CVE-2023-52809

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume

In current code, when a PCI error state pci_channel_io_normal is detectd, it will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI driver will continue the execution of PCI resume callback report_resume by pci_walk_bridge, and the callback will go into amdgpu_pci_resume finally, where write lock is releasd unconditionally without acquiring such lock first. In this case, a deadlock will happen when other threads start to acquire the read lock.

To fix this, add a member in amdgpu_device strucutre to cache pci_channel_state, and only continue the execution in amdgpu_pci_resume when it's pci_channel_io_frozen.(CVE-2021-47421)

In the Linux kernel, the following vulnerability has been resolved:

ptp: Fix possible memory leak in ptp_clock_register()

I got memory leak as follows when doing fault injection test:

unreferenced object 0xffff88800906c618 (size 8): comm "i2c-idt82p33931", pid 4421, jiffies 4294948083 (age 13.188s) hex dump (first 8 bytes): 70 74 70 30 00 00 00 00 ptp0.... backtrace: [<00000000312ed458>] __kmalloc_track_caller+0x19f/0x3a0 [<0000000079f6e2ff>] kvasprintf+0xb5/0x150 [<0000000026aae54f>] kvasprintf_const+0x60/0x190 [<00000000f323a5f7>] kobject_set_name_vargs+0x56/0x150 [<000000004e35abdd>] dev_set_name+0xc0/0x100 [<00000000f20cfe25>] ptp_clock_register+0x9f4/0xd30 [ptp] [<000000008bb9f0de>] idt82p33_probe.cold+0x8b6/0x1561 [ptp_idt82p33]

When posix_clock_register() returns an error, the name allocated in dev_set_name() will be leaked, the put_device() should be used to give up the device reference, then the name will be freed in kobject_cleanup() and other memory will be freed in ptp_clock_release().(CVE-2021-47455)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebtables: fix memory leak when blob is malformed

The bug fix was incomplete, it "replaced" crash with a memory leak. The old code had an assignment to "ret" embedded into the conditional, restore this.(CVE-2022-48641)

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: single: fix potential NULL dereference

Added checking of pointer "function" in pcs_set_mux(). pinmux_generic_get_function() can return NULL and the pointer "function" was dereferenced without checking against NULL.

Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2022-48708)

In the Linux kernel, the following vulnerability has been resolved:

drm/tegra: dsi: Add missing check for of_find_device_by_node

Add check for the return value of of_find_device_by_node() and return the error if it fails in order to avoid NULL pointer dereference.(CVE-2023-52650)

In the Linux kernel, the following vulnerability has been resolved:

io_uring: drop any code related to SCM_RIGHTS

This is dead code after we dropped support for passing io_uring fds over SCM_RIGHTS, get rid of it.(CVE-2023-52656)

In the Linux kernel, the following vulnerability has been resolved:

net: atlantic: eliminate double free in error handling logic

Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called multiple times on same ring, if system is under stress and got memory allocation error.

Ring pointer was used as an indicator of failure, but this is not correct since only ring data is allocated/deallocated. Ring itself is an array member.

Changing ring allocation functions to return error code directly. This simplifies error handling and eliminates aq_ring_free on higher layer.(CVE-2023-52664)

In the Linux kernel, the following vulnerability has been…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume

In current code, when a PCI error state pci_channel_io_normal is detectd, it will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI driver will continue the execution of PCI resume callback report_resume by pci_walk_bridge, and the callback will go into amdgpu_pci_resume finally, where write lock is releasd unconditionally without acquiring such lock first. In this case, a deadlock will happen when other threads start to acquire the read lock.

To fix this, add a member in amdgpu_device strucutre to cache pci_channel_state, and only continue the execution in amdgpu_pci_resume when it's pci_channel_io_frozen.(CVE-2021-47421)

In the Linux kernel, the following vulnerability has been resolved:

ptp: Fix possible memory leak in ptp_clock_register()

I got memory leak as follows when doing fault injection test:

unreferenced object 0xffff88800906c618 (size 8): comm "i2c-idt82p33931", pid 4421, jiffies 4294948083 (age 13.188s) hex dump (first 8 bytes): 70 74 70 30 00 00 00 00 ptp0.... backtrace: [<00000000312ed458>] __kmalloc_track_caller+0x19f/0x3a0 [<0000000079f6e2ff>] kvasprintf+0xb5/0x150 [<0000000026aae54f>] kvasprintf_const+0x60/0x190 [<00000000f323a5f7>] kobject_set_name_vargs+0x56/0x150 [<000000004e35abdd>] dev_set_name+0xc0/0x100 [<00000000f20cfe25>] ptp_clock_register+0x9f4/0xd30 [ptp] [<000000008bb9f0de>] idt82p33_probe.cold+0x8b6/0x1561 [ptp_idt82p33]

When posix_clock_register() returns an error, the name allocated in dev_set_name() will be leaked, the put_device() should be used to give up the device reference, then the name will be freed in kobject_cleanup() and other memory will be freed in ptp_clock_release().(CVE-2021-47455)

In the Linux kernel, the following vulnerability has been resolved:

net: enetc: deny offload of tc-based TSN features on VF interfaces

TSN features on the ENETC (taprio, cbs, gate, police) are configured through a mix of command BD ring messages and port registers: enetc_port_rd(), enetc_port_wr().

Port registers are a region of the ENETC memory map which are only accessible from the PCIe Physical Function. They are not accessible from the Virtual Functions.

Moreover, attempting to access these registers crashes the kernel:

$ echo 1 > /sys/bus/pci/devices/0000:00:00.0/sriov_numvfs pci 0000:00:01.0: [1957:ef00] type 00 class 0x020001 fsl_enetc_vf 0000:00:01.0: Adding to iommu group 15 fsl_enetc_vf 0000:00:01.0: enabling device (0000 -> 0002) fsl_enetc_vf 0000:00:01.0 eno0vf0: renamed from eth0 $ tc qdisc replace dev eno0vf0 root taprio num_tc 8 map 0 1 2 3 4 5 6 7
queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0
sched-entry S 0x7f 900000 sched-entry S 0x80 100000 flags 0x2 Unable to handle kernel paging request at virtual address ffff800009551a08 Internal error: Oops: 96000007 [#1] PREEMPT SMP pc : enetc_setup_tc_taprio+0x170/0x47c lr : enetc_setup_tc_taprio+0x16c/0x47c Call trace: enetc_setup_tc_taprio+0x170/0x47c enetc_setup_tc+0x38/0x2dc taprio_change+0x43c/0x970 taprio_init+0x188/0x1e0 qdisc_create+0x114/0x470 tc_modify_qdisc+0x1fc/0x6c0 rtnetlink_rcv_msg+0x12c/0x390

Split enetc_setup_tc() into separate functions for the PF and for the VF drivers. Also remove enetc_qos.o from being included into enetc-vf.ko, since it serves absolutely no purpose there.(CVE-2022-48645)

In the Linux kernel, the following vulnerability has been resolved:

drm/tegra: dsi: Add missing check for of_find_device_by_node

Add check for the return value of of_find_device_by_node() and return the error if it fails in order to avoid NULL pointer dereference.(CVE-2023-52650)

In the Linux kernel,…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: usb: fix possible use-after-free in smsc75xx_bind

The commit 46a8b29c6306 ("net: usb: fix memory leak in smsc75xx_bind") fails to clean up the work scheduled in smsc75xx_reset-> smsc75xx_set_multicast, which leads to use-after-free if the work is scheduled to start after the deallocation. In addition, this patch also removes a dangling pointer - dev->data[0].

