CVE-2023-53761

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux SIG Cloud 8.10 Release Notes linked from the References section.

• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• drm/i915/gt: Fix timeline left held on VMA alloc error {CVE-2025-38389}
• md/raid1: Fix stack memory use after return in raid1_reshape {CVE-2025-38445}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• bpf: Avoid __bpf_prog_ret0_warn when jit fails {CVE-2025-38280}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• netfilter: nf_tables: do not compare internal table flags on updates {CVE-2024-27065}
• init/main.c: Fix potential static_command_line memory overflow {CVE-2024-26988}
• wireguard: netlink: check for dangling peer via is_dead instead of empty list {CVE-2024-26951}
• platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() {CVE-2025-38077}
• exfat: fix double free in delayed_free {CVE-2025-38206}
• net: openvswitch: Fix the dead loop of MPLS parse {CVE-2025-38146}
• wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write {CVE-2023-54286}
• vsock: Do not allow binding to VMADDR_PORT_ANY {CVE-2025-38618}
• fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198}
• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• software node: Correct a OOB check in {CVE-2025-38342}
• nbd: fix uaf in nbd_genl_connect() error path {CVE-2025-38443}
• USB: usbtmc: Fix direction for 0-length ioctl control messages {CVE-2023-53761}
• cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751}
• cifs: Fix warning and UAF when destroy the MR list {CVE-2023-53427}
• PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093}
• PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
• sctp: fix a potential overflow in sctp_ifwdtsn_skip {CVE-2023-53372}
• md/raid10: fix wrong setting of max_corr_read_errors {CVE-2023-53313}
• md/raid10: fix overflow of md/safe_mode_delay
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
• net: fec: Better handle pm_runtime_get() failing in .remove() {CVE-2023-53308}
• rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails {CVE-2023-53307}
• ice: set tx_tstamps when creating new Tx rings via ethtool {CVE-2022-50710}
• RDMA/mlx5: Return the firmware result upon destroying QP/RQ {CVE-2023-53286}
• RDMA/mlx5: Handle DCT QP logic separately from low level QP interface
• net/mlx5e: Use correct encap attribute during invalidation {CVE-2023-54074}
• net/mlx5: Nullify qp->dbg pointer post destruction
• scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write {CVE-2023-53282}
• net: ena: fix shift-out-of-bounds in exponential backoff {CVE-2023-53272}
• ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265}
• sched/fair: Don't balance task to its current running CPU {CVE-2023-53215}
• netfilter: allow exp not to be removed in nf_ct_find_expectation {CVE-2023-52927}
• wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() {CVE-2022-50881}

• ip6_vti: fix slab-use-after-free in decode_session6 {CVE-2023-53821}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• md/raid10: fix null-ptr-deref in raid10_sync_request {CVE-2023-53832}
• dm flakey: fix a crash with invalid table line {CVE-2023-53786}
• wifi: mt7601u: fix an integer underflow {CVE-2023-53679}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• USB: usbtmc: Fix direction for 0-length ioctl control messages {CVE-2023-53761}
• scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() {CVE-2023-53803}
• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• md/raid1: Fix stack memory use after return in raid1_reshape {CVE-2025-38445}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• dm cache: free background tracker's queued work in {CVE-2023-53765}
• drm/amdkfd: Fix UBSAN shift-out-of-bounds warning {CVE-2021-4460}
• drm/vmwgfx: Validate the box size for the snooped cursor {CVE-2022-36280,CVE-2022-50440}
• vsock: Do not allow binding to VMADDR_PORT_ANY {CVE-2025-38618}
• ice: set tx_tstamps when creating new Tx rings via ethtool {CVE-2022-50710}
• media: dvb-frontends: avoid stack overflow warnings with clang {CVE-2024-27075}
• PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
• cifs: Fix warning and UAF when destroy the MR list {CVE-2023-53427}
• sctp: fix a potential overflow in sctp_ifwdtsn_skip {CVE-2023-53372}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
• ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265}
• ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() {CVE-2022-50423}
• Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
• ACPICA: Fix error code path in acpi_ds_call_control_method() {CVE-2022-50411}
• ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace {CVE-2023-54286}

• scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() {CVE-2023-53803}
• md/raid1: Fix stack memory use after return in raid1_reshape {CVE-2025-38445}
• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• dm cache: free background tracker's queued work in {CVE-2023-53765}
• drm/vmwgfx: Validate the box size for the snooped cursor {CVE-2022-36280,CVE-2022-50440}
• vsock: Do not allow binding to VMADDR_PORT_ANY {CVE-2025-38618}
• ice: set tx_tstamps when creating new Tx rings via ethtool {CVE-2022-50710}
• sctp: avoid NULL dereference when chunk data buffer is {CVE-2025-40240}
• ip6_vti: fix slab-use-after-free in decode_session6 {CVE-2023-53821}
• wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• md/raid10: fix null-ptr-deref in raid10_sync_request {CVE-2023-53832}
• dm flakey: fix a crash with invalid table line {CVE-2023-53786}
• wifi: mt7601u: fix an integer underflow {CVE-2023-53679}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode
• ext4: add helper to check quota inums
• ext4: fix bug_on in __es_tree_search caused by bad quota inode
• quota: Factor out setup of quota inode
• USB: usbtmc: Fix direction for 0-length ioctl control messages {CVE-2023-53761}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] {CVE-2024-46815}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-1989}
• nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• dm raid: fix address sanitizer warning in raid_status {CVE-2022-50084}
• vt: Clear selection before changing the font {CVE-2022-49948}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• ata: libata-transport: fix double ata_host_put() in ata_tport_add() {CVE-2022-49826}
• ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix {CVE-2022-49503}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails {CVE-2023-53307}
• RDMA/mlx5: Return the firmware result upon destroying QP/RQ {CVE-2023-53286}
• sched/fair: Don't balance task to its current running CPU {CVE-2023-53215}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• ACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address {CVE-2022-50320}
• wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() {CVE-2022-50881}
• slcan: Don't transmit uninitialized stack data in padding {CVE-2020-11494}
• media: dvb-frontends: avoid stack overflow warnings with clang {CVE-2024-27075}
• PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
• cifs: Fix warning and UAF when destroy the MR list {CVE-2023-53427}
• sctp: fix a potential overflow in sctp_ifwdtsn_skip {CVE-2023-53372}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
• ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265}
• ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() {CVE-2022-50423}
• Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
• ACPICA: Fix error code path in acpi_ds_call_control_method() {CVE-2022-50411}
• ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace {CVE-2023-54286}

