CVE-2023-53148

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

sctp: handle the error returned from sctp_auth_asoc_init_active_key

When it returns an error from sctp_auth_asoc_init_active_key(), the active_key is actually not updated. The old sh_key will be freeed while it's still used as active key in asoc. Then an use-after-free will be triggered when sending patckets, as found by syzbot:

sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112 sctp_set_owner_w net/sctp/socket.c:132 [inline] sctp_sendmsg_to_asoc+0xbd5/0x1a20 net/sctp/socket.c:1863 sctp_sendmsg+0x1053/0x1d50 net/sctp/socket.c:2025 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734

This patch is to fix it by not replacing the sh_key when it returns errors from sctp_auth_asoc_init_active_key() in sctp_auth_set_key(). For sctp_auth_set_active_key(), old active_key_id will be set back to asoc->active_key_id when the same thing happens.(CVE-2022-50243)

In the Linux kernel, the following vulnerability has been resolved:

igb: Do not free q_vector unless new one was allocated

Avoid potential use-after-free condition under memory pressure. If the kzalloc() fails, q_vector will be freed but left in the original adapter->q_vector[v_idx] array position.(CVE-2022-50252)

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()

This patch fixes a stack-out-of-bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is passed as an argument of strsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware version string by memcpy() in brcmf_fil_iovar_data_get(). The patch ensures buf is null-terminated.

Found by a modified version of syzkaller.

[ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3 [ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available [ 47.601565][ T1897] ================================================================== [ 47.602574][ T1897] BUG: KASAN: stack-out-of-bounds in strsep+0x1b2/0x1f0 [ 47.603447][ T1897] Read of size 1 at addr ffffc90001f6f000 by task kworker/0:2/1897 [ 47.604336][ T1897] [ 47.604621][ T1897] CPU: 0 PID: 1897 Comm: kworker/0:2 Tainted: G O 5.14.0+ #131 [ 47.605617][ T1897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 47.606907][ T1897] Workqueue: usb_hub_wq hub_event [ 47.607453][ T1897] Call Trace: [ 47.607801][ T1897] dump_stack_lvl+0x8e/0xd1 [ 47.608295][ T1897] print_address_description.constprop.0.cold+0xf/0x334 [ 47.609009][ T1897] ? strsep+0x1b2/0x1f0 [ 47.609434][ T1897] ? strsep+0x1b2/0x1f0 [ 47.609863][ T1897] kasan_report.cold+0x83/0xdf [ 47.610366][ T1897] ? strsep+0x1b2/0x1f0 [ 47.610882][ T1897] strsep+0x1b2/0x1f0 [ 47.611300][ T1897] ? brcmf_fil_iovar_data_get+0x3a/0xf0 [ 47.611883][ T1897] brcmf_c_preinit_dcmds+0x995/0xc40 [ 47.612434][ T1897] ? brcmf_c_set_joinpref_default+0x100/0x100 [ 47.613078][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 47.613662][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 47.614208][ T1897] ? lock_acquire+0x19d/0x4e0 [ 47.614704][ T1897] ? find_held_lock+0x2d/0x110 [ 47.615236][ T1897] ? brcmf_usb_deq+0x1a7/0x260 [ 47.615741][ T1897] ? brcmf_usb_rx_fill_all+0x5a/0xf0 [ 47.616288][ T1897] brcmf_attach+0x246/0xd40 [ 47.616758][ T1897] ? wiphy_new_nm+0x1703/0x1dd0 [ 47.617280][ T1897] ? kmemdup+0x43/0x50 [ 47.617720][ T1897] brcmf_usb_probe+0x12de/0x1690 [ 47.618244][ T1897] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 [ 47.618901][ T1897] usb_probe_interface+0x2aa/0x760 [ …

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux SIG Cloud 8.10 Release Notes linked from the References section.

