CVE-2023-53112

In the Linux kernel, the following vulnerability has been resolved: drm/i915/sseu: fix max_subslices array-index-out-of-bounds access It seems that commit bc3c5e0809ae ("drm/i915/sseu: Don't try to store EU mask internally in UAPI format") exposed a potential out-of-bounds access, reported by UBSAN as following on a laptop with a gen 11 i915 card: UBSAN: array-index-out-of-bounds in drivers/gpu/drm/i915/gt/intel_sseu.c:65:27 index 6 is out of range for type 'u16 [6]' CPU: 2 PID: 165 Comm: systemd-udevd Not tainted 6.2.0-9-generic #9-Ubuntu Hardware name: Dell Inc. XPS 13 9300/077Y9N, BIOS 1.11.0 03/22/2022 Call Trace: <TASK> show_stack+0x4e/0x61 dump_stack_lvl+0x4a/0x6f dump_stack+0x10/0x18 ubsan_epilogue+0x9/0x3a __ubsan_handle_out_of_bounds.cold+0x42/0x47 gen11_compute_sseu_info+0x121/0x130 [i915] intel_sseu_info_init+0x15d/0x2b0 [i915] intel_gt_init_mmio+0x23/0x40 [i915] i915_driver_mmio_probe+0x129/0x400 [i915] ? intel_gt_probe_all+0x91/0x2e0 [i915] i915_driver_probe+0xe1/0x3f0 [i915] ? drm_privacy_screen_get+0x16d/0x190 [drm] ? acpi_dev_found+0x64/0x80 i915_pci_probe+0xac/0x1b0 [i915] ... According to the definition of sseu_dev_info, eu_mask->hsw is limited to a maximum of GEN_MAX_SS_PER_HSW_SLICE (6) sub-slices, but gen11_sseu_info_init() can potentially set 8 sub-slices, in the !IS_JSL_EHL(gt->i915) case. Fix this by reserving up to 8 slots for max_subslices in the eu_mask struct. (cherry picked from commit 3cba09a6ac86ea1d456909626eb2685596c07822)

• Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• padata: Fix pd UAF once and for all {CVE-2025-38584}
• wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• padata: Fix list iterator in padata_do_serial()
• padata: do not leak refcount in reorder_work {CVE-2025-38031}
• padata: avoid UAF for reorder_work {CVE-2025-21726}
• padata: add pd get/put refcnt helper
• net/smc: fix UAF on smcsk after smc_listen_out() {CVE-2025-38734}
• scsi: mpi3mr: Bad drive in topology results kernel crash {CVE-2023-53037}
• scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• drm/i915/sseu: fix max_subslices array-index-out-of-bounds access {CVE-2023-53112}
• i40e: fix idx validation in config queues msg {CVE-2025-39971}
• dm-bufio: don't schedule in atomic context {CVE-2025-37928}
• fs: prevent out-of-bounds array speculation when closing a file descriptor {CVE-2023-53117}
• vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
• iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid {CVE-2025-37927}
• tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
• KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• KVM: arm64: Tear down vGIC on failed vCPU creation {CVE-2025-37849}
• KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache {CVE-2022-49882}
• jbd2: remove wrong sb->s_sequence check {CVE-2025-37839}
• power: supply: gpio-charger: Fix set charge current limits {CVE-2024-57792}
• ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object {CVE-2024-46798}
• ipv6: prevent possible UAF in ip6_xmit() {CVE-2024-44985}
• ipv6: fix possible UAF in ip6_finish_output2() {CVE-2024-44986}
• netfilter: flowtable: validate vlan header {CVE-2024-44983}
• usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() {CVE-2024-50268}
• usb: vhci-hcd: Do not drop references before new references are gained {CVE-2024-43883}
• drm/amd/display: Fix slab-use-after-free on hdcp_work {CVE-2025-21968}
• drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] {CVE-2024-46815}
• drm/amd/display: Check index msg_id before read or write {CVE-2024-42121}
• drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120}
• drm/amdkfd: don't allow mapping the MMIO HDP page with large pages {CVE-2024-41011}
• drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
• drm/shmem-helper: Remove another errant put in error path {CVE-2023-53084}
• drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes {CVE-2023-53077}
• drm/i915: mark requests for GuC virtual engines to avoid use-after-free {CVE-2023-53552}
• ptp: fix integer overflow in max_vclocks_store {CVE-2024-40994}
• nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
• loop: Fix use-after-free issues {CVE-2023-53111}
• ftrace: Fix invalid address access in lookup_rec() when index is 0 {CVE-2023-53075}
• mptcp: use the workqueue to destroy unaccepted sockets {CVE-2023-53072}
• perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output {CVE-2023-53065}
• erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
• HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• coresight: Clear the connection field properly {CVE-2022-50214}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-53145}
• Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync {CVE-2025-39982}
• x86/tdx: Fix "in-kernel MMIO" check {CVE-2024-47727}
• arm64: sme: Use STR P to clear FFR context field in streaming SVE mode {CVE-2023-53713}
• wifi: mt76: mt7921: fix error code of return in…

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/sseu: fix max_subslices array-index-out-of-bounds access

It seems that commit bc3c5e0809ae ("drm/i915/sseu: Don't try to store EU mask internally in UAPI format") exposed a potential out-of-bounds access, reported by UBSAN as following on a laptop with a gen 11 i915 card:

UBSAN: array-index-out-of-bounds in drivers/gpu/drm/i915/gt/intel_sseu.c:65:27 index 6 is out of range for type 'u16 [6]' CPU: 2 PID: 165 Comm: systemd-udevd Not tainted 6.2.0-9-generic #9-Ubuntu Hardware name: Dell Inc. XPS 13 9300/077Y9N, BIOS 1.11.0 03/22/2022 Call Trace: <TASK> show_stack+0x4e/0x61 dump_stack_lvl+0x4a/0x6f dump_stack+0x10/0x18 ubsan_epilogue+0x9/0x3a __ubsan_handle_out_of_bounds.cold+0x42/0x47 gen11_compute_sseu_info+0x121/0x130 [i915] intel_sseu_info_init+0x15d/0x2b0 [i915] intel_gt_init_mmio+0x23/0x40 [i915] i915_driver_mmio_probe+0x129/0x400 [i915] ? intel_gt_probe_all+0x91/0x2e0 [i915] i915_driver_probe+0xe1/0x3f0 [i915] ? drm_privacy_screen_get+0x16d/0x190 [drm] ? acpi_dev_found+0x64/0x80 i915_pci_probe+0xac/0x1b0 [i915] ...

According to the definition of sseu_dev_info, eu_mask->hsw is limited to a maximum of GEN_MAX_SS_PER_HSW_SLICE (6) sub-slices, but gen11_sseu_info_init() can potentially set 8 sub-slices, in the !IS_JSL_EHL(gt->i915) case.

Fix this by reserving up to 8 slots for max_subslices in the eu_mask struct.

(cherry picked from commit 3cba09a6ac86ea1d456909626eb2685596c07822)

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).

The following non-security bugs were fixed:

• Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• Remove debug flavor (bsc#1243919).
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• net :mana :Add remaining GDMA stats for MANA to ethtool (bsc#1234395).
• net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (bsc#1234395).
• net: mana: Add gdma stats to ethtool output for mana (bsc#1234395).
• nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (bsc#1223096).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• tcp: Dump bound-only sockets in inet_diag (bsc#1204562).
• tpm, tpm_tis: Workaround failed command reception on Infineon devices (bsc#1235870).
• tpm: tis: Double the timeout B to 4s (bsc#1235870).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
• CVE-2024-28956: x86/its: Add support for ITS-safe indirect thunk (bsc#1242006).
• CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).

The following non-security bugs were fixed:

• Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• Move upstreamed sched/membarrier patch into sorted section
• Remove debug flavor (bsc#1243919). This is only released in Leap, and we do not have Leap 15.4 anymore.
• Remove debug flavor (bsc#1243919). This is only released in Leap, and we do not have Leap 15.5 anymore.
• Use gcc-13 for build on SLE16 (jsc#PED-10028).
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• net :mana :Add remaining GDMA stats for MANA to ethtool (bsc#1234395).
• net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (bsc#1234395).
• net: mana: Add gdma stats to ethtool output for mana (bsc#1234395).
• nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (bsc#1223096).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• rpm/kernel-binary.spec.in: Also order against update-bootloader (boo#1228659, boo#1240785, boo#1241038).
• rpm/kernel-binary.spec.in: Fix missing 20-kernel-default-extra.conf (bsc#1239986)
• rpm/kernel-binary.spec.in: fix KMPs build on 6.13+ (bsc#1234454)
• rpm/kernel-docs.spec.in: Workaround for reproducible builds (bsc#1238303)
• rpm/release-projects: Update the ALP projects again (bsc#1231293).
• rpm/split-modules: Fix optional splitting with usrmerge (bsc#1238570)
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• tcp: Dump bound-only sockets in inet_diag (bsc#1204562).
• tpm, tpm_tis: Workaround failed command reception on Infineon devices (bsc#1235870).
• tpm: tis: Double the timeout B to 4s (bsc#1235870).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
• CVE-2024-28956: x86/its: Add support for ITS-safe indirect thunk (bsc#1242006).
• CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).

The following non-security bugs were fixed:

• Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• Move upstreamed sched/membarrier patch into sorted section
• Remove debug flavor (bsc#1243919). This is only released in Leap, and we do not have Leap 15.4 anymore.
• Remove debug flavor (bsc#1243919). This is only released in Leap, and we do not have Leap 15.5 anymore.
• Use gcc-13 for build on SLE16 (jsc#PED-10028).
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• net :mana :Add remaining GDMA stats for MANA to ethtool (bsc#1234395).
• net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (bsc#1234395).
• net: mana: Add gdma stats to ethtool output for mana (bsc#1234395).
• nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (bsc#1223096).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• rpm/kernel-binary.spec.in: Also order against update-bootloader (boo#1228659, boo#1240785, boo#1241038).
• rpm/kernel-binary.spec.in: Fix missing 20-kernel-default-extra.conf (bsc#1239986)
• rpm/kernel-binary.spec.in: fix KMPs build on 6.13+ (bsc#1234454)
• rpm/kernel-docs.spec.in: Workaround for reproducible builds (bsc#1238303)
• rpm/release-projects: Update the ALP projects again (bsc#1231293).
• rpm/split-modules: Fix optional splitting with usrmerge (bsc#1238570)
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• tcp: Dump bound-only sockets in inet_diag (bsc#1204562).
• tpm, tpm_tis: Workaround failed command reception on Infineon devices (bsc#1235870).
• tpm: tis: Double the timeout B to 4s (bsc#1235870).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).