021-46991: Fixed a use-after-free in i40e_client_subtask (bsc#1220575).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2024-26600: Fixed NULL pointer dereference for SRP in phy-omap-usb2 (bsc#1220340).

The following non-security bugs were fixed:

• ASN.1: Fix check for strdup() success (git-fixes).
• audit: fix possible soft lockup in __audit_inode_child() (git-fixes).
• Bluetooth: hci_bcsp: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).
• Bluetooth: hci_h5: do…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item (bsc#1220918).
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2021-47005: Fixed a NULL pointer dereference for ->get_features() (bsc#1220660).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2021-47012: Fixed a use after free in siw_alloc_mr (bsc#1220627).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2021-46989: Fixed a bug by preventing corruption in shrinking truncate in hfsplus (bsc#1220737).
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595:…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26600: Fixed NULL pointer dereference for SRP (bsc#1220340).
• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2021-47077: Fixed a NULL pointer dereference when in shost_data (bsc#1220861).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2021-33200: Fixed a leakage of uninitialized bpf stack under speculation. (bsc#1186484)
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2021-46921: Fixed ordering in queued_write_lock_slowpath (bsc#1220468).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46953: Fixed a corruption in interrupt mappings on watchdow probe failure (bsc#1220599).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2021-47054: Fixed a bug to put child node before return (bsc#1220767).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46906: Fixed an info leak in hid_submit_ctrl (bsc#1220421).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2020-36777: Fixed a memory leak in dvb_media_device_free (bsc#1220526).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2021-46992: Fixed a bug to avoid overflows in nft_hash_buckets (bsc#1220638).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2021-46991: Fixed a use-after-free in i40e_client_subtask (bsc#1220575).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).

The following non-security bugs were fixed:

• ASN.1: Fix check for strdup() success (git-fixes).
• audit: fix possible soft lockup in __audit_inode_child() (git-fixes).
• Bluetooth:…

The SUSE Linux Enterprise SLE12SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36777: Fixed a memory leak in dvb_media_device_free() (bsc#1220526).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2021-46906: Fixed an info leak in hid_submit_ctrl (bsc#1220421).
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46921: Fixed ordering in queued_write_lock_slowpath (bsc#1220468).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2021-46953: Fixed a corruption in interrupt mappings on watchdow probe failure (bsc#1220599).
• CVE-2021-46991: Fixed a use-after-free in i40e_client_subtask (bsc#1220575).
• CVE-2021-46992: Fixed a bug to avoid overflows in nft_hash_buckets (bsc#1220638).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2021-47054: Fixed a bug to put child node before return (bsc#1220767).
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2021-47077: Fixed a NULL pointer dereference when in shost_data (bsc#1220861).
• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2024-26600: Fixed NULL pointer dereference for SRP in phy-omap-usb2 (bsc#1220340).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).

The following non-security bugs were fixed:

• [media] coda:…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2021-46923: Fixed reference leakage in fs/mount_setattr (bsc#1220457).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-5197: Fixed se-after-free due to addition and removal of rules from chain bindings within the same transaction (bsc#1218216).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2023-52452: Fixed Fix accesses to uninit stack slots (bsc#1220257).
• CVE-2023-52456: Fixed tx statemachine deadlock (bsc#1220364).
• CVE-2023-52457: Fixed skipped resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register (bsc#1220433).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52484: Fixed a soft lockup triggered by arm_smmu_mm_invalidate_range (bsc#1220797).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2023-52559: Fixed a bug by avoiding memory allocation in iommu_suspend (bsc#1220933).
• CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2024-23850: Fixed double free of anonymous device after snapshot creation failure (bsc#1219126).
• CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2024-26591: Fixed re-attachment branch in bpf_tracing_prog_attach (bsc#1220254).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2024-26598: Fixed potential UAF in LPI translation cache (bsc#1220326).
• CVE-2024-26602: Fixed overall slowdowns with…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

NOTE: This update has been retracted due to a bug in the BHI CPU sidechannel mitigation, which led to incorrect selection of other CPU mitigations.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2022-48628: Fixed possible lock in ceph (bsc#1220848).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52462: Fixed check for attempt to corrupt spilled pointer…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2022-48628: Fixed possible lock in ceph (bsc#1220848).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52462: Fixed check for attempt to corrupt spilled pointer (bsc#1220325).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register…