This patch calls cancel_work_sync to cancel the scheduled work and set the dangling pointer to NULL.(CVE-2021-47239)

In the Linux kernel, the following vulnerability has been resolved:

RDMA: Verify port when creating flow rule

Validate port value provided by the user and with that remove no longer needed validation by the driver. The missing check in the mlx5_ib driver could cause to the below oops.

Call trace: _create_flow_rule+0x2d4/0xf28 [mlx5_ib] mlx5_ib_create_flow+0x2d0/0x5b0 [mlx5_ib] ib_uverbs_ex_create_flow+0x4cc/0x624 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xd4/0x150 [ib_uverbs] ib_uverbs_cmd_verbs.isra.7+0xb28/0xc50 [ib_uverbs] ib_uverbs_ioctl+0x158/0x1d0 [ib_uverbs] do_vfs_ioctl+0xd0/0xaf0 ksys_ioctl+0x84/0xb4 __arm64_sys_ioctl+0x28/0xc4 el0_svc_common.constprop.3+0xa4/0x254 el0_svc_handler+0x84/0xa0 el0_svc+0x10/0x26c Code: b9401260 f9615681 51000400 8b001c20 (f9403c1a)(CVE-2021-47265)

In the Linux kernel, the following vulnerability has been resolved:

bcache: avoid oversized read request in cache missing code path

In the cache missing code path of cached device, if a proper location from the internal B+ tree is matched for a cache miss range, function cached_dev_cache_miss() will be called in cache_lookup_fn() in the following code block, [code block 1] 526 unsigned int sectors = KEY_INODE(k) == s->iop.inode 527 ? min_t(uint64_t, INT_MAX, 528 KEY_START(k) - bio->bi_iter.bi_sector) 529 : INT_MAX; 530 int ret = s->d->cache_miss(b, s, bio, sectors);

Here s->d->cache_miss() is the call backfunction pointer initialized as cached_dev_cache_miss(), the last parameter 'sectors' is an important hint to calculate the size of read request to backing device of the missing cache data.

Current calculation in above code block may generate oversized value of 'sectors', which consequently may trigger 2 different potential kernel panics by BUG() or BUG_ON() as listed below,

1. BUG_ON() inside bch_btree_insert_key(), [code block 2] 886 BUG_ON(b->ops->is_extents && !KEY_SIZE(k));
2. BUG() inside biovec_slab(), [code block 3] 51 default: 52 BUG(); 53 return NULL;

All the above panics are original from cached_dev_cache_miss() by the oversized parameter 'sectors'.

Inside cached_dev_cache_miss(), parameter 'sectors' is used to calculate the size of data read from backing device for the cache missing. This size is stored in s->insert_bio_sectors by the following lines of code, [code block 4] 909 s->insert_bio_sectors = min(sectors, bio_sectors(bio) + reada);

Then the actual key inserting to the internal B+ tree is generated and stored in s->iop.replace_key by the following lines of code, [code block 5] 911 s->iop.replace_key = KEY(s->iop.inode, 912 bio->bi_iter.bi_sector + s->insert_bio_sectors, 913 s->insert_bio_sectors); The oversized parameter 'sectors' may trigger panic 1) by BUG_ON() from the above code block.

And the bio sending to backing device for the missing data is allocated with hint from s->insert_bio_sectors by the following lines of code, [code block 6] 926 cache_bio = bio_alloc_bioset(GFP_NOWAIT, 927 …

The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):