In the Linux kernel, the following vulnerability has been resolved: igb: Fix igb_down hung on surprise removal In a setup where a Thunderbolt hub connects to Ethernet and a display through USB Type-C, users may experience a hung task timeout when they remove the cable between the PC and the Thunderbolt hub. This is because the igb_down function is called multiple times when the Thunderbolt hub is unplugged. For example, the igb_io_error_detected triggers the first call, and the igb_remove triggers the second call. The second call to igb_down will block at napi_synchronize. Here's the call trace: __schedule+0x3b0/0xddb ? __mod_timer+0x164/0x5d3 schedule+0x44/0xa8 schedule_timeout+0xb2/0x2a4 ? run_local_timers+0x4e/0x4e msleep+0x31/0x38 igb_down+0x12c/0x22a [igb 6615058754948bfde0bf01429257eb59f13030d4] __igb_close+0x6f/0x9c [igb 6615058754948bfde0bf01429257eb59f13030d4] igb_close+0x23/0x2b [igb 6615058754948bfde0bf01429257eb59f13030d4] __dev_close_many+0x95/0xec dev_close_many+0x6e/0x103 unregister_netdevice_many+0x105/0x5b1 unregister_netdevice_queue+0xc2/0x10d unregister_netdev+0x1c/0x23 igb_remove+0xa7/0x11c [igb 6615058754948bfde0bf01429257eb59f13030d4] pci_device_remove+0x3f/0x9c device_release_driver_internal+0xfe/0x1b4 pci_stop_bus_device+0x5b/0x7f pci_stop_bus_device+0x30/0x7f pci_stop_bus_device+0x30/0x7f pci_stop_and_remove_bus_device+0x12/0x19 pciehp_unconfigure_device+0x76/0xe9 pciehp_disable_slot+0x6e/0x131 pciehp_handle_presence_or_link_change+0x7a/0x3f7 pciehp_ist+0xbe/0x194 irq_thread_fn+0x22/0x4d ? irq_thread+0x1fd/0x1fd irq_thread+0x17b/0x1fd ? irq_forced_thread_fn+0x5f/0x5f kthread+0x142/0x153 ? __irq_get_irqchip_state+0x46/0x46 ? kthread_associate_blkcg+0x71/0x71 ret_from_fork+0x1f/0x30 In this case, igb_io_error_detected detaches the network interface and requests a PCIE slot reset, however, the PCIE reset callback is not being invoked and thus the Ethernet connection breaks down. As the PCIE error in this case is a non-fatal one, requesting a slot reset can be avoided. This patch fixes the task hung issue and preserves Ethernet connection by ignoring non-fatal PCIE errors.

• Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• padata: Fix pd UAF once and for all {CVE-2025-38584}
• wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• padata: Fix list iterator in padata_do_serial()
• padata: do not leak refcount in reorder_work {CVE-2025-38031}
• padata: avoid UAF for reorder_work {CVE-2025-21726}
• padata: add pd get/put refcnt helper
• net/smc: fix UAF on smcsk after smc_listen_out() {CVE-2025-38734}
• scsi: mpi3mr: Bad drive in topology results kernel crash {CVE-2023-53037}
• scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• drm/i915/sseu: fix max_subslices array-index-out-of-bounds access {CVE-2023-53112}
• i40e: fix idx validation in config queues msg {CVE-2025-39971}
• dm-bufio: don't schedule in atomic context {CVE-2025-37928}
• fs: prevent out-of-bounds array speculation when closing a file descriptor {CVE-2023-53117}
• vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
• iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid {CVE-2025-37927}
• tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
• KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• KVM: arm64: Tear down vGIC on failed vCPU creation {CVE-2025-37849}
• KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache {CVE-2022-49882}
• jbd2: remove wrong sb->s_sequence check {CVE-2025-37839}
• power: supply: gpio-charger: Fix set charge current limits {CVE-2024-57792}
• ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object {CVE-2024-46798}
• ipv6: prevent possible UAF in ip6_xmit() {CVE-2024-44985}
• ipv6: fix possible UAF in ip6_finish_output2() {CVE-2024-44986}
• netfilter: flowtable: validate vlan header {CVE-2024-44983}
• usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() {CVE-2024-50268}
• usb: vhci-hcd: Do not drop references before new references are gained {CVE-2024-43883}
• drm/amd/display: Fix slab-use-after-free on hdcp_work {CVE-2025-21968}
• drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] {CVE-2024-46815}
• drm/amd/display: Check index msg_id before read or write {CVE-2024-42121}
• drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120}
• drm/amdkfd: don't allow mapping the MMIO HDP page with large pages {CVE-2024-41011}
• drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
• drm/shmem-helper: Remove another errant put in error path {CVE-2023-53084}
• drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes {CVE-2023-53077}
• drm/i915: mark requests for GuC virtual engines to avoid use-after-free {CVE-2023-53552}
• ptp: fix integer overflow in max_vclocks_store {CVE-2024-40994}
• nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
• loop: Fix use-after-free issues {CVE-2023-53111}
• ftrace: Fix invalid address access in lookup_rec() when index is 0 {CVE-2023-53075}
• mptcp: use the workqueue to destroy unaccepted sockets {CVE-2023-53072}
• perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output {CVE-2023-53065}
• erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
• HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• coresight: Clear the connection field properly {CVE-2022-50214}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-53145}
• Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync {CVE-2025-39982}
• x86/tdx: Fix "in-kernel MMIO" check {CVE-2024-47727}
• arm64: sme: Use STR P to clear FFR context field in streaming SVE mode {CVE-2023-53713}
• wifi: mt76: mt7921: fix error code of return in…

• wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921}
• ASoC: topology: Fix references to freed memory {CVE-2024-41069}
• net/sched: act_mirred: don't override retval if we already lost the skb {CVE-2024-26739}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
• net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• ext4: fix use-after-free in ext4_orphan_cleanup {CVE-2022-50673}
• xfrm: fix slab-use-after-free in decode_session6 {CVE-2023-53500}
• net: bridge: xmit: make sure we have at least eth header len bytes {CVE-2024-38538}
• NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
• perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
• virtio_net: fix xdp_rxq_info bug after suspend/resume {CVE-2022-49687}
• NFSD: Fix the behavior of READ near OFFSET_MAX {CVE-2022-48827}
• usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
• netfilter: nf_tables: prefer nft_chain_validate {CVE-2024-41042}
• netfilter: validate user input for expected length {CVE-2024-35896}
• erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• i40e: remove read access to debugfs files {CVE-2025-39901}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
• Bluetooth: hci_sock: Prevent race in socket write iter and sock bind {CVE-2025-68305}
• RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
• netfilter: allow exp not to be removed in nf_ct_find_expectation {CVE-2023-52927}
• dm-bufio: don't schedule in atomic context {CVE-2025-37928}
• HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
• netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201}
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• tracing/histograms: Add histograms to hist_vars if they have referenced variables {CVE-2023-53560}
• netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() {CVE-2024-35791}
• scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521}
• dm cache: Fix UAF in destroy() {CVE-2022-50496}
• xhci: Remove device endpoints from bandwidth list when freeing the device {CVE-2022-50470}
• Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386}
• mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats {CVE-2025-68800}
• net/sched: Enforce that teql can only be used as root qdisc {CVE-2026-23074}
• igb: Do not bring the device up after non-fatal error {CVE-2024-50040}
• wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
• HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}
• HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() {CVE-2022-50551}
• ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path…

