CVE-2023-52835

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: ep0: fix NULL pointer exception

There is no validation of the index from dwc3_wIndex_to_dep() and we might be referring a non-existing ep and trigger a NULL pointer exception. In certain configurations we might use fewer eps and the index might wrongly indicate a larger ep index than existing.

By adding this validation from the patch we can actually report a wrong index back to the caller.

In our usecase we are using a composite device on an older kernel, but upstream might use this fix also. Unfortunately, I cannot describe the hardware for others to reproduce the issue as it is a proprietary implementation.

[ 82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4 [ 82.966891] Mem abort info: [ 82.969663] ESR = 0x96000006 [ 82.972703] Exception class = DABT (current EL), IL = 32 bits [ 82.978603] SET = 0, FnV = 0 [ 82.981642] EA = 0, S1PTW = 0 [ 82.984765] Data abort info: [ 82.987631] ISV = 0, ISS = 0x00000006 [ 82.991449] CM = 0, WnR = 0 [ 82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc [ 83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000 [ 83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP [ 83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c) [ 83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1 [ 83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO) [ 83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c [ 83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94

...

[ 83.141788] Call trace: [ 83.144227] dwc3_ep0_handle_feature+0x414/0x43c [ 83.148823] dwc3_ep0_interrupt+0x3b4/0xc94 [ 83.181546] ---[ end trace aac6b5267d84c32f ]---(CVE-2021-47269)

In the Linux kernel, the following vulnerability has been resolved:

isdn: mISDN: netjet: Fix crash in nj_probe:

'nj_setup' in netjet.c might fail with -EIO and in this case 'card->irq' is initialized and is bigger than zero. A subsequent call to 'nj_release' will free the irq that has not been requested.

Fix this bug by deleting the previous assignment to 'card->irq' and just keep the assignment before 'request_irq'.

The KASAN's log reveals it:

[ 3.354615 ] WARNING: CPU: 0 PID: 1 at kernel/irq/manage.c:1826 free_irq+0x100/0x480 [ 3.355112 ] Modules linked in: [ 3.355310 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc1-00144-g25a1298726e #13 [ 3.355816 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 3.356552 ] RIP: 0010:free_irq+0x100/0x480 [ 3.356820 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18 4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5 ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80 [ 3.358012 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082 [ 3.358357 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX: 0000000000000000 [ 3.358814 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI: 00000000ffffffff [ 3.359272 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09: 0000000000000000 [ 3.359732 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12: 0000000000000000 [ 3.360195 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15: ffff888104dc80a8 [ 3.360652 ] FS: 0000000000000000(0000) GS:ffff88817bc00000(0000) knlGS:0000000000000000 [ 3.361170 ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3.361538 ] CR2: 0000000000000000 CR3: 000000000582e000 CR4: 00000000000006f0 [ 3.362003 ] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3.362175 ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 3.362175 ] Call Trace: [ …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: ep0: fix NULL pointer exception

There is no validation of the index from dwc3_wIndex_to_dep() and we might be referring a non-existing ep and trigger a NULL pointer exception. In certain configurations we might use fewer eps and the index might wrongly indicate a larger ep index than existing.

By adding this validation from the patch we can actually report a wrong index back to the caller.

In our usecase we are using a composite device on an older kernel, but upstream might use this fix also. Unfortunately, I cannot describe the hardware for others to reproduce the issue as it is a proprietary implementation.

[ 82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4 [ 82.966891] Mem abort info: [ 82.969663] ESR = 0x96000006 [ 82.972703] Exception class = DABT (current EL), IL = 32 bits [ 82.978603] SET = 0, FnV = 0 [ 82.981642] EA = 0, S1PTW = 0 [ 82.984765] Data abort info: [ 82.987631] ISV = 0, ISS = 0x00000006 [ 82.991449] CM = 0, WnR = 0 [ 82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc [ 83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000 [ 83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP [ 83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c) [ 83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1 [ 83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO) [ 83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c [ 83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94

...

[ 83.141788] Call trace: [ 83.144227] dwc3_ep0_handle_feature+0x414/0x43c [ 83.148823] dwc3_ep0_interrupt+0x3b4/0xc94 [ 83.181546] ---[ end trace aac6b5267d84c32f ]---(CVE-2021-47269)

In the Linux kernel, the following vulnerability has been resolved:

isdn: mISDN: netjet: Fix crash in nj_probe:

'nj_setup' in netjet.c might fail with -EIO and in this case 'card->irq' is initialized and is bigger than zero. A subsequent call to 'nj_release' will free the irq that has not been requested.

Fix this bug by deleting the previous assignment to 'card->irq' and just keep the assignment before 'request_irq'.

The KASAN's log reveals it:

[ 3.354615 ] WARNING: CPU: 0 PID: 1 at kernel/irq/manage.c:1826 free_irq+0x100/0x480 [ 3.355112 ] Modules linked in: [ 3.355310 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc1-00144-g25a1298726e #13 [ 3.355816 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 3.356552 ] RIP: 0010:free_irq+0x100/0x480 [ 3.356820 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18 4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5 ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80 [ 3.358012 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082 [ 3.358357 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX: 0000000000000000 [ 3.358814 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI: 00000000ffffffff [ 3.359272 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09: 0000000000000000 [ 3.359732 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12: 0000000000000000 [ 3.360195 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15: ffff888104dc80a8 [ 3.360652 ] FS: 0000000000000000(0000) GS:ffff88817bc00000(0000) knlGS:0000000000000000 [ 3.361170 ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3.361538 ] CR2: 0000000000000000 CR3: 000000000582e000 CR4: 00000000000006f0 [ 3.362003 ] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3.362175 ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 3.362175 ] Call Trace: [ …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume

In current code, when a PCI error state pci_channel_io_normal is detectd, it will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI driver will continue the execution of PCI resume callback report_resume by pci_walk_bridge, and the callback will go into amdgpu_pci_resume finally, where write lock is releasd unconditionally without acquiring such lock first. In this case, a deadlock will happen when other threads start to acquire the read lock.

To fix this, add a member in amdgpu_device strucutre to cache pci_channel_state, and only continue the execution in amdgpu_pci_resume when it's pci_channel_io_frozen.(CVE-2021-47421)

In the Linux kernel, the following vulnerability has been resolved:

ptp: Fix possible memory leak in ptp_clock_register()

I got memory leak as follows when doing fault injection test:

unreferenced object 0xffff88800906c618 (size 8): comm "i2c-idt82p33931", pid 4421, jiffies 4294948083 (age 13.188s) hex dump (first 8 bytes): 70 74 70 30 00 00 00 00 ptp0.... backtrace: [<00000000312ed458>] __kmalloc_track_caller+0x19f/0x3a0 [<0000000079f6e2ff>] kvasprintf+0xb5/0x150 [<0000000026aae54f>] kvasprintf_const+0x60/0x190 [<00000000f323a5f7>] kobject_set_name_vargs+0x56/0x150 [<000000004e35abdd>] dev_set_name+0xc0/0x100 [<00000000f20cfe25>] ptp_clock_register+0x9f4/0xd30 [ptp] [<000000008bb9f0de>] idt82p33_probe.cold+0x8b6/0x1561 [ptp_idt82p33]

When posix_clock_register() returns an error, the name allocated in dev_set_name() will be leaked, the put_device() should be used to give up the device reference, then the name will be freed in kobject_cleanup() and other memory will be freed in ptp_clock_release().(CVE-2021-47455)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebtables: fix memory leak when blob is malformed

The bug fix was incomplete, it "replaced" crash with a memory leak. The old code had an assignment to "ret" embedded into the conditional, restore this.(CVE-2022-48641)

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: single: fix potential NULL dereference

Added checking of pointer "function" in pcs_set_mux(). pinmux_generic_get_function() can return NULL and the pointer "function" was dereferenced without checking against NULL.

Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2022-48708)

In the Linux kernel, the following vulnerability has been resolved:

drm/tegra: dsi: Add missing check for of_find_device_by_node

Add check for the return value of of_find_device_by_node() and return the error if it fails in order to avoid NULL pointer dereference.(CVE-2023-52650)

In the Linux kernel, the following vulnerability has been resolved:

io_uring: drop any code related to SCM_RIGHTS

This is dead code after we dropped support for passing io_uring fds over SCM_RIGHTS, get rid of it.(CVE-2023-52656)

In the Linux kernel, the following vulnerability has been resolved:

net: atlantic: eliminate double free in error handling logic

Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called multiple times on same ring, if system is under stress and got memory allocation error.

Ring pointer was used as an indicator of failure, but this is not correct since only ring data is allocated/deallocated. Ring itself is an array member.

Changing ring allocation functions to return error code directly. This simplifies error handling and eliminates aq_ring_free on higher layer.(CVE-2023-52664)

In the Linux kernel, the following vulnerability has been…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume

In current code, when a PCI error state pci_channel_io_normal is detectd, it will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI driver will continue the execution of PCI resume callback report_resume by pci_walk_bridge, and the callback will go into amdgpu_pci_resume finally, where write lock is releasd unconditionally without acquiring such lock first. In this case, a deadlock will happen when other threads start to acquire the read lock.

To fix this, add a member in amdgpu_device strucutre to cache pci_channel_state, and only continue the execution in amdgpu_pci_resume when it's pci_channel_io_frozen.(CVE-2021-47421)

In the Linux kernel, the following vulnerability has been resolved:

ptp: Fix possible memory leak in ptp_clock_register()

I got memory leak as follows when doing fault injection test:

unreferenced object 0xffff88800906c618 (size 8): comm "i2c-idt82p33931", pid 4421, jiffies 4294948083 (age 13.188s) hex dump (first 8 bytes): 70 74 70 30 00 00 00 00 ptp0.... backtrace: [<00000000312ed458>] __kmalloc_track_caller+0x19f/0x3a0 [<0000000079f6e2ff>] kvasprintf+0xb5/0x150 [<0000000026aae54f>] kvasprintf_const+0x60/0x190 [<00000000f323a5f7>] kobject_set_name_vargs+0x56/0x150 [<000000004e35abdd>] dev_set_name+0xc0/0x100 [<00000000f20cfe25>] ptp_clock_register+0x9f4/0xd30 [ptp] [<000000008bb9f0de>] idt82p33_probe.cold+0x8b6/0x1561 [ptp_idt82p33]

When posix_clock_register() returns an error, the name allocated in dev_set_name() will be leaked, the put_device() should be used to give up the device reference, then the name will be freed in kobject_cleanup() and other memory will be freed in ptp_clock_release().(CVE-2021-47455)

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: single: fix potential NULL dereference

Added checking of pointer "function" in pcs_set_mux(). pinmux_generic_get_function() can return NULL and the pointer "function" was dereferenced without checking against NULL.

Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2022-48708)

In the Linux kernel, the following vulnerability has been resolved:

drm/tegra: dsi: Add missing check for of_find_device_by_node

Add check for the return value of of_find_device_by_node() and return the error if it fails in order to avoid NULL pointer dereference.(CVE-2023-52650)

In the Linux kernel, the following vulnerability has been resolved:

io_uring: drop any code related to SCM_RIGHTS

This is dead code after we dropped support for passing io_uring fds over SCM_RIGHTS, get rid of it.(CVE-2023-52656)

In the Linux kernel, the following vulnerability has been resolved:

net: atlantic: eliminate double free in error handling logic

Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called multiple times on same ring, if system is under stress and got memory allocation error.

Ring pointer was used as an indicator of failure, but this is not correct since only ring data is allocated/deallocated. Ring itself is an array member.

Changing ring allocation functions to return error code directly. This simplifies error handling and eliminates aq_ring_free on higher layer.(CVE-2023-52664)

In the Linux kernel, the following vulnerability has been resolved:

ACPI: LPIT: Avoid u32 multiplication overflow

In lpit_update_residency() there is a possibility of overflow in multiplication, if tsc_khz is large enough (> UINT_MAX/1000).

Change multiplication to mul_u32_u32().

Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2023-52683)

In the…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume

In current code, when a PCI error state pci_channel_io_normal is detectd, it will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI driver will continue the execution of PCI resume callback report_resume by pci_walk_bridge, and the callback will go into amdgpu_pci_resume finally, where write lock is releasd unconditionally without acquiring such lock first. In this case, a deadlock will happen when other threads start to acquire the read lock.

To fix this, add a member in amdgpu_device strucutre to cache pci_channel_state, and only continue the execution in amdgpu_pci_resume when it's pci_channel_io_frozen.(CVE-2021-47421)

In the Linux kernel, the following vulnerability has been resolved:

ptp: Fix possible memory leak in ptp_clock_register()

I got memory leak as follows when doing fault injection test:

unreferenced object 0xffff88800906c618 (size 8): comm "i2c-idt82p33931", pid 4421, jiffies 4294948083 (age 13.188s) hex dump (first 8 bytes): 70 74 70 30 00 00 00 00 ptp0.... backtrace: [<00000000312ed458>] __kmalloc_track_caller+0x19f/0x3a0 [<0000000079f6e2ff>] kvasprintf+0xb5/0x150 [<0000000026aae54f>] kvasprintf_const+0x60/0x190 [<00000000f323a5f7>] kobject_set_name_vargs+0x56/0x150 [<000000004e35abdd>] dev_set_name+0xc0/0x100 [<00000000f20cfe25>] ptp_clock_register+0x9f4/0xd30 [ptp] [<000000008bb9f0de>] idt82p33_probe.cold+0x8b6/0x1561 [ptp_idt82p33]

When posix_clock_register() returns an error, the name allocated in dev_set_name() will be leaked, the put_device() should be used to give up the device reference, then the name will be freed in kobject_cleanup() and other memory will be freed in ptp_clock_release().(CVE-2021-47455)

In the Linux kernel, the following vulnerability has been resolved:

net: enetc: deny offload of tc-based TSN features on VF interfaces

TSN features on the ENETC (taprio, cbs, gate, police) are configured through a mix of command BD ring messages and port registers: enetc_port_rd(), enetc_port_wr().

Port registers are a region of the ENETC memory map which are only accessible from the PCIe Physical Function. They are not accessible from the Virtual Functions.

Moreover, attempting to access these registers crashes the kernel:

$ echo 1 > /sys/bus/pci/devices/0000:00:00.0/sriov_numvfs pci 0000:00:01.0: [1957:ef00] type 00 class 0x020001 fsl_enetc_vf 0000:00:01.0: Adding to iommu group 15 fsl_enetc_vf 0000:00:01.0: enabling device (0000 -> 0002) fsl_enetc_vf 0000:00:01.0 eno0vf0: renamed from eth0 $ tc qdisc replace dev eno0vf0 root taprio num_tc 8 map 0 1 2 3 4 5 6 7
queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0
sched-entry S 0x7f 900000 sched-entry S 0x80 100000 flags 0x2 Unable to handle kernel paging request at virtual address ffff800009551a08 Internal error: Oops: 96000007 [#1] PREEMPT SMP pc : enetc_setup_tc_taprio+0x170/0x47c lr : enetc_setup_tc_taprio+0x16c/0x47c Call trace: enetc_setup_tc_taprio+0x170/0x47c enetc_setup_tc+0x38/0x2dc taprio_change+0x43c/0x970 taprio_init+0x188/0x1e0 qdisc_create+0x114/0x470 tc_modify_qdisc+0x1fc/0x6c0 rtnetlink_rcv_msg+0x12c/0x390

Split enetc_setup_tc() into separate functions for the PF and for the VF drivers. Also remove enetc_qos.o from being included into enetc-vf.ko, since it serves absolutely no purpose there.(CVE-2022-48645)

In the Linux kernel, the following vulnerability has been resolved:

drm/tegra: dsi: Add missing check for of_find_device_by_node

Add check for the return value of of_find_device_by_node() and return the error if it fails in order to avoid NULL pointer dereference.(CVE-2023-52650)