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36402)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Android drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• CPU frequency scaling framework;
• Device frequency scaling framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• ISDN/mISDN subsystem;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• EEPROM drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Parport drivers;
• PCI subsystem;
• Pin controllers subsystem;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI drivers;
• QCOM SoC drivers;
• Direct Digital Synthesis drivers;
• TTY drivers;
• Userspace I/O drivers;
• DesignWare USB3 driver;
• USB subsystem;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• BPF subsystem;
• Core kernel;
• DMA mapping infrastructure;
• Tracing infrastructure;
• Radix Tree data structure library;
• Kernel userspace event delivery library;
• Objagg library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• KCM (Kernel Connection Multiplexor) sockets driver;
• MAC80211 subsystem;
• Netfilter;
• Network traffic control;
• SCTP protocol;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• Wireless networking;
• AppArmor security module;
• Simplified Mandatory Access Control Kernel framework;
• SoC audio core drivers;
• USB sound devices; (CVE-2024-43894, CVE-2024-46737, CVE-2024-46828, CVE-2024-42244, CVE-2024-46723, CVE-2024-41073, CVE-2024-46756, CVE-2024-42288, CVE-2024-46840, CVE-2024-46771, CVE-2024-46757, CVE-2024-43860, CVE-2024-46747, CVE-2024-41017, CVE-2024-42246, CVE-2024-44988, CVE-2024-42281, CVE-2024-36484, CVE-2024-43856, CVE-2024-47668, CVE-2024-46759, CVE-2024-46744, CVE-2024-42289, CVE-2024-42131, CVE-2024-46679, CVE-2024-42304, CVE-2024-46818, CVE-2024-43858, CVE-2024-44960, CVE-2024-45028, CVE-2024-26885, CVE-2024-46676, CVE-2024-46780, CVE-2024-42310, CVE-2024-44987, CVE-2024-41090, CVE-2024-44954, CVE-2024-45026, CVE-2024-42285, CVE-2023-52614, CVE-2024-27051, CVE-2024-43880, CVE-2024-43839, CVE-2024-43884, CVE-2024-42311, CVE-2024-43893, CVE-2024-41072, CVE-2024-41091, CVE-2024-46758, CVE-2024-41022, CVE-2024-46745, CVE-2024-42305, CVE-2024-46673, CVE-2024-42284, CVE-2024-46844, CVE-2024-46677, CVE-2024-45025, CVE-2024-43861, CVE-2024-43914, CVE-2024-46783, CVE-2024-41012, CVE-2024-44999, CVE-2024-44946, CVE-2024-42276, CVE-2024-46740, CVE-2024-42295, CVE-2024-44947, CVE-2024-41059, CVE-2024-26669, CVE-2024-38602, CVE-2024-42306, CVE-2023-52918, CVE-2024-42297, CVE-2024-42229, CVE-2024-43853, CVE-2024-45006, CVE-2024-44998, CVE-2024-42283, CVE-2024-44952, CVE-2024-46761, CVE-2024-43841, CVE-2024-44944, CVE-2024-42313, CVE-2024-45008, CVE-2024-46714, CVE-2024-41065, CVE-2024-43883, CVE-2024-43867, CVE-2024-42286, CVE-2024-43879, CVE-2024-43846, CVE-2024-42280, CVE-2024-43854, CVE-2021-47212, CVE-2024-35848, CVE-2024-41020, CVE-2024-41068, CVE-2024-45021, CVE-2024-41098, CVE-2024-44965, CVE-2024-43890,…