CVE-2023-6040 CVE-2024-26595 CVE-2024-26600 CVE-2021-46984 CVE-2023-52478 CVE-2023-52476 CVE-2023-52522 CVE-2021-47101 CVE-2021-47097 CVE-2023-52605 CVE-2024-26638 CVE-2024-26645 CVE-2024-26665 CVE-2024-26720 CVE-2024-26717 CVE-2024-26769 CVE-2024-26846 CVE-2024-26894 CVE-2024-26880 CVE-2024-26855 CVE-2024-26923 CVE-2024-26939 CVE-2024-27013 CVE-2024-27042 CVE-2024-35809 CVE-2023-52683 CVE-2024-35884 CVE-2024-35877 CVE-2024-35944 CVE-2024-35989 CVE-2021-47412 CVE-2021-47393 CVE-2021-47386 CVE-2021-47385 CVE-2021-47384 CVE-2021-47383 CVE-2021-47432 CVE-2021-47352 CVE-2021-47338 CVE-2021-47321 CVE-2021-47289 CVE-2021-47287 CVE-2023-52798 CVE-2023-52809 CVE-2023-52817 CVE-2023-52840 CVE-2023-52800 CVE-2021-47441 CVE-2021-47466 CVE-2021-47455 CVE-2021-47497 CVE-2021-47560 CVE-2021-47527 CVE-2024-36883 CVE-2024-36922 CVE-2024-36920 CVE-2024-36902 CVE-2024-36953 CVE-2024-36939 CVE-2024-36919 CVE-2024-36901 CVE-2021-47582 CVE-2021-47609 CVE-2024-38619 CVE-2022-48754 CVE-2022-48760 CVE-2024-38581 CVE-2024-38579 CVE-2024-38570 CVE-2024-38559 CVE-2024-38558 CVE-2024-37356 CVE-2024-39471 CVE-2024-39499 CVE-2024-39501 CVE-2024-39506 CVE-2024-40904 CVE-2024-40911 CVE-2024-40912 CVE-2024-40929 CVE-2024-40931 CVE-2024-40941 CVE-2024-40954 CVE-2024-40958 CVE-2024-40959 CVE-2024-40960 CVE-2024-40972 CVE-2024-40977 CVE-2024-40978 CVE-2024-40988 CVE-2024-40989 CVE-2024-40995 CVE-2024-40997 CVE-2024-40998 CVE-2024-41005 CVE-2024-40901 CVE-2024-41007 CVE-2024-41008 CVE-2022-48804 CVE-2022-48836 CVE-2022-48866 CVE-2024-41090 CVE-2024-41091 CVE-2024-41012 CVE-2024-41013 CVE-2024-41014 CVE-2024-41023 CVE-2024-41035 CVE-2024-41038 CVE-2024-41039 CVE-2024-41040 CVE-2024-41041 CVE-2024-41044 CVE-2024-41055 CVE-2024-41056 CVE-2024-41060 CVE-2024-41064 CVE-2024-41065 CVE-2024-41071 CVE-2024-41076 CVE-2024-41097 CVE-2024-42084 CVE-2024-42090 CVE-2024-42094 CVE-2024-42096 CVE-2024-42114 CVE-2024-42124 CVE-2024-42131 CVE-2024-42152 CVE-2024-42154 CVE-2024-42225 CVE-2024-42226 CVE-2024-42228 CVE-2024-42237 CVE-2024-42238 CVE-2024-42240 CVE-2024-42246 CVE-2024-42322 CVE-2024-43830 CVE-2024-43871 For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() fc_lport_ptp_setup() did not check the return value of fc_rport_create() which can return NULL and would cause a NULL pointer dereference. Address this issue by checking return value of fc_rport_create() and log error message on fc_rport_create() failed.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: block: null pointer dereference in ioctl.c when length and logical block size are misaligned (CVE-2023-52458)
• kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (CVE-2024-26773)
• kernel: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel (CVE-2024-26737)
• kernel: dm: call the resume method on internal suspend (CVE-2024-26880)
• kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (CVE-2024-26852)
• kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)
• kernel: nfp: flower: handle acti_netdevs allocation failure (CVE-2024-27046)
• kernel: octeontx2-af: Use separate handlers for interrupts (CVE-2024-27030)
• kernel: icmp: prevent possible NULL dereferences from icmp_build_probe() (CVE-2024-35857)
• kernel: mlxbf_gige: call request_irq() after NAPI initialized (CVE-2024-35907)
• kernel: mlxbf_gige: stop interface during shutdown (CVE-2024-35885)
• kernel: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (CVE-2023-52809)
• kernel: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv (CVE-2021-47459)
• kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (CVE-2024-36924)
• kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (CVE-2024-36952)
• kernel: net: amd-xgbe: Fix skb data length underflow (CVE-2022-48743)
• kernel: epoll: be better about file lifetimes (CVE-2024-38580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):

CVE-2023-6040 CVE-2024-26595 CVE-2024-26600 CVE-2021-46984 CVE-2023-52478 CVE-2023-52476 CVE-2023-52522 CVE-2021-47101 CVE-2021-47097 CVE-2023-52605 CVE-2024-26638 CVE-2024-26645 CVE-2024-26665 CVE-2024-26720 CVE-2024-26717 CVE-2024-26769 CVE-2024-26846 CVE-2024-26894 CVE-2024-26880 CVE-2024-26855 CVE-2024-26923 CVE-2024-26939 CVE-2024-27013 CVE-2024-27042 CVE-2024-35809 CVE-2023-52683 CVE-2024-35884 CVE-2024-35877 CVE-2024-35944 CVE-2024-35989 CVE-2021-47412 CVE-2021-47393 CVE-2021-47386 CVE-2021-47385 CVE-2021-47384 CVE-2021-47383 CVE-2021-47432 CVE-2021-47352 CVE-2021-47338 CVE-2021-47321 CVE-2021-47289 CVE-2021-47287 CVE-2023-52798 CVE-2023-52809 CVE-2023-52817 CVE-2023-52840 CVE-2023-52800 CVE-2021-47441 CVE-2021-47466 CVE-2021-47455 CVE-2021-47497 CVE-2021-47560 CVE-2021-47527 CVE-2024-36883 CVE-2024-36922 CVE-2024-36920 CVE-2024-36902 CVE-2024-36953 CVE-2024-36939 CVE-2024-36919 CVE-2024-36901 CVE-2021-47582 CVE-2021-47609 CVE-2024-38619 CVE-2022-48754 CVE-2022-48760 CVE-2024-38581 CVE-2024-38579 CVE-2024-38570 CVE-2024-38559 CVE-2024-38558 CVE-2024-37356 CVE-2024-39471 CVE-2024-39499 CVE-2024-39501 CVE-2024-39506 CVE-2024-40904 CVE-2024-40911 CVE-2024-40912 CVE-2024-40929 CVE-2024-40931 CVE-2024-40941 CVE-2024-40954 CVE-2024-40958 CVE-2024-40959 CVE-2024-40960 CVE-2024-40972 CVE-2024-40977 CVE-2024-40978 CVE-2024-40988 CVE-2024-40989 CVE-2024-40995 CVE-2024-40997 CVE-2024-40998 CVE-2024-41005 CVE-2024-40901 CVE-2024-41007 CVE-2024-41008 CVE-2022-48804 CVE-2022-48836 CVE-2022-48866 CVE-2024-41090 CVE-2024-41091 CVE-2024-41012 CVE-2024-41013 CVE-2024-41014 CVE-2024-41023 CVE-2024-41035 CVE-2024-41038 CVE-2024-41039 CVE-2024-41040 CVE-2024-41041 CVE-2024-41044 CVE-2024-41055 CVE-2024-41056 CVE-2024-41060 CVE-2024-41064 CVE-2024-41065 CVE-2024-41071 CVE-2024-41076 CVE-2024-41097 CVE-2024-42084 CVE-2024-42090 CVE-2024-42094 CVE-2024-42096 CVE-2024-42114 CVE-2024-42124 CVE-2024-42131 CVE-2024-42152 CVE-2024-42154 CVE-2024-42225 CVE-2024-42226 CVE-2024-42228 CVE-2024-42237 CVE-2024-42238 CVE-2024-42240 CVE-2024-42246 CVE-2024-42322 CVE-2024-43830 CVE-2024-43871 For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-url: https://ubuntu.com/security/CVE-2024-26929
  • scsi: qla2xxx: Fix double free of fcport
• CVE-url: https://ubuntu.com/security/CVE-2024-35997
  • HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
• CVE-url: https://ubuntu.com/security/CVE-2023-52752
  • smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
• CVE-url: https://ubuntu.com/security/CVE-2024-27013
  • tun: limit printing rate when illegal packet received by tun dev
• CVE-url: https://ubuntu.com/security/CVE-2023-52809
  • scsi: libfc: Fixup disc_mutex handling
  • scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
• CVE-url: https://ubuntu.com/security/CVE-2024-26934
  • USB: core: Fix deadlock in usb_deauthorize_interface()
• CVE-url: https://ubuntu.com/security/CVE-2024-35978
  • Bluetooth: Fix memory leak in hci_req_sync_complete()
• CVE-url: https://ubuntu.com/security/CVE-2023-52806
  • ALSA: hda: Fix possible null-ptr-deref when assigning a stream
• CVE-url: https://ubuntu.com/security/CVE-2024-35984
  • i2c: smbus: fix NULL function pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2023-52817
  • drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
• CVE-url: https://ubuntu.com/security/CVE-2024-27020
  • netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
• CVE-url: https://ubuntu.com/security/CVE-2024-35982
  • batman-adv: Avoid infinite loop trying to resize local TT