• xhci: Remove device endpoints from bandwidth list when freeing the device {CVE-2022-50470}
• HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
• netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201}
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• tracing/histograms: Add histograms to hist_vars if they have referenced variables {CVE-2023-53560}
• netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521}
• dm cache: Fix UAF in destroy() {CVE-2022-50496}
• Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf {CVE-2023-53524}
• xfrm: fix slab-use-after-free in decode_session6 {CVE-2023-53500}
• ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
• NFSD: Fix the behavior of READ near OFFSET_MAX {CVE-2022-48827}
• NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
• mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory {CVE-2025-39883}
• fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
• erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
• net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• i40e: remove read access to debugfs files {CVE-2025-39901}
• Bluetooth: hci_sock: Prevent race in socket write iter and sock bind {CVE-2025-68305}
• RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
• usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
• netfilter: allow exp not to be removed in nf_ct_find_expectation {CVE-2023-52927}
• dm-bufio: don't schedule in atomic context {CVE-2025-37928}
• ACPI: EC: Fix oops when removing custom query handlers {CVE-2023-54244}
• mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats {CVE-2025-68800}
• net/sched: Enforce that teql can only be used as root qdisc {CVE-2026-23074}
• net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114}
• igb: Do not bring the device up after non-fatal error {CVE-2024-50040}
• HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras {CVE-2023-53471}
• wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
• HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}
• HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() {CVE-2022-50551}
• dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path {CVE-2023-53604}
• gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• iavf: Fix use-after-free in free_netdev {CVE-2023-53556}
• cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945}
• kernfs: fix use-after-free in __kernfs_remove {CVE-2022-50432}
• net/sched: act_mirred: don't override retval if we already lost the skb…

• CVE-2023-53515
  • virtio-mmio: don't break lifecycle of vm_dev {CVE-2023-53515}
• CVE-2025-39967
  • fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
  • fbcon: Fix OOB access in font allocation {CVE-2025-39967}
• CVE-2025-38702
  • fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• CVE-2025-38563
  • perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563}
• CVE-2025-39869
  • dmaengine: ti: edma: Fix memory allocation size for queue_priority_map {CVE-2025-39869}
• CVE-2023-53577
  • bpf, cpumap: Make sure kthread is running before map update returns {CVE-2023-53577}
• CVE-2023-53608
  • nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() {CVE-2023-53608}
• CVE-2023-53604
  • dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path {CVE-2023-53604}
• CVE-2023-53619
  • netfilter: Replace printk() with pr_*() and define pr_fmt() {CVE-2023-53619}
  • netfilter: use kvmalloc_array to allocate memory for hashtable {CVE-2023-53619}
  • netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• CVE-2025-38680
  • media: uvcvideo: Fix 1-byte out-of-bounds read in {CVE-2025-38680}
• CVE-2023-53454
  • HID: multitouch: Correct devm device reference for hidinput {CVE-2023-53454}
• CVE-2025-38699
  • scsi: bfa: Double-free fix {CVE-2025-38699}
  • ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265}
  • scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
  • fs: jfs: Fix UBSAN: array-index-out-of-bounds in {CVE-2025-38699}
• CVE-2023-53596
  • drivers: base: Free devm resources when unregistering a {CVE-2023-53596}
• CVE-2023-53622
  • gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
  • HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition {CVE-2023-53622}
• CVE-2023-53090
  • drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
• CVE-2023-53116
  • nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
• CVE-2023-53138
  • net: caif: Fix use-after-free in cfusbl_device_notify() {CVE-2023-53138}
• CVE-2023-53035
  • nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() {CVE-2023-53035}
• CVE-2023-53668
  • ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• CVE-2023-53616
  • jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount {CVE-2023-53616}
• CVE-2023-53554
  • staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() {CVE-2023-53554}
• CVE-2023-53587
  • ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• CVE-2023-53541
  • mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write {CVE-2023-53541}
• CVE-2023-53559
  • ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559}
• CVE-2023-53484
  • lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
  • lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() {CVE-2023-53484}
• CVE-2025-39824
  • HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
• CVE-2025-38715
  • hfs: fix slab-out-of-bounds in hfs_bnode_read() {CVE-2025-38715}
• CVE-2023-53153
  • wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• CVE-2025-38555
  • usb: gadget : fix use-after-free in composite_dev_cleanup() {CVE-2025-38555}
• CVE-2025-39743
  • jfs: truncate good inode pages when hard link is 0 {CVE-2025-39743}
• CVE-2025-39945
  • cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945}
• CVE-2023-53506
  • udf: Do not bother merging very…