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36402)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Android drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• CPU frequency scaling framework;
• Device frequency scaling framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• ISDN/mISDN subsystem;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• EEPROM drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Parport drivers;
• PCI subsystem;
• Pin controllers subsystem;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI drivers;
• QCOM SoC drivers;
• Direct Digital Synthesis drivers;
• TTY drivers;
• Userspace I/O drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Serial drivers;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• BPF subsystem;
• Core kernel;
• DMA mapping infrastructure;
• Tracing infrastructure;
• Radix Tree data structure library;
• Kernel userspace event delivery library;
• Objagg library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• KCM (Kernel Connection Multiplexor) sockets driver;
• MAC80211 subsystem;
• Netfilter;
• Network traffic control;
• SCTP protocol;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• Wireless networking;
• AppArmor security module;
• Simplified Mandatory Access Control Kernel framework;
• SoC audio core drivers;
• USB sound devices; (CVE-2024-46714, CVE-2024-42288, CVE-2024-42290, CVE-2024-44987, CVE-2024-41090, CVE-2024-42313, CVE-2024-46689, CVE-2024-46737, CVE-2024-44946, CVE-2024-44999, CVE-2024-44935, CVE-2024-38602, CVE-2024-43883, CVE-2024-26607, CVE-2024-41091, CVE-2024-45025, CVE-2024-42305, CVE-2024-26891, CVE-2024-41073, CVE-2024-44969, CVE-2024-26641, CVE-2024-46719, CVE-2024-40929, CVE-2024-46721, CVE-2024-46740, CVE-2024-41012, CVE-2024-42280, CVE-2024-46738, CVE-2024-46722, CVE-2024-42246, CVE-2024-41063, CVE-2024-41072, CVE-2024-41068, CVE-2024-43884, CVE-2024-46758, CVE-2024-43861, CVE-2024-42306, CVE-2024-42285, CVE-2024-41065, CVE-2024-46818, CVE-2024-43894, CVE-2024-44954, CVE-2024-42310, CVE-2024-46829, CVE-2023-52614, CVE-2024-47663, CVE-2024-42281, CVE-2024-42297, CVE-2024-46800, CVE-2024-44960, CVE-2024-44952, CVE-2024-46747, CVE-2024-42286, CVE-2024-41071, CVE-2024-43893, CVE-2023-52531, CVE-2024-43860, CVE-2024-46840, CVE-2024-41011, CVE-2024-43890, CVE-2024-45026, CVE-2024-42292, CVE-2024-27051, CVE-2024-41015, CVE-2024-47668, CVE-2024-46817, CVE-2024-43846, CVE-2024-44988, CVE-2024-44944, CVE-2024-43829, CVE-2024-45021, CVE-2024-43914, CVE-2024-43856, CVE-2024-46673, CVE-2024-46771, CVE-2024-41081, CVE-2024-43830, CVE-2024-43839, CVE-2024-43853, CVE-2024-47669, CVE-2024-42244, CVE-2021-47212, CVE-2024-46844, CVE-2024-44965, CVE-2024-41059, CVE-2024-46783, CVE-2024-42295, CVE-2024-35848, CVE-2024-41017, CVE-2024-47659, CVE-2024-42309, CVE-2024-26800, CVE-2024-41064, CVE-2024-43879, CVE-2024-46679, CVE-2024-43854, CVE-2024-41022,…

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36402)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Android drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• CPU frequency scaling framework;
• Device frequency scaling framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• ISDN/mISDN subsystem;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• EEPROM drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Parport drivers;
• PCI subsystem;
• Pin controllers subsystem;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI drivers;
• QCOM SoC drivers;
• Direct Digital Synthesis drivers;
• TTY drivers;
• Userspace I/O drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Serial drivers;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• BPF subsystem;
• Core kernel;
• DMA mapping infrastructure;
• Tracing infrastructure;
• Radix Tree data structure library;
• Kernel userspace event delivery library;
• Objagg library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• KCM (Kernel Connection Multiplexor) sockets driver;
• MAC80211 subsystem;
• Netfilter;
• Network traffic control;
• SCTP protocol;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• Wireless networking;
• AppArmor security module;
• Simplified Mandatory Access Control Kernel framework;
• SoC audio core drivers;
• USB sound devices; (CVE-2021-47212, CVE-2024-44965, CVE-2024-46676, CVE-2024-41091, CVE-2024-44946, CVE-2024-43894, CVE-2024-26668, CVE-2024-42259, CVE-2024-42295, CVE-2024-46685, CVE-2024-46722, CVE-2024-45028, CVE-2024-46815, CVE-2024-41081, CVE-2024-41022, CVE-2024-44948, CVE-2024-42301, CVE-2024-43914, CVE-2024-46771, CVE-2024-42289, CVE-2024-43841, CVE-2024-41042, CVE-2024-44999, CVE-2024-43893, CVE-2024-46758, CVE-2024-46828, CVE-2024-36484, CVE-2024-26669, CVE-2024-44952, CVE-2024-42265, CVE-2024-42311, CVE-2024-43880, CVE-2024-41070, CVE-2024-46829, CVE-2024-42292, CVE-2024-46719, CVE-2024-41020, CVE-2024-41015, CVE-2024-42283, CVE-2024-46744, CVE-2024-46679, CVE-2024-46800, CVE-2024-46777, CVE-2024-43835, CVE-2024-42271, CVE-2024-43882, CVE-2024-41072, CVE-2024-35848, CVE-2024-43860, CVE-2024-38611, CVE-2024-26607, CVE-2024-47663, CVE-2024-46780, CVE-2024-46675, CVE-2024-45003, CVE-2024-44969, CVE-2024-42244, CVE-2024-43856, CVE-2024-46755, CVE-2024-42286, CVE-2024-41063, CVE-2024-41068, CVE-2024-46743, CVE-2024-43839, CVE-2024-41065, CVE-2023-52531, CVE-2024-41090, CVE-2024-46747, CVE-2023-52614, CVE-2024-43853, CVE-2024-46737, CVE-2024-45021, CVE-2024-41012, CVE-2024-41064, CVE-2024-26800, CVE-2024-42246, CVE-2024-43908, CVE-2024-46723, CVE-2024-42310, CVE-2024-46781, CVE-2023-52918, CVE-2024-42313, CVE-2024-45006, CVE-2024-43890, CVE-2024-44954, CVE-2024-43858, CVE-2024-41098, CVE-2024-41071, CVE-2024-26641, CVE-2024-42280, CVE-2024-46673, CVE-2024-43846, CVE-2024-46721, CVE-2024-47667, CVE-2024-26885, CVE-2024-42304, CVE-2024-46745,…