In the Linux kernel,…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

• kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number (CVE-2023-52881,RHV-2024-1001)

• kernel: ovl: fix leaked entry (CVE-2021-46972)

• kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)

• kernel: gro: fix ownership transfer (CVE-2024-35890)

• kernel: tls: (CVE-2024-26584, CVE-2024-26583, CVE-2024-26585)

• kernel: wifi: (CVE-2024-35789, CVE-2024-27410, CVE-2024-35838, CVE-2024-35845)

• kernel: mlxsw: (CVE-2024-35855, CVE-2024-35854, CVE-2024-35853, CVE-2024-35852, CVE-2024-36007)

• kernel: PCI interrupt mapping cause oops [rhel-8] (CVE-2021-46909)

• kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)

• kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng [rhel-8] (CVE-2023-52615)

• kernel: net/mlx5e: (CVE-2023-52626, CVE-2024-35835, CVE-2023-52667, CVE-2024-35959)

• kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)

• kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset [rhel-8] (CVE-2024-26801)

• kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)

• kernel: netfilter: nf_tables: use timestamp to check for set element timeout [rhel-8.10] (CVE-2024-27397)

• kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)

• kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)

• kernel: x86/mm/swap: (CVE-2024-26759, CVE-2024-26906)

• kernel: tipc: fix kernel warning when sending SYN message [rhel-8] (CVE-2023-52700)

• kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)

• kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)

• kernel: powerpc/imc-pmu/powernv: (CVE-2023-52675, CVE-2023-52686)

• kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs (CVE-2023-5090)

• kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)

• kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)

• kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)

• kernel: crypto: (CVE-2024-26974, CVE-2023-52669, CVE-2023-52813)

• kernel: net/mlx5/bnx2x/usb: (CVE-2024-35960, CVE-2024-35958, CVE-2021-47310, CVE-2024-26804, CVE-2021-47311, CVE-2024-26859, CVE-2021-47236, CVE-2023-52703)

• kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)

• kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

• kernel: USB/usbnet: (CVE-2023-52781, CVE-2023-52877, CVE-2021-47495)

• kernel: can: (CVE-2023-52878, CVE-2021-47456)

• kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)

• kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

Bug Fix(es):

• Kernel panic - kernel BUG at mm/slub.c:376! (JIRA:Rocky Linux-29783)

• Temporary values in FIPS integrity test should be zeroized [rhel-8.10.z] (JIRA:Rocky Linux-35361)

• Rocky Linux8.6 - kernel: s390/cpum_cf: make crypto counters upward compatible (JIRA:Rocky Linux-36048)

• [Rocky Linux8] blktests block/024 failed (JIRA:Rocky Linux-8130)

• Rocky Linux8.9: EEH injections results Error: Power fault on Port 0 and other call traces(Everest/1050/Shiner) (JIRA:Rocky Linux-14195)

• Latency spikes with Matrox G200 graphic cards (JIRA:Rocky Linux-36172)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: tls (CVE-2024-26585,CVE-2024-26584, CVE-2024-26583

• kernel-rt: kernel: PCI interrupt mapping cause oops [rhel-8] (CVE-2021-46909)

• kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)

• kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng (CVE-2023-52615)

• kernel-rt: kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)

• kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset CVE-2024-26801)

• kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)

• kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397)

• kernel: wifi: mac80211: (CVE-2024-35789, CVE-2024-35838, CVE-2024-35845)

• kernel: wifi: nl80211: reject iftype change with mesh ID change (CVE-2024-27410)

• kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

• kernel:TCP-spoofed ghost ACKs and leak initial sequence number (CVE-2023-52881)

• kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

• kernel: ovl: fix leaked dentry (CVE-2021-46972)

• kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)

• kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)

• kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)

• kernel: mm/swap: fix race when skipping swapcache (CVE-2024-26759)

• kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)

• kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906)

• kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)

• kernel: net/usb: kalmia: avoid printing uninitialized value on error path (CVE-2023-52703)

• kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs (CVE-2023-5090)

• kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)

• kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)

• kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)

• kernel: net/bnx2x: Prevent access to a freed page in page_pool (CVE-2024-26859)

• kernel: crypto: (CVE-2024-26974, CVE-2023-52813)

• kernel: can: (CVE-2023-52878, CVE-2021-47456)

• kernel: usb: (CVE-2023-52781, CVE-2023-52877)

• kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)

• kernel: usbnet: sanity check for maxpacket (CVE-2021-47495)

• kernel: gro: fix ownership transfer (CVE-2024-35890)

• kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)

• kernel: tipc: fix kernel warning when sending SYN message (CVE-2023-52700)

• kernel: net/mlx5/mlxsw: (CVE-2024-35960, CVE-2024-36007, CVE-2024-35855)

• kernel: net/mlx5e: (CVE-2024-35959, CVE-2023-52626, CVE-2024-35835)

• kernel: mlxsw: (CVE-2024-35854, CVE-2024-35853, CVE-2024-35852)

• kernel: net: (CVE-2024-35958, CVE-2021-47311, CVE-2021-47236, CVE-2021-47310)

• kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)

• kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)

• kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

Bug Fix(es):

• kernel-rt: update RT source tree to the latest Rocky Linux-8.10.z kernel (JIRA:Rocky Linux-40882)

• [rhel8.9][cxgb4]BUG: using smp_processor_id() in preemptible [00000000] code: ethtool/54735 (JIRA:Rocky Linux-8779)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

• kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number (CVE-2023-52881,RHV-2024-1001)

• kernel: ovl: fix leaked entry (CVE-2021-46972)

• kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)

• kernel: gro: fix ownership transfer (CVE-2024-35890)

• kernel: tls: (CVE-2024-26584, CVE-2024-26583, CVE-2024-26585)

• kernel: wifi: (CVE-2024-35789, CVE-2024-27410, CVE-2024-35838, CVE-2024-35845)

• kernel: mlxsw: (CVE-2024-35855, CVE-2024-35854, CVE-2024-35853, CVE-2024-35852, CVE-2024-36007)

• kernel: PCI interrupt mapping cause oops [rhel-8] (CVE-2021-46909)

• kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)

• kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng [rhel-8] (CVE-2023-52615)

• kernel: net/mlx5e: (CVE-2023-52626, CVE-2024-35835, CVE-2023-52667, CVE-2024-35959)

• kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)

• kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset [rhel-8] (CVE-2024-26801)

• kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)

• kernel: netfilter: nf_tables: use timestamp to check for set element timeout [rhel-8.10] (CVE-2024-27397)

• kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)

• kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)

• kernel: x86/mm/swap: (CVE-2024-26759, CVE-2024-26906)

• kernel: tipc: fix kernel warning when sending SYN message [rhel-8] (CVE-2023-52700)

• kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)

• kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)

• kernel: powerpc/imc-pmu/powernv: (CVE-2023-52675, CVE-2023-52686)

• kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs (CVE-2023-5090)

• kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)

• kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)

• kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)

• kernel: crypto: (CVE-2024-26974, CVE-2023-52669, CVE-2023-52813)

• kernel: net/mlx5/bnx2x/usb: (CVE-2024-35960, CVE-2024-35958, CVE-2021-47310, CVE-2024-26804, CVE-2021-47311, CVE-2024-26859, CVE-2021-47236, CVE-2023-52703)

• kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)

• kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

• kernel: USB/usbnet: (CVE-2023-52781, CVE-2023-52877, CVE-2021-47495)

• kernel: can: (CVE-2023-52878, CVE-2021-47456)

• kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)

• kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

Bug Fix(es):

• Kernel panic - kernel BUG at mm/slub.c:376! (JIRA:Rocky Linux SIG Cloud-29783)

• Temporary values in FIPS integrity test should be zeroized [rhel-8.10.z] (JIRA:Rocky Linux SIG Cloud-35361)