• Miscellaneous Ubuntu changes
  • update-from-bionic-master repo has been updated
• Miscellaneous upstream changes
  • debian: add control and changeg files [ Ubuntu: 4.15.0-254.265 ]
• CVE-2023-53515
  • virtio-mmio: don't break lifecycle of vm_dev {CVE-2023-53515}
• CVE-2025-39967
  • fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
  • fbcon: Fix OOB access in font allocation {CVE-2025-39967}
• CVE-2025-38702
  • fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• CVE-2025-38563
  • perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563}
• CVE-2025-39869
  • dmaengine: ti: edma: Fix memory allocation size for queue_priority_map {CVE-2025-39869}
• CVE-2023-53577
  • bpf, cpumap: Make sure kthread is running before map update returns {CVE-2023-53577}
• CVE-2023-53608
  • nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() {CVE-2023-53608}
• CVE-2023-53604
  • dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path {CVE-2023-53604}
• CVE-2023-53619
  • netfilter: Replace printk() with pr_*() and define pr_fmt() {CVE-2023-53619}
  • netfilter: use kvmalloc_array to allocate memory for hashtable {CVE-2023-53619}
  • netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• CVE-2025-38680
  • media: uvcvideo: Fix 1-byte out-of-bounds read in {CVE-2025-38680}
• CVE-2023-53454
  • HID: multitouch: Correct devm device reference for hidinput {CVE-2023-53454}
• CVE-2025-38699
  • scsi: bfa: Double-free fix {CVE-2025-38699}
  • ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265}
  • scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
  • fs: jfs: Fix UBSAN: array-index-out-of-bounds in {CVE-2025-38699}
• CVE-2023-53596
  • drivers: base: Free devm resources when unregistering a {CVE-2023-53596}
• CVE-2023-53622
  • gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
  • HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition {CVE-2023-53622}
• CVE-2023-53090
  • drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
• CVE-2023-53116
  • nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
• CVE-2023-53138
  • net: caif: Fix use-after-free in cfusbl_device_notify() {CVE-2023-53138}
• CVE-2023-53035
  • nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() {CVE-2023-53035}
• CVE-2023-53668
  • ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• CVE-2023-53616
  • jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount {CVE-2023-53616}
• CVE-2023-53554
  • staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() {CVE-2023-53554}
• CVE-2023-53587
  • ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• CVE-2023-53541
  • mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write {CVE-2023-53541}
• CVE-2023-53559
  • ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559}
• CVE-2023-53484
  • lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
  • lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() {CVE-2023-53484}
• CVE-2025-39824
  • HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
• CVE-2025-38715
  • hfs: fix slab-out-of-bounds in hfs_bnode_read() {CVE-2025-38715}
• CVE-2023-53153
  • wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• CVE-2025-38555
  • usb: gadget : fix use-after-free in composite_dev_cleanup() {CVE-2025-38555}
• CVE-2025-39743
  • jfs: truncate good inode…

• i40e: remove read access to debugfs files {CVE-2025-39901}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• md: fix resync softlockup when bitmap size is less than array size {CVE-2023-53357}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• tracing: Only have rmmod clear buffers that its events were active in {CVE-2022-49006}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• dm raid: fix accesses beyond end of raid member array {CVE-2022-49674}
• md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output {CVE-2023-53676}
• mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}

• i40e: remove read access to debugfs files {CVE-2025-39901}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• md: fix resync softlockup when bitmap size is less than array size {CVE-2023-53357}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• tracing: Only have rmmod clear buffers that its events were active in {CVE-2022-49006}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• dm raid: fix accesses beyond end of raid member array {CVE-2022-49674}
• md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output {CVE-2023-53676}
• mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}

• i40e: remove read access to debugfs files {CVE-2025-39901}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• md: fix resync softlockup when bitmap size is less than array size {CVE-2023-53357}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• tracing: Only have rmmod clear buffers that its events were active in {CVE-2022-49006}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• dm raid: fix accesses beyond end of raid member array {CVE-2022-49674}
• md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output {CVE-2023-53676}
• mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}