• CVE-url: https://ubuntu.com/security/CVE-2024-26929
  • scsi: qla2xxx: Fix double free of fcport
• CVE-url: https://ubuntu.com/security/CVE-2024-35997
  • HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
• CVE-url: https://ubuntu.com/security/CVE-2023-52752
  • smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
• CVE-url: https://ubuntu.com/security/CVE-2024-27013
  • tun: limit printing rate when illegal packet received by tun dev
• CVE-url: https://ubuntu.com/security/CVE-2023-52809
  • scsi: libfc: Fixup disc_mutex handling
  • scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
• CVE-url: https://ubuntu.com/security/CVE-2024-26934
  • USB: core: Fix deadlock in usb_deauthorize_interface()
• CVE-url: https://ubuntu.com/security/CVE-2024-35978
  • Bluetooth: Fix memory leak in hci_req_sync_complete()
• CVE-url: https://ubuntu.com/security/CVE-2023-52806
  • ALSA: hda: Fix possible null-ptr-deref when assigning a stream
• CVE-url: https://ubuntu.com/security/CVE-2024-35984
  • i2c: smbus: fix NULL function pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2023-52817
  • drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
• CVE-url: https://ubuntu.com/security/CVE-2024-27020
  • netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
• CVE-url: https://ubuntu.com/security/CVE-2024-35982
  • batman-adv: Avoid infinite loop trying to resize local TT

• CVE-url: https://ubuntu.com/security/CVE-2022-48673
  • net/smc: Fix possible access to freed memory in link clear
• CVE-url: https://ubuntu.com/security/CVE-2024-35997
  • HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
• CVE-url: https://ubuntu.com/security/CVE-2023-52752
  • smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
• CVE-url: https://ubuntu.com/security/CVE-2022-48687
  • ipv6: sr: fix out-of-bounds read when setting HMAC data.
• CVE-url: https://ubuntu.com/security/CVE-2024-27013
  • tun: limit printing rate when illegal packet received by tun dev
• CVE-url: https://ubuntu.com/security/CVE-2024-27019
  • netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
• CVE-url: https://ubuntu.com/security/CVE-2023-52809
  • scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
• CVE-url: https://ubuntu.com/security/CVE-2024-26934
  • USB: core: Fix deadlock in usb_deauthorize_interface()
• CVE-url: https://ubuntu.com/security/CVE-2024-35978
  • Bluetooth: Fix memory leak in hci_req_sync_complete()
• CVE-url: https://ubuntu.com/security/CVE-2023-52753
  • drm/amd/display: Avoid NULL dereference of timing generator
• CVE-url: https://ubuntu.com/security/CVE-2023-52806
  • ALSA: hda: Fix possible null-ptr-deref when assigning a stream
• CVE-url: https://ubuntu.com/security/CVE-2024-35984
  • i2c: smbus: fix NULL function pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2023-52817
  • drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
• CVE-url: https://ubuntu.com/security/CVE-2024-27020
  • netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
• CVE-url: https://ubuntu.com/security/CVE-2024-35982
  • batman-adv: Avoid infinite loop trying to resize local TT
• CVE-url: https://ubuntu.com/security/CVE-2024-26929
  • scsi: qla2xxx: Fix double free of fcport
• CVE-url: https://ubuntu.com/security/CVE-2023-52802
  • iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()

• CVE-url: https://ubuntu.com/security/CVE-2022-48673
  • net/smc: Fix possible access to freed memory in link clear
• CVE-url: https://ubuntu.com/security/CVE-2024-35997
  • HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
• CVE-url: https://ubuntu.com/security/CVE-2023-52752
  • smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
• CVE-url: https://ubuntu.com/security/CVE-2022-48687
  • ipv6: sr: fix out-of-bounds read when setting HMAC data.
• CVE-url: https://ubuntu.com/security/CVE-2024-27013
  • tun: limit printing rate when illegal packet received by tun dev
• CVE-url: https://ubuntu.com/security/CVE-2024-27019
  • netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
• CVE-url: https://ubuntu.com/security/CVE-2023-52809
  • scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
• CVE-url: https://ubuntu.com/security/CVE-2024-26934
  • USB: core: Fix deadlock in usb_deauthorize_interface()
• CVE-url: https://ubuntu.com/security/CVE-2024-35978
  • Bluetooth: Fix memory leak in hci_req_sync_complete()
• CVE-url: https://ubuntu.com/security/CVE-2023-52753
  • drm/amd/display: Avoid NULL dereference of timing generator
• CVE-url: https://ubuntu.com/security/CVE-2023-52806
  • ALSA: hda: Fix possible null-ptr-deref when assigning a stream
• CVE-url: https://ubuntu.com/security/CVE-2024-35984
  • i2c: smbus: fix NULL function pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2023-52817
  • drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
• CVE-url: https://ubuntu.com/security/CVE-2024-27020
  • netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
• CVE-url: https://ubuntu.com/security/CVE-2024-35982
  • batman-adv: Avoid infinite loop trying to resize local TT
• CVE-url: https://ubuntu.com/security/CVE-2024-26929
  • scsi: qla2xxx: Fix double free of fcport
• CVE-url: https://ubuntu.com/security/CVE-2023-52802
  • iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()