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36402)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Android drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• CPU frequency scaling framework;
• Device frequency scaling framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• ISDN/mISDN subsystem;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• EEPROM drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Parport drivers;
• PCI subsystem;
• Pin controllers subsystem;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI drivers;
• QCOM SoC drivers;
• Direct Digital Synthesis drivers;
• TTY drivers;
• Userspace I/O drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Serial drivers;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• BPF subsystem;
• Core kernel;
• DMA mapping infrastructure;
• Tracing infrastructure;
• Radix Tree data structure library;
• Kernel userspace event delivery library;
• Objagg library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• KCM (Kernel Connection Multiplexor) sockets driver;
• MAC80211 subsystem;
• Netfilter;
• Network traffic control;
• SCTP protocol;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• Wireless networking;
• AppArmor security module;
• Simplified Mandatory Access Control Kernel framework;
• SoC audio core drivers;
• USB sound devices; (CVE-2024-35848, CVE-2024-43853, CVE-2024-41017, CVE-2024-26607, CVE-2024-43839, CVE-2024-41072, CVE-2024-46815, CVE-2023-52614, CVE-2024-46798, CVE-2024-46676, CVE-2024-43914, CVE-2024-43841, CVE-2024-41012, CVE-2024-27051, CVE-2024-46738, CVE-2024-47663, CVE-2024-46723, CVE-2024-46740, CVE-2024-42287, CVE-2024-46750, CVE-2024-43894, CVE-2023-52531, CVE-2024-47668, CVE-2024-47669, CVE-2024-46685, CVE-2024-41011, CVE-2024-41064, CVE-2024-42305, CVE-2024-41073, CVE-2024-46829, CVE-2024-43860, CVE-2024-46679, CVE-2024-44999, CVE-2024-46817, CVE-2024-26800, CVE-2024-46689, CVE-2024-43908, CVE-2024-46739, CVE-2024-43893, CVE-2024-46828, CVE-2024-46777, CVE-2024-46721, CVE-2024-36484, CVE-2024-46822, CVE-2024-46840, CVE-2024-43880, CVE-2024-46781, CVE-2024-46673, CVE-2024-26669, CVE-2024-41098, CVE-2024-46737, CVE-2024-43871, CVE-2024-42281, CVE-2024-42301, CVE-2024-44995, CVE-2024-43879, CVE-2024-26668, CVE-2024-44965, CVE-2024-41068, CVE-2024-41059, CVE-2024-42229, CVE-2024-44987, CVE-2024-46745, CVE-2024-26891, CVE-2024-46719, CVE-2024-42292, CVE-2024-44952, CVE-2024-46756, CVE-2024-45028, CVE-2024-42283, CVE-2024-45025, CVE-2024-46743, CVE-2024-43867, CVE-2024-46771, CVE-2024-41081, CVE-2024-42244, CVE-2024-42284, CVE-2024-43858, CVE-2024-44998, CVE-2024-46758, CVE-2024-46800, CVE-2024-45003, CVE-2024-44935, CVE-2024-38611, CVE-2024-46844, CVE-2024-44954, CVE-2024-42313, CVE-2024-46783, CVE-2024-42311, CVE-2024-46761, CVE-2024-41022, CVE-2024-43829, CVE-2024-43835, CVE-2024-43846, CVE-2024-46755, CVE-2024-47667, CVE-2024-42259,…