In the Linux kernel, the following vulnerability has been resolved:

igb: Fix igb_down hung on surprise removal

In a setup where a Thunderbolt hub connects to Ethernet and a display through USB Type-C, users may experience a hung task timeout when they remove the cable between the PC and the Thunderbolt hub. This is because the igb_down function is called multiple times when the Thunderbolt hub is unplugged. For example, the igb_io_error_detected triggers the first call, and the igb_remove triggers the second call. The second call to igb_down will block at napi_synchronize. Here's the call trace: __schedule+0x3b0/0xddb ? __mod_timer+0x164/0x5d3 schedule+0x44/0xa8 schedule_timeout+0xb2/0x2a4 ? run_local_timers+0x4e/0x4e msleep+0x31/0x38 igb_down+0x12c/0x22a [igb 6615058754948bfde0bf01429257eb59f13030d4] __igb_close+0x6f/0x9c [igb 6615058754948bfde0bf01429257eb59f13030d4] igb_close+0x23/0x2b [igb 6615058754948bfde0bf01429257eb59f13030d4] __dev_close_many+0x95/0xec dev_close_many+0x6e/0x103 unregister_netdevice_many+0x105/0x5b1 unregister_netdevice_queue+0xc2/0x10d unregister_netdev+0x1c/0x23 igb_remove+0xa7/0x11c [igb 6615058754948bfde0bf01429257eb59f13030d4] pci_device_remove+0x3f/0x9c device_release_driver_internal+0xfe/0x1b4 pci_stop_bus_device+0x5b/0x7f pci_stop_bus_device+0x30/0x7f pci_stop_bus_device+0x30/0x7f pci_stop_and_remove_bus_device+0x12/0x19 pciehp_unconfigure_device+0x76/0xe9 pciehp_disable_slot+0x6e/0x131 pciehp_handle_presence_or_link_change+0x7a/0x3f7 pciehp_ist+0xbe/0x194 irq_thread_fn+0x22/0x4d ? irq_thread+0x1fd/0x1fd irq_thread+0x17b/0x1fd ? irq_forced_thread_fn+0x5f/0x5f kthread+0x142/0x153 ? __irq_get_irqchip_state+0x46/0x46 ? kthread_associate_blkcg+0x71/0x71 ret_from_fork+0x1f/0x30

In this case, igb_io_error_detected detaches the network interface and requests a PCIE slot reset, however, the PCIE reset callback is not being invoked and thus the Ethernet connection breaks down. As the PCIE error in this case is a non-fatal one, requesting a slot reset can be avoided. This patch fixes the task hung issue and preserves Ethernet connection by ignoring non-fatal PCIE errors.