• tun: add missing verification for short frame {CVE-2024-41091}
• tap: add missing verification for short frame {CVE-2024-41090}
• drm/amd/display: Fix potential index out of bounds in color transformation function {CVE-2024-38552}
• net: fix __dst_negative_advice() race {CVE-2024-36971}
• net: annotate data-races around sk->sk_dst_pending_confirm {CVE-2024-36971}
• net: fix out-of-bounds access in ops_init {CVE-2024-36883}
• net/sched: flower: Fix chain template offload {CVE-2024-26669}
• netfilter: nf_tables: use timestamp to check for set element timeout {CVE-2024-27397}
• netfilter: nft_set_rbtree: Remove unused variable nft_net {CVE-2024-27397}
• netfilter: nft_set_rbtree: prefer sync gc to async worker {CVE-2024-27397}
• netfilter: nft_set_rbtree: rename gc deactivate+erase function {CVE-2024-27397}
• netfilter: nf_tables: de-constify set commit ops function argument {CVE-2024-27397}
• netfilter: nft_set_rbtree: .deactivate fails if element has expired {CVE-2024-27397}
• sched/membarrier: reduce the ability to hammer on sys_membarrier {CVE-2024-26602}
• drm/vmwgfx: Fix possible null pointer derefence with invalid contexts {CVE-2022-38096}
• sched/psi: Fix use-after-free in ep_remove_wait_queue() {CVE-2023-52707}
• wait: add wake_up_pollfree() {CVE-2023-52707}
• x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2023-46813}
• x86/sev: Check IOBM for IOIO exceptions from user-space {CVE-2023-46813}
• x86/sev: Disable MMIO emulation from user mode {CVE-2023-46813}
• tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). {CVE-2024-37356}
• blk-cgroup: fix list corruption from reorder of WRITE ->lqueued {CVE-2024-38384}
• netfilter: complete validation of user input {CVE-2024-35962}
• SUNRPC: Fix UAF in svc_tcp_listen_data_ready() {CVE-2023-52885}
• PM / devfreq: Synchronize devfreq_monitor_[start/stop] {CVE-2023-52635}
• netfilter: validate user input for expected length {CVE-2024-35896}
• virtio: delete vq in vp_find_vqs_msix() when request_irq() fails {CVE-2024-37353}
• bnxt: prevent skb UAF after handing over to PTP worker {CVE-2022-48637}
• net: openvswitch: fix overwriting ct original tuple for ICMPv6 {CVE-2024-38558}
• net: core: reject skb_copy(_expand) for fraglist GSO skbs {CVE-2024-36929}
• rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation {CVE-2024-36017}
• ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound {CVE-2024-33621}
• drm/vmwgfx: Fix invalid reads in fence signaled events {CVE-2024-36960}
• gro: fix ownership transfer {CVE-2024-35890}
• mlxbf_gige: stop interface during shutdown {CVE-2024-35885}
• scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() {CVE-2023-52809}
• wifi: mt76: replace skb_put with skb_put_zero {CVE-2024-42225}
• drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc {CVE-2024-42228}
• scsi: mpi3mr: Sanitise num_phys {CVE-2024-42159}
• bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD {CVE-2024-42161}
• drm/amdgpu/mes: fix use-after-free issue {CVE-2024-38581}
• i40e: fix vf may be used uninitialized in this function warning {CVE-2024-36020}
• vt: fix unicode buffer corruption when deleting characters {CVE-2024-35823}
• ata: libata-core: Fix double free on error {CVE-2024-41087}
• netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path {CVE-2024-26925}
• tcp_metrics: validate source addr length {CVE-2024-42154}

• sch/netem: fix use after free in netem_dequeue {CVE-2024-46800}
• VMCI: Fix use-after-free when removing resource in vmci_resource_remove() {CVE-2024-46738}
• drm/amdgpu: Fix out-of-bounds write warning {CVE-2024-46725}
• drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number {CVE-2024-46724}
• drm/amdgpu: fix ucode out-of-bounds read warning {CVE-2024-46723}
• drm/amdgpu: fix mc_data out-of-bounds read warning {CVE-2024-46722}
• scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}
• ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
• exec: Fix ToCToU between perm check and set-uid/gid usage {CVE-2024-43882}
• dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
• RDMA/iwcm: Fix a use-after-free related to destroying CM IDs {CVE-2024-42285}
• tipc: Return non-zero value from tipc_udp_addr2str() on error {CVE-2024-42284}
• mISDN: Fix a use after free in hfcmulti_tx() {CVE-2024-42280}
• nvme: avoid double free special payload {CVE-2024-41073}
• wifi: mac80211: Avoid address calculations via out of bounds array indexing {CVE-2024-41071}
• xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• tunnels: fix out of bounds access when building IPv6 PMTU error {CVE-2024-26665}
• KVM: x86/mmu: make apf token non-zero to fix bug {CVE-2022-48943}
• cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}
• netfilter: fix use-after-free in __nf_register_net_hook() {CVE-2022-48912}
• rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() {CVE-2022-48742}
• selinux: fix double free of cond_list on error paths {CVE-2022-48740}
• ALSA: hda: Fix UAF of leds class devs at unbinding {CVE-2022-48735}
• drm/nouveau: fix off by one in BIOS boundary checking {CVE-2022-48732}
• mm, slub: fix potential memoryleak in kmem_cache_open() {CVE-2021-47466}
• x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25744}
• x86: Make IA32_EMULATION boot time configurable {CVE-2024-25744}
• x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() {CVE-2024-25744}
• x86/elf: Make loading of 32bit processes depend on ia32_enabled() {CVE-2024-25744}
• x86/entry: Rename ignore_sysret() {CVE-2024-25744}
• x86/cpu: Don't write CSTAR MSR on Intel CPUs {CVE-2024-25744}
• x86: Introduce ia32_enabled() {CVE-2024-25744}
• scsi: qedf: Make qedf_execute_tmf() non-preemptible {CVE-2024-42124}
• ftruncate: pass a signed offset {CVE-2024-42084}
• USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor {CVE-2024-41035}
• xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
• drm/radeon: fix UBSAN warning in kv_dpm.c {CVE-2024-40988}
• ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
• Input: cyapa - add missing input core locking to suspend/resume functions {CVE-2023-52884}
• Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() {CVE-2023-52840}
• wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
• wifi: ath11k: fix dfs radar event locking {CVE-2023-52798}
• ACPI: LPIT: Avoid u32 multiplication overflow {CVE-2023-52683}
• ACPI: extlog: fix NULL pointer dereference check {CVE-2023-52605}
• HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect {CVE-2023-52478}
• USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
• phylib: fix potential use-after-free {CVE-2022-48754}
• serial: core: fix transmit-buffer reset and memleak {CVE-2021-47527}
• nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
• mlxsw: thermal: Fix out-of-bounds memory accesses {CVE-2021-47441}
• hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs {CVE-2021-47393}
• hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47386}
• hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47385}
• hwmon: (w83793) Fix NULL pointer…