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36402)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Android drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• CPU frequency scaling framework;
• Device frequency scaling framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• ISDN/mISDN subsystem;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• EEPROM drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Parport drivers;
• PCI subsystem;
• Pin controllers subsystem;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI drivers;
• QCOM SoC drivers;
• Direct Digital Synthesis drivers;
• TTY drivers;
• Userspace I/O drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB Serial drivers;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• BPF subsystem;
• Core kernel;
• DMA mapping infrastructure;
• Tracing infrastructure;
• Radix Tree data structure library;
• Kernel userspace event delivery library;
• Objagg library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• KCM (Kernel Connection Multiplexor) sockets driver;
• MAC80211 subsystem;
• Netfilter;
• Network traffic control;
• SCTP protocol;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• Wireless networking;
• AppArmor security module;
• Simplified Mandatory Access Control Kernel framework;
• SoC audio core drivers;
• USB sound devices; (CVE-2024-42289, CVE-2024-26640, CVE-2024-42246, CVE-2024-43914, CVE-2024-46744, CVE-2024-45026, CVE-2024-41071, CVE-2024-43893, CVE-2024-46689, CVE-2024-41073, CVE-2024-42292, CVE-2024-43884, CVE-2024-42301, CVE-2024-43856, CVE-2024-46756, CVE-2024-46759, CVE-2024-27051, CVE-2024-26668, CVE-2024-46840, CVE-2024-42306, CVE-2024-41042, CVE-2024-45006, CVE-2024-42309, CVE-2024-26891, CVE-2024-42283, CVE-2024-46782, CVE-2024-44948, CVE-2024-43839, CVE-2024-47667, CVE-2024-44965, CVE-2024-42284, CVE-2024-44987, CVE-2024-46777, CVE-2024-41017, CVE-2024-46722, CVE-2024-41015, CVE-2024-46817, CVE-2024-46740, CVE-2024-43894, CVE-2024-26800, CVE-2024-45003, CVE-2024-46822, CVE-2024-26641, CVE-2024-44960, CVE-2024-44935, CVE-2024-42229, CVE-2024-42285, CVE-2024-44988, CVE-2024-46829, CVE-2024-41012, CVE-2024-46750, CVE-2024-43835, CVE-2024-43883, CVE-2024-43882, CVE-2024-46844, CVE-2024-41011, CVE-2024-44999, CVE-2024-46757, CVE-2024-42131, CVE-2024-46714, CVE-2024-41081, CVE-2024-45021, CVE-2024-46747, CVE-2024-46673, CVE-2024-46737, CVE-2024-43841, CVE-2024-42304, CVE-2024-45008, CVE-2024-42259, CVE-2024-42276, CVE-2024-46685, CVE-2024-46743, CVE-2023-52614, CVE-2024-42313, CVE-2024-41090, CVE-2024-46677, CVE-2024-43861, CVE-2024-42288, CVE-2024-43890, CVE-2024-41063, CVE-2024-43860, CVE-2024-47669, CVE-2024-42305, CVE-2024-43879, CVE-2024-42281, CVE-2024-46798, CVE-2024-42280, CVE-2024-42297, CVE-2024-42310,…