• Rocky Linux SIG Cloud8.6 - kernel: s390/cpum_cf: make crypto counters upward compatible (JIRA:Rocky Linux SIG Cloud-36048)

• [Rocky Linux SIG Cloud8] blktests block/024 failed (JIRA:Rocky Linux SIG Cloud-8130)

• Rocky Linux SIG Cloud8.9: EEH injections results Error: Power fault on Port 0 and other call traces(Everest/1050/Shiner) (JIRA:Rocky Linux SIG Cloud-14195)

• Latency spikes with Matrox G200 graphic cards (JIRA:Rocky Linux SIG Cloud-36172)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: perf/core: Bail out early if the request AUX area is out of bound When perf-record with a large AUX area, e.g 4GB, it fails with: #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory) and it reveals a WARNING with __alloc_pages(): ------------[ cut here ]------------ WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248 Call trace: __alloc_pages+0x1ec/0x248 __kmalloc_large_node+0xc0/0x1f8 __kmalloc_node+0x134/0x1e8 rb_alloc_aux+0xe0/0x298 perf_mmap+0x440/0x660 mmap_region+0x308/0x8a8 do_mmap+0x3c0/0x528 vm_mmap_pgoff+0xf4/0x1b8 ksys_mmap_pgoff+0x18c/0x218 __arm64_sys_mmap+0x38/0x58 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x58/0x188 do_el0_svc+0x34/0x50 el0_svc+0x34/0x108 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x1a4/0x1a8 'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to maintains AUX trace pages. The allocated page for this array is physically contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the size of pointer array crosses the limitation set by MAX_ORDER, it reveals a WARNING. So bail out early with -ENOMEM if the request AUX area is out of bound, e.g.: #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)
• kernel:TCP-spoofed ghost ACKs and leak leak initial sequence number (CVE-2023-52881,RHV-2024-1001)
• kernel: ovl: fix leaked dentry (CVE-2021-46972)
• kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)
• kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)
• kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)
• kernel: mm/swap: fix race when skipping swapcache (CVE-2024-26759)
• kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)
• kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)
• kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906)
• kernel: powerpc/powernv: Add a null pointer check in opal_event_init() (CVE-2023-52686)
• kernel: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (CVE-2023-52675)
• kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs (CVE-2023-5090)
• kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)
• kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)
• kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)
• kernel: net/bnx2x: Prevent access to a freed page in page_pool (CVE-2024-26859)
• kernel: crypto: qat - resolve race condition during AER recovery (CVE-2024-26974)
• kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)
• kernel: net/mlx5: Properly link new fs rules into the tree (CVE-2024-35960)
• kernel: net/mlx5e: Fix mlx5e_priv_init() cleanup flow (CVE-2024-35959)
• kernel: net: ena: Fix incorrect descriptor free behavior (CVE-2024-35958)
• kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)
• kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)
• kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)
• kernel: net: ti: fix UAF in tlan_remove_one (CVE-2021-47310)

Bug Fix(es):

• Kernel panic - kernel BUG at mm/slub.c:376! (JIRA:AlmaLinux-29783)
• Temporary values in FIPS integrity test should be zeroized [almalinux-8.10.z] (JIRA:AlmaLinux-35361)
• AlmaLinux8.6 - kernel: s390/cpum_cf: make crypto counters upward compatible (JIRA:AlmaLinux-36048)
• [AlmaLinux8] blktests block/024 failed (JIRA:AlmaLinux-8130)
• AlmaLinux8.9: EEH injections results Error: Power fault on Port 0 and other call traces(Everest/1050/Shiner) (JIRA:AlmaLinux-14195)
• Latency spikes with Matrox G200 graphic cards (JIRA:AlmaLinux-36172)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: tls (CVE-2024-26585,CVE-2024-26584, CVE-2024-26583
• kernel-rt: kernel: PCI interrupt mapping cause oops [almalinux-8] (CVE-2021-46909)
• kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)
• kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng (CVE-2023-52615)
• kernel-rt: kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)
• kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset CVE-2024-26801)
• kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)
• kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397)
• kernel: wifi: mac80211: (CVE-2024-35789, CVE-2024-35838, CVE-2024-35845)
• kernel: wifi: nl80211: reject iftype change with mesh ID change (CVE-2024-27410)
• kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)
• kernel:TCP-spoofed ghost ACKs and leak initial sequence number (CVE-2023-52881)
• kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)
• kernel: ovl: fix leaked dentry (CVE-2021-46972)
• kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)
• kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)
• kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)
• kernel: mm/swap: fix race when skipping swapcache (CVE-2024-26759)
• kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)
• kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906)
• kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)
• kernel: net/usb: kalmia: avoid printing uninitialized value on error path (CVE-2023-52703)
• kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs (CVE-2023-5090)
• kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)
• kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)
• kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)
• kernel: net/bnx2x: Prevent access to a freed page in page_pool (CVE-2024-26859)
• kernel: crypto: (CVE-2024-26974, CVE-2023-52813)
• kernel: can: (CVE-2023-52878, CVE-2021-47456)
• kernel: usb: (CVE-2023-52781, CVE-2023-52877)
• kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)
• kernel: usbnet: sanity check for maxpacket (CVE-2021-47495)
• kernel: gro: fix ownership transfer (CVE-2024-35890)
• kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)
• kernel: tipc: fix kernel warning when sending SYN message (CVE-2023-52700)
• kernel: net/mlx5/mlxsw: (CVE-2024-35960, CVE-2024-36007, CVE-2024-35855)
• kernel: net/mlx5e: (CVE-2024-35959, CVE-2023-52626, CVE-2024-35835)
• kernel: mlxsw: (CVE-2024-35854, CVE-2024-35853, CVE-2024-35852)
• kernel: net: (CVE-2024-35958, CVE-2021-47311, CVE-2021-47236, CVE-2021-47310)
• kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)
• kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)
• kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

Bug Fix(es):

• kernel-rt: update RT source tree to the latest AlmaLinux-8.10.z kernel (JIRA:AlmaLinux-40882)
• [almalinux8.9][cxgb4]BUG: using smp_processor_id() in preemptible [00000000] code: ethtool/54735 (JIRA:AlmaLinux-8779)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• ASoC: topology: Clean up route loading {CVE-2024-41069}
• ASoC: topology: Fix references to freed memory {CVE-2024-41069}
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt() {CVE-2024-35965}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35966}
• media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621}
• net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
• sch_htb: make htb_qlen_notify() idempotent {CVE-2025-37932}
• codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-37798}
• sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38350}
• sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38350}
• sch_htb: make htb_deactivate() idempotent {CVE-2025-38350}
• sch_cbq: make cbq_qlen_notify() idempotent {CVE-2025-38000}
• inet: fully convert sk->sk_rx_dst to RCU rules {CVE-2021-47103}
• scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
• scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
• vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
• USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
• nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
• virtio-net: Add validation for used length {CVE-2021-47352}
• watchdog: Fix possible use-after-free by calling del_timer_sync() {CVE-2021-47321}
• scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978}
• wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
• wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921}
• mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
• wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
• net: fix information leakage in /proc/net/ptype {CVE-2022-48757}
• crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
• perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
• net: ti: fix UAF in tlan_remove_one {CVE-2021-47310}
• wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
• net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
• net: add atomic_long_t to net_device_stats fields {CVE-2023-52578}
• media: dvb-core: Fix use-after-free due to race at dvb_register_device() {CVE-2022-45884}
• media: dvb-core: Fix use-after-free on race condition at dvb_frontend {CVE-2022-45885}
• xen/gntalloc: don't use gnttab_query_foreign_access() {CVE-2022-23039}
• xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
• xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23038}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292}
• gfs2: Fix length of holes reported at end-of-file
• gfs2: Only do glock put in gfs2_create_inode for free inodes
• gfs2: Fix use-after-free in gfs2_logd after withdraw
• gfs2: fix use-after-free in trans_drain
• gfs2: Clean up revokes on normal withdraws
• GFS2: gfs2_free_extlen can return an extent that is too long
• gfs2: Wipe jdata and ail1 in gfs2_journal_wipe, formerly gfs2_meta_wipe
• GFS2: Refactor gfs2_remove_from_journal
• GFS2: Only set PageChecked for jdata…