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4: do not BUG…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50242: drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() (bsc#1249696).
• CVE-2022-50244: cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() (bsc#1249647).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947).
• CVE-2022-50265: kcm: annotate data-races around kcm->rx_wait (bsc#1249744).
• CVE-2022-50278: PNP: fix name memory leak in pnp_alloc_dev() (bsc#1249715).
• CVE-2022-50285: mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages (bsc#1249803).
• CVE-2022-50288: qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure (bsc#1249802).
• CVE-2022-50291: kcm: annotate data-races around kcm->rx_psock (bsc#1249798).
• CVE-2022-50294: wifi: libertas: fix memory leak in lbs_init_adapter() (bsc#1249799).
• CVE-2022-50297: wifi: ath9k: verify the expected usb_endpoints are present (bsc#1250250).
• CVE-2022-50304: mm: export bdi_unregister (bsc#1249725).
• CVE-2022-50311: cxl: Fix refcount leak in cxl_calc_capp_routing (bsc#1249720).
• CVE-2022-50312: drivers: serial: jsm: fix some leaks in probe (bsc#1249716).
• CVE-2022-50321: wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (bsc#1249706).
• CVE-2022-50330: crypto: cavium - prevent integer overflow loading firmware (bsc#1249700).
• CVE-2022-50349: misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (bsc#1249920).
• CVE-2022-50352: net: hns: fix possible memory leak in hnae_ae_register() (bsc#1249922).
• CVE-2022-50359: media: cx88: Fix a null-ptr-deref bug in buffer_prepare() (bsc#1250269).
• CVE-2022-50365: skbuff: Account for tail adjustment during pull operations (bsc#1250084).
• CVE-2022-50375: tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown (bsc#1250132).
• CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
• CVE-2022-50396: net: sched: fix memory leak in tcindex_set_parms (bsc#1250104).
• CVE-2022-50402: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() (bsc#1250363).
• CVE-2022-50405: net/tunnel: wait until all sk_user_data reader finish before releasing the sock (bsc#1250155).
• CVE-2022-50406: iomap: iomap: fix memory corruption when recording errors during writeback (bsc#1250165).
• CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2022-50419: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times (bsc#1250394).
• CVE-2023-53148: igb: Do not bring the device up after non-fatal error (bsc#1249842).
• CVE-2023-53153: wifi: cfg80211: Partial revert 'wifi: cfg80211: Fix use after free for wext' (bsc#1249877).
• CVE-2023-53176: serial: 8250: Fix oops for port->pm on uart_change_pm() (bsc#1249991).
• CVE-2023-53178: mm: zswap: fix missing folio cleanup in writeback race path (bsc#1249827 git-fix).
• CVE-2023-53199: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails (bsc#1249683).
• CVE-2023-53201: RDMA/bnxt_re: wraparound mbox producer index (bsc#1249687).
• CVE-2023-53226: wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (bsc#1249658).
• CVE-2023-53248: drm/amdgpu: install stub fence into potential unused fence pointers (bsc#1249779).
• CVE-2023-53254: drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug (bsc#1249871).
• CVE-2023-53272: net: ena: fix shift-out-of-bounds in exponential backoff (bsc#1249917).
• CVE-2023-53277: wifi: iwl3945: Add missing check for create_singlethread_workqueue…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
• CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
• CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
• CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
• CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
• CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
• CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
• CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
• CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
• CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
• CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (bsc#1247167).
• CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
• CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
• CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
• CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
• CVE-2025-38491: mptcp: make fallback action and fallback decision…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4: do…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4: do…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4:…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4: do not…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).
• CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).
• CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).
• CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).
• CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (bsc#1249182).
• CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
• CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).
• CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).
• CVE-2025-39683: tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286).
• CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).
• CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).
• CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).
• CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).
• CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
• CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).
• CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).
• CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).
• CVE-2025-39832: net/mlx5: Add sync reset drop mode support (bsc#1249901).
• CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
• CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
• CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).
• CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
• CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
• CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).
• CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).
• CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).
• CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).
• CVE-2025-39898: e1000e: fix heap overflow in e1000_set_eeprom (bsc#1250742).
• CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).
• CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).
• CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).
• CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).
• CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).
• CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).
• CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).
• CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051). -…