• sch/netem: fix use after free in netem_dequeue {CVE-2024-46800}
• VMCI: Fix use-after-free when removing resource in vmci_resource_remove() {CVE-2024-46738}
• drm/amdgpu: Fix out-of-bounds write warning {CVE-2024-46725}
• drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number {CVE-2024-46724}
• drm/amdgpu: fix ucode out-of-bounds read warning {CVE-2024-46723}
• drm/amdgpu: fix mc_data out-of-bounds read warning {CVE-2024-46722}
• scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}
• ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
• exec: Fix ToCToU between perm check and set-uid/gid usage {CVE-2024-43882}
• dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
• RDMA/iwcm: Fix a use-after-free related to destroying CM IDs {CVE-2024-42285}
• tipc: Return non-zero value from tipc_udp_addr2str() on error {CVE-2024-42284}
• mISDN: Fix a use after free in hfcmulti_tx() {CVE-2024-42280}
• nvme: avoid double free special payload {CVE-2024-41073}
• wifi: mac80211: Avoid address calculations via out of bounds array indexing {CVE-2024-41071}
• xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• tunnels: fix out of bounds access when building IPv6 PMTU error {CVE-2024-26665}
• KVM: x86/mmu: make apf token non-zero to fix bug {CVE-2022-48943}
• cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}
• netfilter: fix use-after-free in __nf_register_net_hook() {CVE-2022-48912}
• rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() {CVE-2022-48742}
• selinux: fix double free of cond_list on error paths {CVE-2022-48740}
• ALSA: hda: Fix UAF of leds class devs at unbinding {CVE-2022-48735}
• drm/nouveau: fix off by one in BIOS boundary checking {CVE-2022-48732}
• mm, slub: fix potential memoryleak in kmem_cache_open() {CVE-2021-47466}
• x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25744}
• x86: Make IA32_EMULATION boot time configurable {CVE-2024-25744}
• x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() {CVE-2024-25744}
• x86/elf: Make loading of 32bit processes depend on ia32_enabled() {CVE-2024-25744}
• x86/entry: Rename ignore_sysret() {CVE-2024-25744}
• x86/cpu: Don't write CSTAR MSR on Intel CPUs {CVE-2024-25744}
• x86: Introduce ia32_enabled() {CVE-2024-25744}
• x86/asm/64: Change all ENTRY+END to SYM_CODE_* {CVE-2024-25744}
• x86/head/64: Annotate start_cpu0() as non-callable {CVE-2024-25744}
• x86/asm: Do not annotate functions with GLOBAL {CVE-2024-25744}
• kprobes/x86/xen: blacklist non-attachable xen interrupt functions {CVE-2024-25744}
• x86/asm/64: Add ENDs to some functions and relabel with SYM_CODE_* {CVE-2024-25744}
• x86/asm: Use SYM_INNER_LABEL instead of GLOBAL {CVE-2024-25744}
• x86/asm: Annotate aliases {CVE-2024-25744}
• x86/asm/crypto: Annotate local functions {CVE-2024-25744}
• scsi: qedf: Make qedf_execute_tmf() non-preemptible {CVE-2024-42124}
• ftruncate: pass a signed offset {CVE-2024-42084}
• USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor {CVE-2024-41035}
• xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
• drm/radeon: fix UBSAN warning in kv_dpm.c {CVE-2024-40988}
• ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
• Input: cyapa - add missing input core locking to suspend/resume functions {CVE-2023-52884}
• Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() {CVE-2023-52840}
• wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
• wifi: ath11k: fix dfs radar event locking {CVE-2023-52798}
• ACPI: LPIT: Avoid u32 multiplication overflow {CVE-2023-52683}
• ACPI: extlog: fix NULL pointer dereference check {CVE-2023-52605}
• HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect {CVE-2023-52478}
• USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
• phylib: fix potential use-after-free {CVE-2022-48754}
• serial: core: fix transmit-buffer…

• firmware: cs_dsp: Return error if block header overflows file {CVE-2024-42238}
• scsi: qedf: Make qedf_execute_tmf() non-preemptible {CVE-2024-42124}
• ftruncate: pass a signed offset {CVE-2024-42084}
• firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files {CVE-2024-41056}
• firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
• USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor {CVE-2024-41035}
• xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
• netpoll: Fix race condition in netpoll_owner_active {CVE-2024-41005}
• drm/radeon: fix UBSAN warning in kv_dpm.c {CVE-2024-40988}
• ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
• scsi: mpi3mr: Avoid memcpy field-spanning write WARNING {CVE-2024-36920}
• dmaengine: idxd: Fix oops during rmmod on single-CPU platforms {CVE-2024-35989}
• udp: do not accept non-tunnel GSO skbs landing in a tunnel {CVE-2024-35884}
• nvme-fc: do not wait in vain when unloading module {CVE-2024-26846}
• drm/amdgpu: Fix the null pointer when load rlc firmware {CVE-2024-26649}
• Input: cyapa - add missing input core locking to suspend/resume functions {CVE-2023-52884}
• Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() {CVE-2023-52840}
• wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
• wifi: ath11k: fix dfs radar event locking {CVE-2023-52798}
• ACPI: LPIT: Avoid u32 multiplication overflow {CVE-2023-52683}
• ACPI: extlog: fix NULL pointer dereference check {CVE-2023-52605}
• HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect {CVE-2023-52478}
• USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
• phylib: fix potential use-after-free {CVE-2022-48754}
• serial: core: fix transmit-buffer reset and memleak {CVE-2021-47527}
• nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
• mlxsw: thermal: Fix out-of-bounds memory accesses {CVE-2021-47441}
• hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs {CVE-2021-47393}
• hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47386}
• hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47385}
• hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47384}
• virtio-net: Add validation for used length {CVE-2021-47352}
• fbmem: Do not delete the mode that is still in use {CVE-2021-47338}
• watchdog: Fix possible use-after-free by calling del_timer_sync() {CVE-2021-47321}
• ACPI: fix NULL pointer dereference {CVE-2021-47289}
• driver core: auxiliary bus: Fix memory leak when driver_register() fail {CVE-2021-47287}
• Input: elantech - fix stack out of bound access in elantech_change_report_id() {CVE-2021-47097}
• HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts {CVE-2022-48866}
• ipv6: prevent possible NULL dereference in rt6_probe() {CVE-2024-40960}
• xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() {CVE-2024-40959}
• wifi: iwlwifi: mvm: don't read past the mfuart notifcation {CVE-2024-40941}
• wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
• wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() {CVE-2024-40912}
• wifi: cfg80211: Lock wiphy in cfg80211_get_station {CVE-2024-40911}
• USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages {CVE-2024-40904}
• scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
• liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet {CVE-2024-39506}
• vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
• crypto: bcm - Fix pointer arithmetic {CVE-2024-38579}
• scsi: qedf: Ensure the copied buf is NUL terminated {CVE-2024-38559}
• net: openvswitch: fix overwriting ct original tuple for ICMPv6…

In the Linux kernel, the following vulnerability has been resolved:

scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()

fc_lport_ptp_setup() did not check the return value of fc_rport_create() which can return NULL and would cause a NULL pointer dereference. Address this issue by checking return value of fc_rport_create() and log error message on fc_rport_create() failed.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: block: null pointer dereference in ioctl.c when length and logical block size are misaligned (CVE-2023-52458)

• kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (CVE-2024-26773)

• kernel: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel (CVE-2024-26737)

• kernel: dm: call the resume method on internal suspend (CVE-2024-26880)

• kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (CVE-2024-26852)

• kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)

• kernel: nfp: flower: handle acti_netdevs allocation failure (CVE-2024-27046)

• kernel: octeontx2-af: Use separate handlers for interrupts (CVE-2024-27030)

• kernel: icmp: prevent possible NULL dereferences from icmp_build_probe() (CVE-2024-35857)

• kernel: mlxbf_gige: call request_irq() after NAPI initialized (CVE-2024-35907)

• kernel: mlxbf_gige: stop interface during shutdown (CVE-2024-35885)

• kernel: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (CVE-2023-52809)

• kernel: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv (CVE-2021-47459)

• kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (CVE-2024-36924)

• kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (CVE-2024-36952)

• kernel: net: amd-xgbe: Fix skb data length underflow (CVE-2022-48743)

• kernel: epoll: be better about file lifetimes (CVE-2024-38580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: block: null pointer dereference in ioctl.c when length and logical block size are misaligned (CVE-2023-52458)

• kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (CVE-2024-26773)

• kernel: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel (CVE-2024-26737)

• kernel: dm: call the resume method on internal suspend (CVE-2024-26880)

• kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (CVE-2024-26852)

• kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)

• kernel: nfp: flower: handle acti_netdevs allocation failure (CVE-2024-27046)

• kernel: octeontx2-af: Use separate handlers for interrupts (CVE-2024-27030)

• kernel: icmp: prevent possible NULL dereferences from icmp_build_probe() (CVE-2024-35857)

• kernel: mlxbf_gige: call request_irq() after NAPI initialized (CVE-2024-35907)

• kernel: mlxbf_gige: stop interface during shutdown (CVE-2024-35885)

• kernel: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (CVE-2023-52809)

• kernel: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv (CVE-2021-47459)

• kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (CVE-2024-36924)

• kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (CVE-2024-36952)

• kernel: net: amd-xgbe: Fix skb data length underflow (CVE-2022-48743)

• kernel: epoll: be better about file lifetimes (CVE-2024-38580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
• CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52660: Fiedx IRQ handling due to shared interrupts (bsc#1224443).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26715: Fixed NULL pointer dereference in dwc3_gadget_suspend (bsc#1222561).
• CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes bsc#1222608).
• CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
• CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
• CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
• CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
• CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
• CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
• CVE-2024-27042: Fixed potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (bsc#1223823).
• CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).
• CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181).
• CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr() (bsc#1224721)
• CVE-2024-27419: Fixed data-races around sysctl_net_busy_read (bsc#1224759)
• CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
• CVE-2024-35791: Flush pages under…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575).
• CVE-2024-36938: Fixed NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761).
• CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2024-35998: Fixed lock ordering potential deadlock in cifs_sync_mid_result (bsc#1224549).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
• CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
• CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break() (bsc#1224668).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
• CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
• CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
• CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key() (bsc#1224667).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-35869: Guarantee refcounted children from parent session (bsc#1224679).
• CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2024-35964: Fixed not validating setsockopt user input (bsc#1224581).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
• CVE-2024-35860: struct bpf_link and bpf_link_ops kABI workaround (bsc#1224531).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).
• CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).
• CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
• CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
• CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
• CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios (bsc#1224530).
• CVE-2024-35852: Fixed memory leak when canceling rehash work (bsc#1224502).
• CVE-2024-36006: Fixed incorrect list API usage (bsc#1224541).
• CVE-2024-36007: Fixed warning during rehash (bsc#1224543).
• CVE-2024-35885: Stop interface during shutdown (bsc#1224519).
• CVE-2024-35907: Call request_irq() after NAPI initialized (bsc#1224492).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
• CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52660: Fiedx IRQ handling due to shared interrupts (bsc#1224443).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26700: Fixed drm/amd/display: Fix MST Null Ptr for RV (bsc#1222870)
• CVE-2024-26715: Fixed NULL pointer dereference in dwc3_gadget_suspend (bsc#1222561).
• CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes bsc#1222608).
• CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
• CVE-2024-26777: Error out if pixclock equals zero in fbdev/sis (bsc#1222765)
• CVE-2024-26778: Error out if pixclock equals zero in fbdev/savage (bsc#1222770)
• CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26839: Fixed a memleak in init_credit_return() (bsc#1222975)
• CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
• CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
• CVE-2024-26907: Fixed a fortify source warning while accessing Eth segment in mlx5 (bsc#1223203).
• CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
• CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
• CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
• CVE-2024-27042: Fixed potential out-of-bounds access in…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52754: media: imon: fix access to invalid resource for the second interface (bsc#1225490).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52764: media: gspca: cpia1: shift-out-of-bounds in set_flicker (bsc#1225571).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52832: wifi: mac80211: do not return unset power in ieee80211_get_tx_power() (bsc#1225577).
• CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52754: media: imon: fix access to invalid resource for the second interface (bsc#1225490).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52764: media: gspca: cpia1: shift-out-of-bounds in set_flicker (bsc#1225571).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52832: wifi: mac80211: do not return unset power in ieee80211_get_tx_power() (bsc#1225577).
• CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52843: llc: verify mac len before…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-10135: Legacy pairing and secure-connections pairing authentication Bluetooth might have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access (bsc#1171988).
• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47145: btrfs: do not BUG_ON in link_to_fixup_dir (bsc#1222005).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47201: iavf: free q_vectors before queues in iavf_disable_vf (bsc#1222792).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47275: bcache: avoid oversized read request in cache missing code path (bsc#1224965).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47328: blacklist.conf: bsc#1225047 CVE-2021-47328: breaks kABI Also, does not apply.
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47438: net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() (bsc#1225229)
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47498: dm rq: do not queue request to blk-mq during DM suspend (bsc#1225357).
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47520: can: pch_can: pch_can_rx_normal: fix use after free (bsc#1225431).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-39371: io_uring: check for non-NULL file pointer in io_file_can_poll() (bsc#1226990).
• CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
• CVE-2024-38610: drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() (bsc#1226758).
• CVE-2024-37354: btrfs: fix crash on racing fsync and size-extending write into prealloc (bsc#1227101).
• CVE-2024-36919: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (bsc#1225767).
• CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
• CVE-2024-38570: gfs2: Fix potential glock use-after-free on unmount (bsc#1226775).
• CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
• CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
• CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595).
• CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
• CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
• CVE-2023-52865: Add check for mtk_alloc_clk_data (bsc#1225086).
• CVE-2023-52821: Fixed a possible null pointer dereference (bsc#1225022).
• CVE-2023-52867: Fixed possible buffer overflow (bsc#1225009).
• CVE-2024-38578: ecryptfs: Fix buffer size for tag 66 packet (bsc#1226634,).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
• CVE-2023-52759: Ignore negated quota changes (bsc#1225560).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52864: Fixed opening of char device (bsc#1225132).
• CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).
• CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).
• CVE-2024-39301: net/9p: fix uninit-value in p9_client_rpc() (bsc#1226994).
• CVE-2024-35843: iommu/vt-d: Use device rbtree in iopf reporting path (bsc#1224751).
• CVE-2024-37078: nilfs2: fix potential kernel bug due to lack of writeback flag waiting (bsc#1227066).
• CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
• CVE-2024-36479: fpga: bridge: add owner module and take its refcount (bsc#1226949).
• CVE-2024-37021: fpga: manager: add owner module and take its refcount (bsc#1226950).
• CVE-2024-36281: net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules (bsc#1226799).
• CVE-2024-38580: epoll: be better about file lifetimes (bsc#1226610).
• CVE-2024-36478: null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' (bsc#1226841).
• CVE-2024-38636: f2fs: multidev: fix to recognize valid zero block address (bsc#1226879).
• CVE-2024-38661: s390/ap: Fix crash in AP internal function modify_bitmap() (bsc#1226996).
• CVE-2024-38564: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (bsc#1226789).
• CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).
• CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
• CVE-2024-36917: block: fix overflow in blk_ioctl_discard() (bsc#1225770).
• CVE-2024-38627: stm class: Fix a double free in stm_register_device() (bsc#1226857).
• CVE-2024-38603: drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset() (bsc#1226842).
• CVE-2024-38553: net: fec: remove .ndo_poll_controller to avoid deadlock (bsc#1226744).
• CVE-2024-38555: net/mlx5: Discard command completions in internal error (bsc#1226607).
• CVE-2024-38556:…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
• CVE-2024-40948: mm/page_table_check: fix crash on ZONE_DEVICE (bsc#1227801). -…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-38417: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225600).
• CVE-2023-47210: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225601).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52458: Fixed check that partition length needs to be aligned with block size (bsc#1220428).
• CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52631: Fixed an NULL dereference bug (bsc#1222264 CVE-2023-52631).
• CVE-2023-52640: Fixed out-of-bounds in ntfs_listxattr (bsc#1222301).
• CVE-2023-52641: Fixed NULL ptr dereference checking at the end of attr_allocate_frame() (bsc#1222303)
• CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
• CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52659: Fixed to pfn_to_kaddr() not treated as a 64-bit type (bsc#1224442)
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52699: sysv: don't call sb_bread() with pointers_lock held (bsc#1224659).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52771: Fixed delete_endpoint() vs parent unregistration race (bsc#1225007).
• CVE-2023-52772: Fixed use-after-free in unix_stream_read_actor() (bsc#1224989).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52786: ext4: fix racy may inline data check in dio write (bsc#1224939).
• CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
• CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
• CVE-2023-52855: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (bsc#1225583).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2023-6238: Fixed kcalloc() arguments order (bsc#1217384).
• CVE-2024-21823: Fixed safety flag to struct ends (bsc#1223625).
• CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
• CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
• CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
• CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
• CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
• CVE-2024-26623: pds_core: Prevent race issues involving the adminq (bsc#1221057).
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086) -…

