CVE-2023-53299

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix leak of 'r10bio->remaining' for recovery raid10_sync_request() will add 'r10bio->remaining' for both rdev and replacement rdev. However, if the read io fails, recovery_request_write() returns without issuing the write io, in this case, end_sync_request() is only called once and 'remaining' is leaked, cause an io hang. Fix the problem by decreasing 'remaining' according to if 'bio' and 'repl_bio' is valid.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

md: Replace snprintf with scnprintf

Current code produces a warning as shown below when total characters in the constituent block device names plus the slashes exceeds 200. snprintf() returns the number of characters generated from the given input, which could cause the expression “200 – len” to wrap around to a large positive number. Fix this by using scnprintf() instead, which returns the actual number of characters written into the buffer.

[ 1513.267938] ------------[ cut here ]------------ [ 1513.267943] WARNING: CPU: 15 PID: 37247 at <snip>/lib/vsprintf.c:2509 vsnprintf+0x2c8/0x510 [ 1513.267944] Modules linked in: <snip> [ 1513.267969] CPU: 15 PID: 37247 Comm: mdadm Not tainted 5.4.0-1085-azure #90~18.04.1-Ubuntu [ 1513.267969] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 05/09/2022 [ 1513.267971] RIP: 0010:vsnprintf+0x2c8/0x510 <-snip-> [ 1513.267982] Call Trace: [ 1513.267986] snprintf+0x45/0x70 [ 1513.267990] ? disk_name+0x71/0xa0 [ 1513.267993] dump_zones+0x114/0x240 [raid0] [ 1513.267996] ? _cond_resched+0x19/0x40 [ 1513.267998] raid0_run+0x19e/0x270 [raid0] [ 1513.268000] md_run+0x5e0/0xc50 [ 1513.268003] ? security_capable+0x3f/0x60 [ 1513.268005] do_md_run+0x19/0x110 [ 1513.268006] md_ioctl+0x195e/0x1f90 [ 1513.268007] blkdev_ioctl+0x91f/0x9f0 [ 1513.268010] block_ioctl+0x3d/0x50 [ 1513.268012] do_vfs_ioctl+0xa9/0x640 [ 1513.268014] ? __fput+0x162/0x260 [ 1513.268016] ksys_ioctl+0x75/0x80 [ 1513.268017] __x64_sys_ioctl+0x1a/0x20 [ 1513.268019] do_syscall_64+0x5e/0x200 [ 1513.268021] entry_SYSCALL_64_after_hwframe+0x44/0xa9(CVE-2022-50299)

In the Linux kernel, the following vulnerability has been resolved:

nbd: Fix hung when signal interrupts nbd_start_device_ioctl()

syzbot reported hung task [1]. The following program is a simplified version of the reproducer:

int main(void) { int sv[2], fd;

if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) < 0)
	return 1;
if ((fd = open("/dev/nbd0", 0)) < 0)
	return 1;
if (ioctl(fd, NBD_SET_SIZE_BLOCKS, 0x81) < 0)
	return 1;
if (ioctl(fd, NBD_SET_SOCK, sv[0]) < 0)
	return 1;
if (ioctl(fd, NBD_DO_IT) < 0)
	return 1;
return 0;

}

When signal interrupt nbd_start_device_ioctl() waiting the condition atomic_read(&config->recv_threads) == 0, the task can hung because it waits the completion of the inflight IOs.

