CVE-2023-53121

In the Linux kernel, the following vulnerability has been resolved: tcp: tcp_make_synack() can be called from process context tcp_rtx_synack() now could be called in process context as explained in 0a375c822497 ("tcp: tcp_rtx_synack() can be called from process context"). tcp_rtx_synack() might call tcp_make_synack(), which will touch per-CPU variables with preemption enabled. This causes the following BUG: BUG: using __this_cpu_add() in preemptible [00000000] code: ThriftIO1/5464 caller is tcp_make_synack+0x841/0xac0 Call Trace: <TASK> dump_stack_lvl+0x10d/0x1a0 check_preemption_disabled+0x104/0x110 tcp_make_synack+0x841/0xac0 tcp_v6_send_synack+0x5c/0x450 tcp_rtx_synack+0xeb/0x1f0 inet_rtx_syn_ack+0x34/0x60 tcp_check_req+0x3af/0x9e0 tcp_rcv_state_process+0x59b/0x2030 tcp_v6_do_rcv+0x5f5/0x700 release_sock+0x3a/0xf0 tcp_sendmsg+0x33/0x40 ____sys_sendmsg+0x2f2/0x490 __sys_sendmsg+0x184/0x230 do_syscall_64+0x3d/0x90 Avoid calling __TCP_INC_STATS() with will touch per-cpu variables. Use TCP_INC_STATS() which is safe to be called from context switch.

• KVM: x86: Fix shadow paging use-after-free due to unexpected role {CVE-2026-46113}
• KVM: x86: Fix shadow paging use-after-free due to unexpected GFN {CVE-2026-46113}
• Bluetooth: bcsp: receive data only if registered {CVE-2025-40308}
• xen/privcmd: unregister xenstore notifier on module exit {CVE-2026-31788}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts {CVE-2026-43429}
• net: usb: rtl8150: enable basic endpoint checking {CVE-2025-21708}
• net: usb: kaweth: validate USB endpoints {CVE-2026-23312}
• net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
• net: usb: pegasus: validate USB endpoints {CVE-2026-23290}
• net: usb: pegasus: enable basic endpoint checking {CVE-2026-43156}
• USB: usbcore: Introduce usb_bulk_msg_killable() {CVE-2026-43429}
• USB: core: Add routines for endpoint checks in old drivers {CVE-2026-43156}
• nf_tables: nft_dynset: fix possible stateful expression memleak in error path {CVE-2026-23399}
• tpm: Cap the number of PCR banks {CVE-2025-71077}
• clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() {CVE-2023-53704}
• dm: fix a race condition in retrieve_deps {CVE-2023-54324}
• ice: fix Tx scheduler error handling in XDP callback {CVE-2025-38127}
• mlx5: fix skb leak while fifo resync and push {CVE-2023-54238}
• mmc: vub300: fix return value check of mmc_add_host() {CVE-2022-50251}
• bonding: annotate data-races around slave->last_rx {CVE-2026-23212}
• RDMA/irdma: Fix data race on CQP completion stats {CVE-2023-54302}
• bpf: cpumap: Fix memory leak in cpu_map_update_elem {CVE-2023-53441}
• fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var {CVE-2025-38215}
• trace/fgraph: Fix the warning caused by missing unregister notifier {CVE-2025-39829}
• vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects {CVE-2025-39850}
• team: prevent adding a device which is already a team device lower {CVE-2024-58071}
• net: stmmac: move the EST lock to struct stmmac_priv {CVE-2024-38594}
• drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too {CVE-2024-50108}
• rxrpc: Fix handling of received connection abort {CVE-2024-58053}
• bnxt_en: Fix out-of-bound memcpy() during ethtool -w {CVE-2025-37911}
• scsi: storvsc: Ratelimit warning logs to prevent VM denial of service {CVE-2025-21690}
• net: atlantic: Fix DMA mapping for PTP hwts ring {CVE-2024-26680}
• wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() {CVE-2024-47713}
• drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2) {CVE-2024-49905}
• dm: fix NULL pointer dereference in __dm_suspend() {CVE-2025-40134}
• smb: client: validate the whole DACL before rewriting it in cifsacl {CVE-2026-31709}
• PM: runtime: Fix a race condition related to device removal {CVE-2026-23452}
• ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces {CVE-2026-43436}
• nvme-pci: Fix race bug in nvme_poll_irqdisable() {CVE-2026-43448}
• sctp: add mutual exclusion in proc_sctp_do_udp_port() {CVE-2025-22062}
• cachefiles: fix dentry leak in cachefiles_open_file() {CVE-2024-49870}
• mm: revert "mm: shmem: fix data-race in shmem_getattr()" {CVE-2024-53136}
• memcg: fix soft lockup in the OOM process {CVE-2024-57977}
• resource: fix region_intersects() vs add_memory_driver_managed() {CVE-2024-49878}
• r8169: add tally counter fields added with RTL8125 {CVE-2024-49973}
• svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() {CVE-2024-53215}
• ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths {CVE-2026-43066}
• wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() {CVE-2025-71273}
• net: netlink: af_netlink: Prevent empty skb by adding a check on len. {CVE-2021-47606}
• extcon: Modify extcon device to be created after driver data is set {CVE-2022-49308}
• tick/nohz: unexport __init-annotated tick_nohz_full_setup() {CVE-2022-49675}
• bridge:…