The SUSE Linux Enterprise Micro 6.0 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
• CVE-2024-40948: mm/page_table_check: fix crash on ZONE_DEVICE (bsc#1227801).
• CVE-2024-35890:…

The SUSE Linux Enterprise Micro 6.0 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()…

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash).

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• GPU drivers;
• Greybus drivers;
• Modular ISDN driver;
• Multiple devices driver;
• Network drivers;
• SCSI drivers;
• VFIO drivers;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• NILFS2 file system;
• Kernel debugger infrastructure;
• Bluetooth subsystem;
• IPv4 networking;
• L2TP protocol;
• Netfilter;
• RxRPC session sockets; (CVE-2024-42154, CVE-2023-52527, CVE-2024-26733, CVE-2024-42160, CVE-2021-47188, CVE-2024-38570, CVE-2024-26851, CVE-2024-26984, CVE-2024-26677, CVE-2024-39480, CVE-2024-27398, CVE-2022-48791, CVE-2024-42224, CVE-2024-38583, CVE-2024-40902, CVE-2023-52809, CVE-2024-39495, CVE-2024-26651, CVE-2024-26880, CVE-2024-42228, CVE-2024-27437, CVE-2022-48863)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash).

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• GPU drivers;
• Greybus drivers;
• Modular ISDN driver;
• Multiple devices driver;
• Network drivers;
• SCSI drivers;
• VFIO drivers;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• NILFS2 file system;
• Kernel debugger infrastructure;
• Bluetooth subsystem;
• IPv4 networking;
• L2TP protocol;
• Netfilter;
• RxRPC session sockets; (CVE-2024-42154, CVE-2023-52527, CVE-2024-26733, CVE-2024-42160, CVE-2021-47188, CVE-2024-38570, CVE-2024-26851, CVE-2024-26984, CVE-2024-26677, CVE-2024-39480, CVE-2024-27398, CVE-2022-48791, CVE-2024-42224, CVE-2024-38583, CVE-2024-40902, CVE-2023-52809, CVE-2024-39495, CVE-2024-26651, CVE-2024-26880, CVE-2024-42228, CVE-2024-27437, CVE-2022-48863)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• GPU drivers;
• Input Device (Tablet) drivers;
• Modular ISDN driver;
• Multiple devices driver;
• Network drivers;
• Near Field Communication (NFC) drivers;
• SCSI drivers;
• GCT GDM724x LTE driver;
• USB subsystem;
• VFIO drivers;
• GFS2 file system;
• JFS file system;
• NILFS2 file system;
• Networking core;
• IPv4 networking;
• L2TP protocol;
• Netfilter;
• RxRPC session sockets; (CVE-2024-26651, CVE-2024-38583, CVE-2023-52527, CVE-2024-26880, CVE-2022-48850, CVE-2024-26733, CVE-2021-47188, CVE-2024-42154, CVE-2023-52809, CVE-2024-42228, CVE-2022-48863, CVE-2022-48836, CVE-2022-48838, CVE-2024-26677, CVE-2024-27437, CVE-2022-48857, CVE-2022-48791, CVE-2021-47181, CVE-2024-26851, CVE-2024-40902, CVE-2022-48851, CVE-2024-38570)