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36402)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Android drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• CPU frequency scaling framework;
• Device frequency scaling framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• ISDN/mISDN subsystem;
• Modular ISDN driver;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• EEPROM drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Parport drivers;
• PCI subsystem;
• Pin controllers subsystem;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI drivers;
• QCOM SoC drivers;
• Direct Digital Synthesis drivers;
• TTY drivers;
• Userspace I/O drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB Serial drivers;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• Watchdog drivers;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• NILFS2 file system;
• Netfilter;
• BPF subsystem;
• Core kernel;
• DMA mapping infrastructure;
• Tracing infrastructure;
• Radix Tree data structure library;
• Kernel userspace event delivery library;
• Objagg library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• KCM (Kernel Connection Multiplexor) sockets driver;
• MAC80211 subsystem;
• RxRPC session sockets;
• Network traffic control;
• SCTP protocol;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• Wireless networking;
• AppArmor security module;
• Integrity Measurement Architecture(IMA) framework;
• Simplified Mandatory Access Control Kernel framework;
• SoC audio core drivers;
• USB sound devices; (CVE-2024-46750, CVE-2024-43853, CVE-2024-46722, CVE-2024-42311, CVE-2024-46679, CVE-2023-52918, CVE-2024-42309, CVE-2024-42160, CVE-2024-26668, CVE-2024-42271, CVE-2024-40929, CVE-2024-46747, CVE-2024-41064, CVE-2024-43839, CVE-2024-46757, CVE-2024-41059, CVE-2024-42301, CVE-2024-46737, CVE-2024-42297, CVE-2024-41015, CVE-2024-43854, CVE-2024-42289, CVE-2024-41017, CVE-2024-26787, CVE-2024-47667, CVE-2024-46675, CVE-2024-42246, CVE-2024-46723, CVE-2024-46817, CVE-2024-43841, CVE-2024-26800, CVE-2024-41098, CVE-2022-48863, CVE-2023-52531, CVE-2024-42265, CVE-2024-46828, CVE-2024-41020, CVE-2024-42305, CVE-2024-46755, CVE-2024-46744, CVE-2024-43871, CVE-2024-43884, CVE-2024-41042, CVE-2024-43914, CVE-2024-43856, CVE-2024-27397, CVE-2024-26607, CVE-2024-42228, CVE-2024-41091, CVE-2024-26677, CVE-2024-38611, CVE-2024-43867, CVE-2024-46829, CVE-2021-47188, CVE-2024-46756, CVE-2024-45025, CVE-2024-42313, CVE-2024-44947, CVE-2024-26669, CVE-2024-47668, CVE-2024-44987, CVE-2024-42295, CVE-2024-42281, CVE-2024-43880, CVE-2024-46777, CVE-2024-46780, CVE-2024-42285, CVE-2024-26891, CVE-2024-46714, CVE-2024-44999, CVE-2024-41068, CVE-2024-44944, CVE-2024-43882, CVE-2024-27051, CVE-2024-41072, CVE-2024-46783, CVE-2024-46781, CVE-2024-26885, CVE-2024-46844, CVE-2024-47669,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ATM drivers;
• Device frequency scaling framework;
• GPU drivers;
• Hardware monitoring drivers;
• VMware VMCI Driver;
• Network drivers;
• Device tree and open firmware driver;
• SCSI drivers;
• Greybus lights staging drivers;
• BTRFS file system;
• File systems infrastructure;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• Netfilter;
• Memory management;
• Ethernet bridge;
• IPv6 networking;
• IUCV driver;
• Logical Link layer;
• MAC80211 subsystem;
• NFC subsystem;
• Network traffic control;
• Unix domain sockets; (CVE-2023-52614, CVE-2024-26633, CVE-2024-46758, CVE-2024-46723, CVE-2023-52502, CVE-2024-41059, CVE-2024-44987, CVE-2024-36020, CVE-2023-52599, CVE-2023-52639, CVE-2024-26668, CVE-2024-42094, CVE-2022-48938, CVE-2022-48733, CVE-2024-27397, CVE-2023-52578, CVE-2024-38560, CVE-2024-38538, CVE-2024-42310, CVE-2024-46722, CVE-2024-46800, CVE-2024-41095, CVE-2024-42104, CVE-2024-35877, CVE-2022-48943, CVE-2024-46743, CVE-2023-52531, CVE-2024-46757, CVE-2024-36953, CVE-2024-46756, CVE-2024-38596, CVE-2023-52612, CVE-2024-38637, CVE-2024-41071, CVE-2024-46759, CVE-2024-43882, CVE-2024-26675, CVE-2024-43854, CVE-2024-44942, CVE-2024-44998, CVE-2024-42240, CVE-2024-41089, CVE-2024-26636, CVE-2024-46738, CVE-2024-42309)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ATM drivers;
• Device frequency scaling framework;
• GPU drivers;
• Hardware monitoring drivers;
• VMware VMCI Driver;
• Network drivers;
• Device tree and open firmware driver;
• SCSI drivers;
• Greybus lights staging drivers;
• BTRFS file system;
• File systems infrastructure;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• Netfilter;
• Memory management;
• Ethernet bridge;
• IPv6 networking;
• IUCV driver;
• Logical Link layer;
• MAC80211 subsystem;
• NFC subsystem;
• Network traffic control;
• Unix domain sockets; (CVE-2023-52614, CVE-2024-26633, CVE-2024-46758, CVE-2024-46723, CVE-2023-52502, CVE-2024-41059, CVE-2024-44987, CVE-2024-36020, CVE-2023-52599, CVE-2023-52639, CVE-2024-26668, CVE-2024-42094, CVE-2022-48938, CVE-2022-48733, CVE-2024-27397, CVE-2023-52578, CVE-2024-38560, CVE-2024-38538, CVE-2024-42310, CVE-2024-46722, CVE-2024-46800, CVE-2024-41095, CVE-2024-42104, CVE-2024-35877, CVE-2022-48943, CVE-2024-46743, CVE-2023-52531, CVE-2024-46757, CVE-2024-36953, CVE-2024-46756, CVE-2024-38596, CVE-2023-52612, CVE-2024-38637, CVE-2024-41071, CVE-2024-46759, CVE-2024-43882, CVE-2024-26675, CVE-2024-43854, CVE-2024-44942, CVE-2024-44998, CVE-2024-42240, CVE-2024-41089, CVE-2024-26636, CVE-2024-46738, CVE-2024-42309)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ATM drivers;
• Device frequency scaling framework;
• GPU drivers;
• Hardware monitoring drivers;
• VMware VMCI Driver;
• Network drivers;
• Device tree and open firmware driver;
• SCSI drivers;
• Greybus lights staging drivers;
• BTRFS file system;
• File systems infrastructure;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• Netfilter;
• Memory management;
• Ethernet bridge;
• IPv6 networking;
• IUCV driver;
• Logical Link layer;
• MAC80211 subsystem;
• NFC subsystem;
• Network traffic control;
• Unix domain sockets; (CVE-2023-52614, CVE-2024-26633, CVE-2024-46758, CVE-2024-46723, CVE-2023-52502, CVE-2024-41059, CVE-2024-44987, CVE-2024-36020, CVE-2023-52599, CVE-2023-52639, CVE-2024-26668, CVE-2024-42094, CVE-2022-48938, CVE-2022-48733, CVE-2024-27397, CVE-2023-52578, CVE-2024-38560, CVE-2024-38538, CVE-2024-42310, CVE-2024-46722, CVE-2024-46800, CVE-2024-41095, CVE-2024-42104, CVE-2024-35877, CVE-2022-48943, CVE-2024-46743, CVE-2023-52531, CVE-2024-46757, CVE-2024-36953, CVE-2024-46756, CVE-2024-38596, CVE-2023-52612, CVE-2024-38637, CVE-2024-41071, CVE-2024-46759, CVE-2024-43882, CVE-2024-26675, CVE-2024-43854, CVE-2024-44942, CVE-2024-44998, CVE-2024-42240, CVE-2024-41089, CVE-2024-26636, CVE-2024-46738, CVE-2024-42309)