In the Linux kernel, the following vulnerability has been resolved:

tcp: tcp_make_synack() can be called from process context

tcp_rtx_synack() now could be called in process context as explained in 0a375c822497 ("tcp: tcp_rtx_synack() can be called from process context").

tcp_rtx_synack() might call tcp_make_synack(), which will touch per-CPU variables with preemption enabled. This causes the following BUG:

BUG: using __this_cpu_add() in preemptible [00000000] code: ThriftIO1/5464
caller is tcp_make_synack+0x841/0xac0
Call Trace:
 <TASK>
 dump_stack_lvl+0x10d/0x1a0
 check_preemption_disabled+0x104/0x110
 tcp_make_synack+0x841/0xac0
 tcp_v6_send_synack+0x5c/0x450
 tcp_rtx_synack+0xeb/0x1f0
 inet_rtx_syn_ack+0x34/0x60
 tcp_check_req+0x3af/0x9e0
 tcp_rcv_state_process+0x59b/0x2030
 tcp_v6_do_rcv+0x5f5/0x700
 release_sock+0x3a/0xf0
 tcp_sendmsg+0x33/0x40
 ____sys_sendmsg+0x2f2/0x490
 __sys_sendmsg+0x184/0x230
 do_syscall_64+0x3d/0x90

Avoid calling __TCP_INC_STATS() with will touch per-cpu variables. Use TCP_INC_STATS() which is safe to be called from context switch.

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47670: can: peak_usb: fix use after free bugs (bsc#1241407).
• CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
• CVE-2022-49145: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (bsc#1238162).
• CVE-2022-49168: btrfs: do not clean up repair bio if submit fails (bsc#1238109).
• CVE-2022-49190: kernel/resource: fix kfree() of bootmem memory again (bsc#1238130).
• CVE-2022-49212: mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init (bsc#1238331).
• CVE-2022-49216: drm/tegra: Fix reference leak in tegra_dsi_ganged_probe (bsc#1238338).
• CVE-2022-49235: ath9k_htc: fix uninit value bugs (bsc#1238333).
• CVE-2022-49248: ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction (bsc#1238284).
• CVE-2022-49253: media: usb: go7007: s2250-board: fix leak in probe() (bsc#1238420).
• CVE-2022-49320: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type (bsc#1238394).
• CVE-2022-49326: rtl818x: Prevent using not initialized queues (bsc#1238646).
• CVE-2022-49371: driver core: fix deadlock in __device_attach (bsc#1238546).
• CVE-2022-49382: soc: rockchip: Fix refcount leak in rockchip_grf_init (bsc#1238306).
• CVE-2022-49396: phy: qcom-qmp: fix reset-controller leak on probe errors (bsc#1238289).
• CVE-2022-49420: net: annotate races around sk->sk_bound_dev_if (bsc#1238887).
• CVE-2022-49441: tty: fix deadlock caused by calling printk() under tty_port->lock (bsc#1238263).
• CVE-2022-49445: pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() (bsc#1238019).
• CVE-2022-49460: PM / devfreq: rk3399_dmc: Disable edev on remove() (bsc#1238892).
• CVE-2022-49467: drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() (bsc#1238815).
• CVE-2022-49474: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout (bsc#1238071).
• CVE-2022-49491: drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() (bsc#1238539).
• CVE-2022-49503: ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix (bsc#1238868).
• CVE-2022-49592: net: stmmac: fix dma queue left shift overflow issue (bsc#1238311).
• CVE-2022-49625: sfc: fix kernel panic when creating VF (bsc#1238411).
• CVE-2022-49635: drm/i915/selftests: fix subtraction overflow bug (bsc#1238806).
• CVE-2022-49652: dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate (bsc#1238871).
• CVE-2022-49715: irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions (bsc#1238818).
• CVE-2022-49728: kABI workaround for changeing the variable length type to size_t (bsc#1239111).
• CVE-2022-49729: nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred (bsc#1239060).
• CVE-2022-49751: w1: fix WARNING after calling w1_process() (bsc#1240254).
• CVE-2022-49761: btrfs: always report error in run_one_delayed_ref() (bsc#1240261).
• CVE-2022-49772: ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (bsc#1242147).
• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2022-49776: macvlan: enforce a consistent minimal mtu (bsc#1242248).
• CVE-2022-49787: mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (bsc#1242352).
• CVE-2022-49788: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (bsc#1242353).
• CVE-2022-49813: net: ena: Fix error handling in ena_init() (bsc#1242497).
• CVE-2022-49821: mISDN: fix possible memory leak in mISDN_dsp_element_register() (bsc#1242542).
• CVE-2022-49826: ata: libata-transport: fix double ata_host_put() in ata_tport_add() (bsc#1242549).
• CVE-2022-49829: drm/scheduler: fix fence ref counting (bsc#1242691).
• CVE-2022-49832: pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (bsc#1242154).
• CVE-2022-49835: ALSA: hda: fix potential memleak in…