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).
• CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).
• CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).
• CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).
• CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (bsc#1249182).
• CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
• CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).
• CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).
• CVE-2025-39683: tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286).
• CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).
• CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).
• CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).
• CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).
• CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
• CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).
• CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).
• CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).
• CVE-2025-39832: net/mlx5: Add sync reset drop mode support (bsc#1249901).
• CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
• CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
• CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).
• CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
• CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
• CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).
• CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).
• CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).
• CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).
• CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).
• CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).
• CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).
• CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).
• CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).
• CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).
• CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).
• CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).
• CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052). -…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).
• CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).
• CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).
• CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).
• CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (bsc#1249182).
• CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
• CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).
• CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).
• CVE-2025-39683: tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286).
• CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).
• CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).
• CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).
• CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).
• CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
• CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).
• CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).
• CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).
• CVE-2025-39832: net/mlx5: Add sync reset drop mode support (bsc#1249901).
• CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
• CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
• CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).
• CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
• CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
• CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).
• CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).
• CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).
• CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).
• CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).
• CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).
• CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).
• CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).
• CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).
• CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).
• CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).
• CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).
• CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50347: mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() (bsc#1249928).
• CVE-2022-50580: blk-throttle: prevent overflow while calculating wait time (bsc#1252542).
• CVE-2022-50676: net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() (bsc#1254689).
• CVE-2022-50697: mrp: introduce active flags to prevent UAF when applicant uninit (bsc#1255594).
• CVE-2022-50709: wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() (bsc#1255565).
• CVE-2022-50716: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out (bsc#1255839).
• CVE-2022-50717: nvmet-tcp: add bounds check on Transfer Tag (bsc#1255844).
• CVE-2022-50719: ALSA: line6: fix stack overflow in line6_midi_transmit (bsc#1255939).
• CVE-2022-50740: wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() (bsc#1256155).
• CVE-2022-50744: scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs (bsc#1256165).
• CVE-2022-50749: acct: fix potential integer overflow in encode_comp_t() (bsc#1256191).
• CVE-2022-50751: configfs: fix possible memory leak in configfs_create_dir() (bsc#1256184).
• CVE-2022-50760: drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() (bsc#1255983).
• CVE-2022-50770: ocfs2: fix memory leak in ocfs2_mount_volume() (bsc#1256221).
• CVE-2022-50777: net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe (bsc#1256320).
• CVE-2022-50780: net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed (bsc#1256305).
• CVE-2022-50782: ext4: fix bug_on in __es_tree_search caused by bad quota inode (bsc#1256282).
• CVE-2022-50786: media: s5p-mfc: Clear workbit to handle error condition (bsc#1256258).
• CVE-2022-50816: ipv6: ensure sane device mtu in tunnels (bsc#1256038).
• CVE-2022-50834: nfc: Fix potential resource leaks (bsc#1256219).
• CVE-2022-50865: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (bsc#1256168).
• CVE-2022-50868: hwrng: amd - Fix PCI device refcount leak (bsc#1256386).
• CVE-2022-50880: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() (bsc#1256132).
• CVE-2022-50881: ath9k: Fix typo in function name (bsc#1256130).
• CVE-2022-50884: drm: Prevent drm_copy_field() to attempt copying a NULL pointer (bsc#1256127).
• CVE-2022-50885: RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed (bsc#1256122).
• CVE-2022-50887: regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() (bsc#1256125).
• CVE-2023-50756: nvme-pci: fix mempool alloc size (bsc#1256216).
• CVE-2023-53685: tun: Fix memory leak for detached NAPI queue (bsc#1251770).
• CVE-2023-53747: vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (bsc#1254572).
• CVE-2023-53751: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (bsc#1254986).
• CVE-2023-53825: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg() (bsc#1254707).
• CVE-2023-53853: netlink: annotate accesses to nlk->cb_running (bsc#1254673).
• CVE-2023-53863: netlink: do not hard code device address lenth in fdb dumps (bsc#1254657).
• CVE-2023-53992: wifi: cfg80211: ocb: don't leave if not joined (bsc#1256058).
• CVE-2023-54012: net: fix stack overflow when LRO is disabled for virtual interfaces (bsc#1255571).
• CVE-2023-54047: drm/rockchip: dw_hdmi: cleanup drm encoder during unbind (bsc#1256398).
• CVE-2023-54048: RDMA/bnxt_re: Prevent handling any completions after qp destroy (bsc#1256395).
• CVE-2023-54067: btrfs: fix race when deleting free space root from the dirty cow roots list (bsc#1256369).
• CVE-2023-54111: pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups (bsc#1256149).
• CVE-2023-54112: kcm: Fix memory leak in error path of kcm_sendmsg() (bsc#1256354).
• CVE-2023-54118: serial: sc16is7xx: setup GPIO controller later in probe…