Lyu Tao discovered that the NFS implementation in the Linux kernel did not properly handle requests to open a directory on a regular file. A local attacker could use this to expose sensitive information (kernel memory).

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 architecture;
• ATM drivers;
• Device frequency scaling framework;
• GPU drivers;
• Hardware monitoring drivers;
• VMware VMCI Driver;
• MTD block device drivers;
• Network drivers;
• Device tree and open firmware driver;
• SCSI subsystem;
• USB Serial drivers;
• BTRFS file system;
• File systems infrastructure;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• Netfilter;
• Memory management;
• Ethernet bridge;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• NFC subsystem;
• Network traffic control; (CVE-2021-47055, CVE-2024-26675, CVE-2024-42244, CVE-2024-46743, CVE-2024-41095, CVE-2024-46756, CVE-2024-46723, CVE-2024-46759, CVE-2024-35877, CVE-2024-38538, CVE-2024-26668, CVE-2024-44998, CVE-2024-42309, CVE-2024-46758, CVE-2024-46800, CVE-2022-48733, CVE-2023-52531, CVE-2023-52599, CVE-2024-46722, CVE-2024-42240, CVE-2024-44987, CVE-2023-52502, CVE-2023-52578, CVE-2024-41059, CVE-2024-41071, CVE-2024-44942, CVE-2024-46738, CVE-2022-48943, CVE-2023-52614, CVE-2024-27397, CVE-2024-38560, CVE-2024-43882, CVE-2024-42104, CVE-2024-46757, CVE-2024-26636, CVE-2024-26633, CVE-2024-41089, CVE-2024-42310, CVE-2022-48938)