• ASoC: topology: Clean up route loading {CVE-2024-41069}
• ASoC: topology: Fix references to freed memory {CVE-2024-41069}
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt() {CVE-2024-35965}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35966}
• media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621}
• net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
• sch_htb: make htb_qlen_notify() idempotent {CVE-2025-37932}
• codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-37798}
• sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38350}
• sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38350}
• sch_htb: make htb_deactivate() idempotent {CVE-2025-38350}
• sch_cbq: make cbq_qlen_notify() idempotent {CVE-2025-38000}
• inet: fully convert sk->sk_rx_dst to RCU rules {CVE-2021-47103}
• scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
• scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
• vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
• USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
• nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
• virtio-net: Add validation for used length {CVE-2021-47352}
• watchdog: Fix possible use-after-free by calling del_timer_sync() {CVE-2021-47321}
• scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978}
• wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
• wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921}
• mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
• wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
• net: fix information leakage in /proc/net/ptype {CVE-2022-48757}
• crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
• perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
• net: ti: fix UAF in tlan_remove_one {CVE-2021-47310}
• wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
• net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
• net: add atomic_long_t to net_device_stats fields {CVE-2023-52578}
• media: dvb-core: Fix use-after-free due to race at dvb_register_device() {CVE-2022-45884}
• media: dvb-core: Fix use-after-free on race condition at dvb_frontend {CVE-2022-45885}
• xen/gntalloc: don't use gnttab_query_foreign_access() {CVE-2022-23039}
• xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
• xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23038}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292}
• gfs2: Fix length of holes reported at end-of-file
• gfs2: Only do glock put in gfs2_create_inode for free inodes
• gfs2: Fix use-after-free in gfs2_logd after withdraw
• gfs2: fix use-after-free in trans_drain
• gfs2: Clean up revokes on normal withdraws
• GFS2: gfs2_free_extlen can return an extent that is too long
• gfs2: Wipe jdata and ail1 in gfs2_journal_wipe, formerly gfs2_meta_wipe
• GFS2: Refactor gfs2_remove_from_journal
• GFS2: Only set PageChecked for jdata…

• ASoC: topology: Clean up route loading {CVE-2024-41069}
• ASoC: topology: Fix references to freed memory {CVE-2024-41069}
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt() {CVE-2024-35965}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35966}
• media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621}
• inet: fully convert sk->sk_rx_dst to RCU rules {CVE-2021-47103}
• scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
• scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
• vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
• USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
• nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
• virtio-net: Add validation for used length {CVE-2021-47352}
• watchdog: Fix possible use-after-free by calling del_timer_sync() {CVE-2021-47321}
• scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978}
• wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
• wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921}
• mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
• wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
• net: fix information leakage in /proc/net/ptype {CVE-2022-48757}
• crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
• perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
• net: ti: fix UAF in tlan_remove_one {CVE-2021-47310}
• wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
• net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
• net: add atomic_long_t to net_device_stats fields {CVE-2023-52578}
• media: dvb-core: Fix use-after-free due to race at dvb_register_device() {CVE-2022-45884}
• media: dvb-core: Fix use-after-free on race condition at dvb_frontend {CVE-2022-45885}
• xen/gntalloc: don't use gnttab_query_foreign_access() {CVE-2022-23039}
• xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
• xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23038}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292}

• mm: zswap: fix missing folio cleanup in writeback race path {CVE-2024-26832}
• mm: fix zswap writeback race condition {CVE-2023-53178}
• dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929}
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• gpio: davinci: Validate the obtained number of IRQs {CVE-2024-42092}
• ASoC: topology: Fix references to freed memory {CVE-2024-41069}
• Bluetooth: hci_sock: Fix not validating setsockopt user input {CVE-2024-35963}
• Bluetooth: ISO: Fix not validating setsockopt user input {CVE-2024-35964}
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
• dma-direct: Leak pages on dma_set_decrypted() failure {CVE-2024-35939}
• wifi: mwifiex: avoid possible NULL skb pointer dereference {CVE-2023-53384}
• md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request {CVE-2023-53380}
• icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
• thermal: core: prevent potential string overflow {CVE-2023-52868}
• drm/amdkfd: Fix shift out-of-bounds issue {CVE-2023-52816}
• drm/vkms: Fix null-ptr-deref in vkms_release() {CVE-2022-50369}
• nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
• net/mlx5: Fix tainted pointer delete is case of flow rules creation fail {CVE-2024-40940}
• ipvlan: add ipvlan_route_v6_outbound() helper {CVE-2023-52796}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
• platform/x86: wmi: remove unnecessary initializations
• perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
• net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• kobject_uevent: Fix OOB access within zap_modalias_env() {CVE-2024-42292}
• mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() {CVE-2023-53401}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
• drm/radeon: possible buffer overflow {CVE-2023-52867}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
• wifi: mac80211_hwsim: Fix possible NULL dereference {CVE-2023-53209}
• vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
• wifi: iwlwifi: fw: fix memory leak in debugfs {CVE-2023-53422}
• drm/amdgpu: fix memory leak in mes self test {CVE-2023-53370}
• skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
• md/raid10: fix leak of 'r10bio->remaining' for recovery {CVE-2023-53299}
• nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
• ppdev: Add an error check in register_device {CVE-2024-36015}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
• net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
• net: add atomic_long_t to net_device_stats fields {CVE-2024-26882}

• CVE-url: https://ubuntu.com/security/CVE-2022-43945
  • NFSD: Protect against send buffer overflow in NFSv3 READ
• Focal update: v5.4.285 upstream stable release (LP: #2089233) // CVE-2024-49924 // CVE-url: https://ubuntu.com/security/CVE-2024-49924
  • fbdev: pxafb: Fix possible use after free in pxafb_task()
• CVE-url: https://ubuntu.com/security/CVE-2025-38477
  • net/sched: sch_qfq: Fix race condition on qfq_aggregate
  • net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
• CVE-url: https://ubuntu.com/security/CVE-2025-38618
  • vsock: Do not allow binding to VMADDR_PORT_ANY
• CVE-url: https://ubuntu.com/security/CVE-2025-38617
  • net/packet: fix a race in packet_set_ring() and packet_notifier()
• CVE-url: https://ubuntu.com/security/CVE-2025-21796
  • nfsd: clear acl_access/acl_default after releasing them
• CVE-url: https://ubuntu.com/security/CVE-2022-48827
  • NFSD: Fix the behavior of READ near OFFSET_MAX
• CVE-url: https://ubuntu.com/security/CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
• CVE-url: https://ubuntu.com/security/CVE-2024-41069
  • ASoC: topology: Fix references to freed memory
  • ASoC: topology: Do not assign fields that are already set
  • ASoC: topology: Clean up route loading
• CVE-url: https://ubuntu.com/security/CVE-2024-56616
  • drm/dp_mst: Fix MST sideband message body length check
• Focal update: v5.4.261 upstream stable release (LP: #2049049) // CVE-url: https://ubuntu.com/security/CVE-2023-52868
  • thermal: core: prevent potential string overflow
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52836
  • locking/ww_mutex/test: Fix potential workqueue corruption
• CVE-2024-35965 // CVE-url: https://ubuntu.com/security/CVE-2024-35965
  • Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()
  • Bluetooth: L2CAP: Fix not validating setsockopt user input
• Focal update: v5.4.188 upstream stable release (LP: #1971496) // CVE-url: https://ubuntu.com/security/CVE-2022-49292
  • ALSA: oss: Fix PCM OSS buffer allocation overflow
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52835
  • perf/core: Bail out early if the request AUX area is out of bound
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52764
  • media: gspca: cpia1: shift-out-of-bounds in set_flicker
• Focal update: v5.4.261 upstream stable release (LP: #2049049) // CVE-url: https://ubuntu.com/security/CVE-2023-52864
  • platform/x86: wmi: Fix probe failure when failing to register WMI devices
  • platform/x86: wmi: remove unnecessary initializations
  • platform/x86: wmi: Fix opening of char device
• CVE-2024-35966 // CVE-url: https://ubuntu.com/security/CVE-2024-35966
  • Bluetooth: RFCOMM: Fix not validating setsockopt user input
• CVE-2024-35967 // CVE-url: https://ubuntu.com/security/CVE-2024-35966
  • Bluetooth: SCO: Fix not validating setsockopt user input
• Focal update: v5.4.291 upstream stable release (LP: #2106002) // CVE-2025-21704 // CVE-url: https://ubuntu.com/security/CVE-2025-21704
  • usb: cdc-acm: Check control transfer buffer size before access
• CVE-url: https://ubuntu.com/security/CVE-2025-38350
  • net/sched: Always pass notifications when child class becomes empty
• CVE-url: https://ubuntu.com/security/CVE-2025-37798
  • sch_htb: make htb_qlen_notify() idempotent

