CVE-2023-52930

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential bit_17 double-free A userspace with multiple threads racing I915_GEM_SET_TILING to set the tiling to I915_TILING_NONE could trigger a double free of the bit_17 bitmask. (Or conversely leak memory on the transition to tiled.) Move allocation/free'ing of the bitmask within the section protected by the obj lock. [tursulin: Correct fixes tag and added cc stable.] (cherry picked from commit 10e0cbaaf1104f449d695c80bcacf930dcd3c42e)

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential bit_17 double-free A userspace with multiple threads racing I915_GEM_SET_TILING to set the tiling to I915_TILING_NONE could trigger a double free of the bit_17 bitmask. (Or conversely leak memory on the transition to tiled.) Move allocation/free'ing of the bitmask within the section protected by the obj lock. [tursulin: Correct fixes tag and added cc stable.] (cherry picked from commit 10e0cbaaf1104f449d695c80bcacf930dcd3c42e)

• rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow {CVE-2024-38577}
• tcp: fix mptcp DSS corruption due to large pmtu xmit {CVE-2024-50083}
• vsock: Keep the binding until socket destruction {CVE-2025-21756}
• memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove {CVE-2025-22020}
• drm/i915: Fix potential bit_17 double-free {CVE-2023-52930}
• netfilter: nft_tunnel: fix geneve_opt type confusion addition {CVE-2025-22056}
• mm: shmem: fix data-race in shmem_getattr() {CVE-2024-46828}
• nvmet-auth: assign dh_key to NULL after kfree_sensitive {CVE-2024-50215}
• net: explicitly clear the sk pointer, when pf->create fails {CVE-2024-50186}
• net: wwan: fix global oob in wwan_rtnl_policy {CVE-2024-50128}
• ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free {CVE-2024-49983}
• vhost_vdpa: assign irq bypass producer token correctly {CVE-2024-47748}
• wifi: rtw88: always wait for both firmware loading attempts {CVE-2024-47718}
• sched: sch_cake: fix bulk flow accounting logic for host fairness {CVE-2024-46828}
• fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF {CVE-2024-46786}
• net: bridge: mcast: wait for previous gc cycles when removing port {CVE-2024-44934}
• vhost/vsock: always initialize seqpacket_allow {CVE-2024-43873}
• ext4: check dot and dotdot of dx_root before making dir indexed {CVE-2024-42305}
• nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
• SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
• Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync {CVE-2024-53208}
• wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one {CVE-2024-56663}
• Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006}
• net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239095).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• Revert 'gfs2: Fix inode height consistency check (git-fixes).
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• cifs: Add a laundromat thread for cached directories (git-fixes).
• cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path (git-fixes).
• gfs2: Fix inode height consistency check (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• sched/membarrier: Fix redundant load of membarrier_state (bsc#1232743).
• smb3: allow controlling length of time directory entries are cached with dir leases (git-fixes).
• smb3: do not start laundromat thread when dir leases disabled (git-fixes).
• smb3: retrying on failed server close (git-fixes).
• smb: client: destroy cfid_put_wq on module exit (git-fixes).
• smb: client: disable directory caching when dir_cache_timeout is zero (git-fixes).
• smb: client: do not start laundromat thread on nohandlecache (git-fixes).
• smb: client: make laundromat a delayed worker (git-fixes).
• smb: client: properly close cfids on umount (bsc#1231432, bsc#1232299, bsc#1235599, bsc#1234896).
• tpm: send_data: Wait longer for the TPM to become ready (bsc#1235870).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21714: RDMA/mlx5: Fix implicit ODP use after free (bsc#1237890).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21732: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (bsc#1237877).
• CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).
• CVE-2025-21839: kABI: Fix kABI after backport od CVE-2025-21839 (bsc#1239061).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• RDMA/mlx5: Fix implicit ODP hang on parent deregistration (git-fixes)
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• gfs2: Fix inode height consistency check (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup (bsc#1240195).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• x86/bhi: Avoid warning in #DB handler due to BHI mitigation (git-fixes).
• x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (git-fixes).
• x86/bugs: Fix BHI documentation (git-fixes).
• x86/bugs: Fix BHI handling of RRSBA (git-fixes).
• x86/bugs: Fix BHI retpoline check (git-fixes).
• x86/bugs: Fix return type of spectre_bhi_state() (git-fixes).
• x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (git-fixes).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21714: RDMA/mlx5: Fix implicit ODP use after free (bsc#1237890).
• CVE-2025-21732: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (bsc#1237877).
• CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• RDMA/mlx5: Fix implicit ODP hang on parent deregistration (git-fixes)
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• gfs2: Fix inode height consistency check (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup (bsc#1240195).
• net: mana: Support holes in device list reply msg (bsc#1240133).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239095).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• cifs: Add a laundromat thread for cached directories (git-fixes).
• cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path (git-fixes).
• gfs2: Fix inode height consistency check (git-fixes).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• sched/membarrier: Fix redundant load of membarrier_state (bsc#1232743).
• smb: client: destroy cfid_put_wq on module exit (git-fixes).
• smb: client: disable directory caching when dir_cache_timeout is zero (git-fixes).
• smb: client: do not start laundromat thread on nohandlecache (git-fixes).
• smb: client: make laundromat a delayed worker (git-fixes).
• smb: client: properly close cfids on umount (bsc#1231432, bsc#1232299, bsc#1235599, bsc#1234896).
• smb3: allow controlling length of time directory entries are cached with dir leases (git-fixes).
• smb3: do not start laundromat thread when dir leases disabled (git-fixes).
• smb3: retrying on failed server close (git-fixes).
• tpm: send_data: Wait longer for the TPM to become ready (bsc#1235870).