This patch fixes the issue by clearing queue, not just shutdown, when signal interrupt nbd_start_device_ioctl().(CVE-2022-50314)

In the Linux kernel, the following vulnerability has been resolved:

cifs: fix oops during encryption

When running xfstests against Azure the following oops occurred on an arm64 system

Unable to handle kernel write to read-only memory at virtual address ffff0001221cf000 Mem abort info: ESR = 0x9600004f EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x0f: level 3 permission fault Data abort info: ISV = 0, ISS = 0x0000004f CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000294f3000 [ffff0001221cf000] pgd=18000001ffff8003, p4d=18000001ffff8003, pud=18000001ff82e003, pmd=18000001ff71d003, pte=00600001221cf787 Internal error: Oops: 9600004f [#1] PREEMPT SMP ... pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) pc : __memcpy+0x40/0x230 lr : scatterwalk_copychunks+0xe0/0x200 sp : ffff800014e92de0 x29: ffff800014e92de0 x28: ffff000114f9de80 x27: 0000000000000008 x26: 0000000000000008 x25: ffff800014e92e78 x24: 0000000000000008 x23: 0000000000000001 x22: 0000040000000000 x21: ffff000000000000 x20: 0000000000000001 x19: ffff0001037c4488 x18: 0000000000000014 x17: 235e1c0d6efa9661 x16: a435f9576b6edd6c x15: 0000000000000058 x14: 0000000000000001 x13:…

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix leak of 'r10bio->remaining' for recovery raid10_sync_request() will add 'r10bio->remaining' for both rdev and replacement rdev. However, if the read io fails, recovery_request_write() returns without issuing the write io, in this case, end_sync_request() is only called once and 'remaining' is leaked, cause an io hang. Fix the problem by decreasing 'remaining' according to if 'bio' and 'repl_bio' is valid.

• mm: zswap: fix missing folio cleanup in writeback race path {CVE-2024-26832}
• mm: fix zswap writeback race condition {CVE-2023-53178}
• dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929}
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• gpio: davinci: Validate the obtained number of IRQs {CVE-2024-42092}
• ASoC: topology: Fix references to freed memory {CVE-2024-41069}
• Bluetooth: hci_sock: Fix not validating setsockopt user input {CVE-2024-35963}
• Bluetooth: ISO: Fix not validating setsockopt user input {CVE-2024-35964}
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
• dma-direct: Leak pages on dma_set_decrypted() failure {CVE-2024-35939}
• wifi: mwifiex: avoid possible NULL skb pointer dereference {CVE-2023-53384}
• md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request {CVE-2023-53380}
• icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
• thermal: core: prevent potential string overflow {CVE-2023-52868}
• drm/amdkfd: Fix shift out-of-bounds issue {CVE-2023-52816}
• drm/vkms: Fix null-ptr-deref in vkms_release() {CVE-2022-50369}
• nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
• net/mlx5: Fix tainted pointer delete is case of flow rules creation fail {CVE-2024-40940}
• ipvlan: add ipvlan_route_v6_outbound() helper {CVE-2023-52796}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
• platform/x86: wmi: remove unnecessary initializations
• perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
• net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• kobject_uevent: Fix OOB access within zap_modalias_env() {CVE-2024-42292}
• mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() {CVE-2023-53401}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
• drm/radeon: possible buffer overflow {CVE-2023-52867}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
• wifi: mac80211_hwsim: Fix possible NULL dereference {CVE-2023-53209}
• vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
• wifi: iwlwifi: fw: fix memory leak in debugfs {CVE-2023-53422}
• drm/amdgpu: fix memory leak in mes self test {CVE-2023-53370}
• skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
• md/raid10: fix leak of 'r10bio->remaining' for recovery {CVE-2023-53299}
• nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
• ppdev: Add an error check in register_device {CVE-2024-36015}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
• net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
• net: add atomic_long_t to net_device_stats fields {CVE-2024-26882}