[ Ubuntu: 4.15.0-252.263 ]

• CVE-url: https://ubuntu.com/security/CVE-2022-43945
  • NFSD: Protect against send buffer overflow in NFSv3 READ
• Focal update: v5.4.285 upstream stable release (LP: #2089233) // CVE-2024-49924 // CVE-url: https://ubuntu.com/security/CVE-2024-49924
  • fbdev: pxafb: Fix possible use after free in pxafb_task()
• CVE-url: https://ubuntu.com/security/CVE-2025-38477
  • net/sched: sch_qfq: Fix race condition on qfq_aggregate
  • net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
• CVE-url: https://ubuntu.com/security/CVE-2025-38618
  • vsock: Do not allow binding to VMADDR_PORT_ANY
• CVE-url: https://ubuntu.com/security/CVE-2025-38617
  • net/packet: fix a race in packet_set_ring() and packet_notifier()
• CVE-url: https://ubuntu.com/security/CVE-2025-21796
  • nfsd: clear acl_access/acl_default after releasing them
• CVE-url: https://ubuntu.com/security/CVE-2022-48827
  • NFSD: Fix the behavior of READ near OFFSET_MAX
• CVE-url: https://ubuntu.com/security/CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
• CVE-url: https://ubuntu.com/security/CVE-2024-41069
  • ASoC: topology: Fix references to freed memory
  • ASoC: topology: Do not assign fields that are already set
  • ASoC: topology: Clean up route loading
• CVE-url: https://ubuntu.com/security/CVE-2024-56616
  • drm/dp_mst: Fix MST sideband message body length check
• Focal update: v5.4.261 upstream stable release (LP: #2049049) // CVE-url: https://ubuntu.com/security/CVE-2023-52868
  • thermal: core: prevent potential string overflow
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52836
  • locking/ww_mutex/test: Fix potential workqueue corruption
• CVE-2024-35965 // CVE-url: https://ubuntu.com/security/CVE-2024-35965
  • Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()
  • Bluetooth: L2CAP: Fix not validating setsockopt user input
• Focal update: v5.4.188 upstream stable release (LP: #1971496) // CVE-url: https://ubuntu.com/security/CVE-2022-49292
  • ALSA: oss: Fix PCM OSS buffer allocation overflow
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52835
  • perf/core: Bail out early if the request AUX area is out of bound
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52764
  • media: gspca: cpia1: shift-out-of-bounds in set_flicker
• Focal update: v5.4.261 upstream stable release (LP: #2049049) // CVE-url: https://ubuntu.com/security/CVE-2023-52864
  • platform/x86: wmi: Fix probe failure when failing to register WMI devices
  • platform/x86: wmi: remove unnecessary initializations
  • platform/x86: wmi: Fix opening of char device
• CVE-2024-35966 // CVE-url: https://ubuntu.com/security/CVE-2024-35966
  • Bluetooth: RFCOMM: Fix not validating setsockopt user input
• CVE-2024-35967 // CVE-url: https://ubuntu.com/security/CVE-2024-35966
  • Bluetooth: SCO: Fix not validating setsockopt user input
• Focal update: v5.4.291 upstream stable release (LP: #2106002) // CVE-2025-21704 // CVE-url: https://ubuntu.com/security/CVE-2025-21704
  • usb: cdc-acm: Check control transfer buffer size before access
• CVE-url: https://ubuntu.com/security/CVE-2025-38350
  • net/sched: Always pass notifications when child class becomes empty
• CVE-url: https://ubuntu.com/security/CVE-2025-37798
  • sch_htb: make htb_qlen_notify() idempotent

• CVE-url: https://ubuntu.com/security/CVE-2024-41069
  • ASoC: topology: Fix references to freed memory
  • ASoC: topology: Do not assign fields that are already set
  • ASoC: topology: Clean up route loading
• Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740) // CVE- url: https://ubuntu.com/security/CVE-2021-47149
  • net: fujitsu: fix potential null-ptr-deref
• CVE-url: https://ubuntu.com/security/CVE-2024-35849
  • btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
• CVE-url: https://ubuntu.com/security/CVE-2025-38618
  • vsock: Do not allow binding to VMADDR_PORT_ANY
• CVE-url: https://ubuntu.com/security/CVE-2025-38617
  • net/packet: fix a race in packet_set_ring() and packet_notifier()
• CVE-url: https://ubuntu.com/security/CVE-2025-21796
  • nfsd: clear acl_access/acl_default after releasing them
• Bionic update: upstream stable patchset 2021-08-03 (LP: #1938824) // CVE- url: https://ubuntu.com/security/CVE-2021-47319
  • virtio-blk: Fix memory leak among suspend/resume procedure
• Focal update: v5.4.285 upstream stable release (LP: #2089233) // CVE-2024-49924 // CVE-url: https://ubuntu.com/security/CVE-2024-49924
  • fbdev: pxafb: Fix possible use after free in pxafb_task()
• CVE-url: https://ubuntu.com/security/CVE-2022-48827
  • NFSD: Fix the behavior of READ near OFFSET_MAX
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48737
  • ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()
  • ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx()
• Focal update: v5.4.261 upstream stable release (LP: #2049049) // CVE-url: https://ubuntu.com/security/CVE-2023-52868
  • thermal: core: prevent potential string overflow
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE- url: https://ubuntu.com/security/CVE-2021-47633
  • ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
• CVE-url: https://ubuntu.com/security/CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
• Bionic update: upstream stable patchset 2021-12-03 (LP: #1953202) // CVE- url: https://ubuntu.com/security/CVE-2021-47475
  • comedi: vmk80xx: fix transfer-buffer overflows
  • comedi: vmk80xx: fix bulk-buffer overflow
  • comedi: vmk80xx: fix bulk and interrupt message timeouts
• Bionic update: upstream stable patchset 2021-11-12 (LP: #1950816) // CVE- url: https://ubuntu.com/security/CVE-2021-47497
  • nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
• CVE-2024-35965 // CVE-url: https://ubuntu.com/security/CVE-2024-35965
  • Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()
  • Bluetooth: L2CAP: Fix not validating setsockopt user input
• CVE-url: https://ubuntu.com/security/CVE-2024-56616
  • drm/dp_mst: Fix MST sideband message body length check
• Bionic update: upstream stable patchset 2022-07-25 (LP: #1982782) // CVE- url: https://ubuntu.com/security/CVE-2022-49407
  • dlm: fix plock invalid read
• Focal update: v5.4.188 upstream stable release (LP: #1971496) // CVE-url: https://ubuntu.com/security/CVE-2022-49292
  • ALSA: oss: Fix PCM OSS buffer allocation overflow
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52835
  • perf/core: Bail out early if the request AUX area is out of bound
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52764
  • media: gspca: cpia1: shift-out-of-bounds in set_flicker
• CVE-2024-35966 // CVE-url: https://ubuntu.com/security/CVE-2024-35966
  • Bluetooth: RFCOMM: Fix not validating setsockopt user input
• CVE-2024-35967 // CVE-url: https://ubuntu.com/security/CVE-2024-35966
  • Bluetooth:…

• mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory {CVE-2025-39883}
• comedi: aio_iiro_16: Fix bit shift out of bounds {CVE-2025-38529}
• comedi: das6402: Fix bit shift out of bounds {CVE-2025-38482}
• comedi: pcl812: Fix bit shift out of bounds {CVE-2025-38530}
• comedi: das16m1: Fix bit shift out of bounds {CVE-2025-38483}
• tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). {CVE-2025-40186}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• smb: client: let recv_done verify data_offset, data_length and remaining_data_length {CVE-2025-39933}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping {CVE-2025-40154}
• Bluetooth: hci_event: call disconnect callback before deleting conn {CVE-2023-53673}
• net: fix information leakage in /proc/net/ptype {CVE-2022-48757}
• net/mlx5e: fix a potential double-free in fs_any_create_groups {CVE-2023-52667}
• mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update {CVE-2024-35855}
• Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
• crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
• perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
• ext4: fix double-free of blocks due to wrong extents moved_len {CVE-2024-26704}
• stm class: Fix a double free in stm_register_device() {CVE-2024-38627}
• pinctrl: core: delete incorrect free in pinctrl_enable() {CVE-2024-36940}
• ipvlan: add ipvlan_route_v6_outbound() helper {CVE-2023-52796}
• wifi: ath11k: fix gtk offload status event locking {CVE-2023-52777}
• ice: fix memory corruption bug with suspend and rebuild {CVE-2024-35911}
• drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' {CVE-2024-27042}
• drm/i915/vma: Fix UAF on destroy against retire race {CVE-2024-26939}
• netfilter: nf_tables: prefer nft_chain_validate {CVE-2024-41042}
• Bluetooth: Fix potential use-after-free when clear keys {CVE-2023-53386}
• drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] {CVE-2024-46815}
• drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120}
• nbd: fix incomplete validation of ioctl arg {CVE-2023-53513}
• RDMA/rxe: Fix incomplete state save in rxe_requester {CVE-2023-53539}
• netfilter: nftables: exthdr: fix 4-byte stack OOB write
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
• iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid {CVE-2025-37927}
• drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• RDMA/rxe: Fix mr->map double free {CVE-2022-50543}
• ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}
• vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
• RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug {CVE-2025-38024}
• drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies {CVE-2025-40096}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• drm/i915: mark requests for GuC virtual engines to avoid use-after-free {CVE-2023-53552}
• net: atlantic: fix fragment overflow handling in RX path {CVE-2025-68301}
• net: atm: add lec_mutex {CVE-2025-38323}
• net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
• scsi: lpfc: Fix buffer free/clear order in deferred receive path…

• net/ieee802154: don't warn zero-sized raw_sendmsg() {CVE-2022-50706}
• bpf: Don't redirect packets with invalid pkt_len {CVE-2022-49975}
• media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
• ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network {CVE-2022-49865}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
• NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349}
• pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
• lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
• ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
• fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691}
• wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue {CVE-2022-50164}
• mptcp: fix race condition in mptcp_schedule_work() {CVE-2025-40258}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• xfrm: Duplicate SPI Handling {CVE-2025-39797}
• scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input {CVE-2022-50030}
• net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent {CVE-2022-48883}
• net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
• dm raid: fix address sanitizer warning in raid_resume {CVE-2022-50085}
• Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
• ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() {CVE-2022-50050}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
• nfs: fix UAF in direct writes {CVE-2024-26958}
• iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
• drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• ALSA: pcm: Fix potential data race at PCM memory allocation helpers {CVE-2023-54072}
• drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes {CVE-2023-53077}
• net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
• i40e: fix idx validation in config queues msg {CVE-2025-39971}
• loop: Fix use-after-free issues {CVE-2023-53111}
• fs: prevent out-of-bounds array speculation when closing a file descriptor {CVE-2023-53117}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• Bluetooth: hci_event: call disconnect callback before deleting conn {CVE-2023-53673}
• wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
• pid: take a reference when initializing cad_pid {CVE-2021-47118}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• iommu/amd: Fix potential buffer overflow in…

• net/ieee802154: don't warn zero-sized raw_sendmsg() {CVE-2022-50706}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
• ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• xfrm: Duplicate SPI Handling {CVE-2025-39797}
• scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input {CVE-2022-50030}
• net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent {CVE-2022-48883}
• net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
• dm raid: fix address sanitizer warning in raid_resume {CVE-2022-50085}
• ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() {CVE-2022-50050}
• nfs: fix UAF in direct writes {CVE-2024-26958}
• iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
• drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• ALSA: pcm: Fix potential data race at PCM memory allocation helpers {CVE-2023-54072}
• drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes {CVE-2023-53077}
• net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
• loop: Fix use-after-free issues {CVE-2023-53111}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• Bluetooth: hci_event: call disconnect callback before deleting conn {CVE-2023-53673}
• ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729}
• libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285}
• firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• drm/shmem-helper: Remove another errant put in error path {CVE-2023-53084}
• wifi: mac80211: Fix UAF in ieee80211_scan_rx() {CVE-2022-49934}
• drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() {CVE-2022-50185}
• ext4: fix undefined behavior in bit shift for ext4_check_flag_values {CVE-2022-50403}
• wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() {CVE-2022-50279}
• nbd: fix incomplete validation of ioctl arg {CVE-2023-53513}
• r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586}
• sctp: handle the error returned from sctp_auth_asoc_init_active_key {CVE-2022-50243}
• crypto: qat - resolve race condition during AER recovery {CVE-2024-39493}
• i40e: fix idx validation in config queues msg {CVE-2025-39971}
• netfilter: nf_tables: prefer nft_chain_validate {CVE-2024-41042}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
• netfilter: validate user input for expected length {CVE-2024-35962}
• wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
• Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
• wifi: iwlwifi: fix a memory corruption {CVE-2024-26610}
• pid: take a reference when initializing cad_pid {CVE-2021-47118}
• wifi: cfg80211: check A-MSDU format more carefully…

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Bail out early if the request AUX area is out of bound

When perf-record with a large AUX area, e.g 4GB, it fails with:

#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)

and it reveals a WARNING with __alloc_pages():

------------[ cut here ]------------
WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248
Call trace:
 __alloc_pages+0x1ec/0x248
 __kmalloc_large_node+0xc0/0x1f8
 __kmalloc_node+0x134/0x1e8
 rb_alloc_aux+0xe0/0x298
 perf_mmap+0x440/0x660
 mmap_region+0x308/0x8a8
 do_mmap+0x3c0/0x528
 vm_mmap_pgoff+0xf4/0x1b8
 ksys_mmap_pgoff+0x18c/0x218
 __arm64_sys_mmap+0x38/0x58
 invoke_syscall+0x50/0x128
 el0_svc_common.constprop.0+0x58/0x188
 do_el0_svc+0x34/0x50
 el0_svc+0x34/0x108
 el0t_64_sync_handler+0xb8/0xc0
 el0t_64_sync+0x1a4/0x1a8

'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to maintains AUX trace pages. The allocated page for this array is physically contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the size of pointer array crosses the limitation set by MAX_ORDER, it reveals a WARNING.

So bail out early with -ENOMEM if the request AUX area is out of bound, e.g.:

#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52754: media: imon: fix access to invalid resource for the second interface (bsc#1225490).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52764: media: gspca: cpia1: shift-out-of-bounds in set_flicker (bsc#1225571).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52832: wifi: mac80211: do not return unset power in ieee80211_get_tx_power() (bsc#1225577).
• CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958.
• CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
• CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
• CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
• CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
• CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
• CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
• CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
• CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
• CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
• CVE-2023-52869: pstore/platform: Add check for kstrdup (bsc#1225050).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2023-52882: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change (bsc#1225692).
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
• CVE-2024-26644: btrfs: do not abort filesystem when attempting to snapshot deleted subvolume (bsc#1221282bsc#1222072).
• CVE-2024-26720: mm: Avoid overflows in dirty throttling logic (bsc#1222364).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
• CVE-2024-26973: fat: fix uninitialized field in nostale filehandles (git-fixesbsc#1223641).
• CVE-2024-27432: net: ethernet: mtk_eth_soc: fix PPE hanging issue (bsc#1224716).
• CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
• CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
• CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (bsc#1224712).
• CVE-2024-35807: ext4: fix corruption during on-line resize (bsc#1224735).
• CVE-2024-35835: net/mlx5e: fix a double-free in arfs_create_groups (bsc#1224605).
• CVE-2024-35848: eeprom: at24: fix memory corruption race condition (bsc#1224612).
• CVE-2024-35857: icmp: prevent possible NULL dereferences from icmp_build_probe() (bsc#1224619).
• CVE-2024-35861:…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52754: media: imon: fix access to invalid resource for the second interface (bsc#1225490).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52764: media: gspca: cpia1: shift-out-of-bounds in set_flicker (bsc#1225571).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52832: wifi: mac80211: do not return unset power in ieee80211_get_tx_power() (bsc#1225577).
• CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52843: llc: verify mac len before…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958.
• CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
• CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
• CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
• CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
• CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
• CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
• CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
• CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
• CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
• CVE-2023-52869: pstore/platform: Add check for kstrdup (bsc#1225050).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2023-52882: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change (bsc#1225692).
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
• CVE-2024-26644: btrfs: do not abort filesystem when attempting to snapshot deleted subvolume (bsc#1221282, bsc#1222072).
• CVE-2024-26720: mm: Avoid overflows in dirty throttling logic (bsc#1222364).
• CVE-2024-26845: scsi: target: core: Add TMF to tmr_list handling (bsc#1223018).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
• CVE-2024-26973: fat: fix uninitialized field in nostale filehandles (bsc#1223641).
• CVE-2024-27432: net: ethernet: mtk_eth_soc: fix PPE hanging issue (bsc#1224716).
• CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
• CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
• CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (bsc#1224712).
• CVE-2024-35807: ext4: fix corruption during on-line resize (bsc#1224735).
• CVE-2024-35835: net/mlx5e: fix a double-free in arfs_create_groups (bsc#1224605).
• CVE-2024-35848: eeprom: at24: fix memory corruption race condition (bsc#1224612).
• CVE-2024-35857: icmp: prevent possible…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-10135: Legacy pairing and secure-connections pairing authentication Bluetooth might have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access (bsc#1171988).
• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47145: btrfs: do not BUG_ON in link_to_fixup_dir (bsc#1222005).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47201: iavf: free q_vectors before queues in iavf_disable_vf (bsc#1222792).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47275: bcache: avoid oversized read request in cache missing code path (bsc#1224965).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47328: blacklist.conf: bsc#1225047 CVE-2021-47328: breaks kABI Also, does not apply.
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47438: net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() (bsc#1225229)
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47498: dm rq: do not queue request to blk-mq during DM suspend (bsc#1225357).
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47520: can: pch_can: pch_can_rx_normal: fix use after free (bsc#1225431).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-39371: io_uring: check for non-NULL file pointer in io_file_can_poll() (bsc#1226990).
• CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
• CVE-2024-38610: drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() (bsc#1226758).
• CVE-2024-37354: btrfs: fix crash on racing fsync and size-extending write into prealloc (bsc#1227101).
• CVE-2024-36919: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (bsc#1225767).
• CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
• CVE-2024-38570: gfs2: Fix potential glock use-after-free on unmount (bsc#1226775).
• CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
• CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
• CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595).
• CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
• CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
• CVE-2023-52865: Add check for mtk_alloc_clk_data (bsc#1225086).
• CVE-2023-52821: Fixed a possible null pointer dereference (bsc#1225022).
• CVE-2023-52867: Fixed possible buffer overflow (bsc#1225009).
• CVE-2024-38578: ecryptfs: Fix buffer size for tag 66 packet (bsc#1226634,).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
• CVE-2023-52759: Ignore negated quota changes (bsc#1225560).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52864: Fixed opening of char device (bsc#1225132).
• CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).
• CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).
• CVE-2024-39301: net/9p: fix uninit-value in p9_client_rpc() (bsc#1226994).
• CVE-2024-35843: iommu/vt-d: Use device rbtree in iopf reporting path (bsc#1224751).
• CVE-2024-37078: nilfs2: fix potential kernel bug due to lack of writeback flag waiting (bsc#1227066).
• CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
• CVE-2024-36479: fpga: bridge: add owner module and take its refcount (bsc#1226949).
• CVE-2024-37021: fpga: manager: add owner module and take its refcount (bsc#1226950).
• CVE-2024-36281: net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules (bsc#1226799).
• CVE-2024-38580: epoll: be better about file lifetimes (bsc#1226610).
• CVE-2024-36478: null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' (bsc#1226841).
• CVE-2024-38636: f2fs: multidev: fix to recognize valid zero block address (bsc#1226879).
• CVE-2024-38661: s390/ap: Fix crash in AP internal function modify_bitmap() (bsc#1226996).
• CVE-2024-38564: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (bsc#1226789).
• CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).
• CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
• CVE-2024-36917: block: fix overflow in blk_ioctl_discard() (bsc#1225770).
• CVE-2024-38627: stm class: Fix a double free in stm_register_device() (bsc#1226857).
• CVE-2024-38603: drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset() (bsc#1226842).
• CVE-2024-38553: net: fec: remove .ndo_poll_controller to avoid deadlock (bsc#1226744).
• CVE-2024-38555: net/mlx5: Discard command completions in internal error (bsc#1226607).
• CVE-2024-38556:…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
• CVE-2024-40948: mm/page_table_check: fix crash on ZONE_DEVICE (bsc#1227801). -…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
• CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958).
• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47186: tipc: check for null after calling kmemdup (bsc#1222702).
• CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
• CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
• CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
• CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
• CVE-2021-47546: ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
• CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
• CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
• CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
• CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571).
• CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len. (bsc#1226555).
• CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
• CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
• CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
• CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
• CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071).
• CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869).
• CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
• CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
• CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52787: blk-mq: make…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-38417: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225600).
• CVE-2023-47210: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225601).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52458: Fixed check that partition length needs to be aligned with block size (bsc#1220428).
• CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52631: Fixed an NULL dereference bug (bsc#1222264 CVE-2023-52631).
• CVE-2023-52640: Fixed out-of-bounds in ntfs_listxattr (bsc#1222301).
• CVE-2023-52641: Fixed NULL ptr dereference checking at the end of attr_allocate_frame() (bsc#1222303)
• CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
• CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52659: Fixed to pfn_to_kaddr() not treated as a 64-bit type (bsc#1224442)
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52699: sysv: don't call sb_bread() with pointers_lock held (bsc#1224659).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52771: Fixed delete_endpoint() vs parent unregistration race (bsc#1225007).
• CVE-2023-52772: Fixed use-after-free in unix_stream_read_actor() (bsc#1224989).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52786: ext4: fix racy may inline data check in dio write (bsc#1224939).
• CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
• CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
• CVE-2023-52855: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (bsc#1225583).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2023-6238: Fixed kcalloc() arguments order (bsc#1217384).
• CVE-2024-21823: Fixed safety flag to struct ends (bsc#1223625).
• CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
• CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
• CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
• CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
• CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
• CVE-2024-26623: pds_core: Prevent race issues involving the adminq (bsc#1221057).
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086) -…

The SUSE Linux Enterprise Micro 6.0 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
• CVE-2024-40948: mm/page_table_check: fix crash on ZONE_DEVICE (bsc#1227801).
• CVE-2024-35890:…

The SUSE Linux Enterprise Micro 6.0 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()…