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50242: drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() (bsc#1249696).
• CVE-2022-50244: cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() (bsc#1249647).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947).
• CVE-2022-50265: kcm: annotate data-races around kcm->rx_wait (bsc#1249744).
• CVE-2022-50278: PNP: fix name memory leak in pnp_alloc_dev() (bsc#1249715).
• CVE-2022-50285: mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages (bsc#1249803).
• CVE-2022-50288: qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure (bsc#1249802).
• CVE-2022-50291: kcm: annotate data-races around kcm->rx_psock (bsc#1249798).
• CVE-2022-50294: wifi: libertas: fix memory leak in lbs_init_adapter() (bsc#1249799).
• CVE-2022-50297: wifi: ath9k: verify the expected usb_endpoints are present (bsc#1250250).
• CVE-2022-50304: mm: export bdi_unregister (bsc#1249725).
• CVE-2022-50311: cxl: Fix refcount leak in cxl_calc_capp_routing (bsc#1249720).
• CVE-2022-50312: drivers: serial: jsm: fix some leaks in probe (bsc#1249716).
• CVE-2022-50321: wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (bsc#1249706).
• CVE-2022-50330: crypto: cavium - prevent integer overflow loading firmware (bsc#1249700).
• CVE-2022-50349: misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (bsc#1249920).
• CVE-2022-50352: net: hns: fix possible memory leak in hnae_ae_register() (bsc#1249922).
• CVE-2022-50359: media: cx88: Fix a null-ptr-deref bug in buffer_prepare() (bsc#1250269).
• CVE-2022-50365: skbuff: Account for tail adjustment during pull operations (bsc#1250084).
• CVE-2022-50375: tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown (bsc#1250132).
• CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
• CVE-2022-50396: net: sched: fix memory leak in tcindex_set_parms (bsc#1250104).
• CVE-2022-50402: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() (bsc#1250363).
• CVE-2022-50405: net/tunnel: wait until all sk_user_data reader finish before releasing the sock (bsc#1250155).
• CVE-2022-50406: iomap: iomap: fix memory corruption when recording errors during writeback (bsc#1250165).
• CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2022-50419: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times (bsc#1250394).
• CVE-2023-53148: igb: Do not bring the device up after non-fatal error (bsc#1249842).
• CVE-2023-53153: wifi: cfg80211: Partial revert 'wifi: cfg80211: Fix use after free for wext' (bsc#1249877).
• CVE-2023-53176: serial: 8250: Fix oops for port->pm on uart_change_pm() (bsc#1249991).
• CVE-2023-53178: mm: zswap: fix missing folio cleanup in writeback race path (bsc#1249827 git-fix).
• CVE-2023-53199: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails (bsc#1249683).
• CVE-2023-53201: RDMA/bnxt_re: wraparound mbox producer index (bsc#1249687).
• CVE-2023-53226: wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (bsc#1249658).
• CVE-2023-53248: drm/amdgpu: install stub fence into potential unused fence pointers (bsc#1249779).
• CVE-2023-53254: drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug (bsc#1249871).
• CVE-2023-53272: net: ena: fix shift-out-of-bounds in exponential backoff (bsc#1249917).
• CVE-2023-53277: wifi: iwl3945: Add missing check for create_singlethread_workqueue…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• !CONFIG & reference -> this is bug, immediate fail
• CONFIG & no reference -> OK temporarily, must be resolved eventually
• Do not self obsolete older kernel variants
• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Update config files. (bsc#1249186) Enable where we define KABI refs + rely on Kconfig deps.
• build_bug.h: Add KABI assert (bsc#1249186).
• hv_netvsc: Fix panic during namespace deletion with VF (bsc#1248111).
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
• kernel-syms.spec: Drop…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (bsc#1247288).
• CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (bsc#1247288).
• CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Revert backported patches for bsc#1238160.
• btrfs: avoid NULL pointer dereference if…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Revert selinux patches that caused regressions (bsc#1249353).
• btrfs: avoid NULL pointer dereference if no valid extent tree (bsc#1249158).
• build_bug.h: Add KABI assert (bsc#1249186).
• hv_netvsc: Fix panic during namespace deletion with VF (bsc#1248111).
• kabi/severities: ignore kABI for atheros helper modules The symbols are used only internally by atheros drivers.
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
• kernel-syms.spec: Drop…