In the Linux kernel, the following vulnerability has been resolved:

USB: usbtmc: Fix direction for 0-length ioctl control messages

The syzbot fuzzer found a problem in the usbtmc driver: When a user submits an ioctl for a 0-length control transfer, the driver does not check that the direction is set to OUT:

------------[ cut here ]------------ usb 3-1: BOGUS control dir, pipe 80000b80 doesn't match bRequestType fd WARNING: CPU: 0 PID: 5100 at drivers/usb/core/urb.c:411 usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Modules linked in: CPU: 0 PID: 5100 Comm: syz-executor428 Not tainted 6.3.0-syzkaller-12049-g58390c8ce1bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 RIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Code: 7c 24 40 e8 1b 13 5c fb 48 8b 7c 24 40 e8 21 1d f0 fe 45 89 e8 44 89 f1 4c 89 e2 48 89 c6 48 c7 c7 e0 b5 fc 8a e8 19 c8 23 fb <0f> 0b e9 9f ee ff ff e8 ed 12 5c fb 0f b6 1d 12 8a 3c 08 31 ff 41 RSP: 0018:ffffc90003d2fb00 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8880789e9058 RCX: 0000000000000000 RDX: ffff888029593b80 RSI: ffffffff814c1447 RDI: 0000000000000001 RBP: ffff88801ea742f8 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff88802915e528 R13: 00000000000000fd R14: 0000000080000b80 R15: ffff8880222b3100 FS: 0000555556ca63c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9ef4d18150 CR3: 0000000073e5b000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153 usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1954 [inline] usbtmc_ioctl+0x1b3d/0x2840 drivers/usb/class/usbtmc.c:2097

To fix this, we must override the direction in the bRequestType field of the control request structure when the length is 0.

In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: Fix direction for 0-length ioctl control messages The syzbot fuzzer found a problem in the usbtmc driver: When a user submits an ioctl for a 0-length control transfer, the driver does not check that the direction is set to OUT: ------------[ cut here ]------------ usb 3-1: BOGUS control dir, pipe 80000b80 doesn't match bRequestType fd WARNING: CPU: 0 PID: 5100 at drivers/usb/core/urb.c:411 usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Modules linked in: CPU: 0 PID: 5100 Comm: syz-executor428 Not tainted 6.3.0-syzkaller-12049-g58390c8ce1bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 RIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Code: 7c 24 40 e8 1b 13 5c fb 48 8b 7c 24 40 e8 21 1d f0 fe 45 89 e8 44 89 f1 4c 89 e2 48 89 c6 48 c7 c7 e0 b5 fc 8a e8 19 c8 23 fb <0f> 0b e9 9f ee ff ff e8 ed 12 5c fb 0f b6 1d 12 8a 3c 08 31 ff 41 RSP: 0018:ffffc90003d2fb00 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8880789e9058 RCX: 0000000000000000 RDX: ffff888029593b80 RSI: ffffffff814c1447 RDI: 0000000000000001 RBP: ffff88801ea742f8 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff88802915e528 R13: 00000000000000fd R14: 0000000080000b80 R15: ffff8880222b3100 FS: 0000555556ca63c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9ef4d18150 CR3: 0000000073e5b000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153 usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1954 [inline] usbtmc_ioctl+0x1b3d/0x2840 drivers/usb/class/usbtmc.c:2097 To fix this, we must override the direction in the bRequestType field of the control request structure when the length is 0.

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
• CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
• CVE-2024-56590: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (bsc#1235038).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
• CVE-2025-40139: net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (bsc#1253409).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
• CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).

The following non security issues were fixed:

• ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (git-fixes).
• ACPI: PRM: Remove unnecessary strict handler address checks (git-fixes).
• ACPI: property: Do not pass NULL handles to acpi_attach_data() (git-fixes).
• ACPI: property: Fix buffer properties extraction for subnodes (git-fixes).
• KVM: SVM: Fix TSC_AUX virtualization setup (git-fixes).
• RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes).
• RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes).
• RDMA/hns: Fix the modification of max_send_sge (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
• RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes).
• RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes).
• RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
• arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled (git-fixes).
• cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls (git-fixes).
• cpuidle: Move IRQ state validation (git-fixes).
• cpuidle: haltpoll: Do not enable interrupts when entering idle (git-fixes).
• dm: free table mempools if not used in __bind (git-fixes).
• padata: Honor the caller's alignment in case of chunk_size 0 (bsc#1237563).
• platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (git-fixes).
• x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (git-fixes).
• x86/bugs: Use SBPB in write_ibpb() if applicable (git-fixes).
• x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (git-fixes).
• x86/tdx: Drop flags from __tdx_hypercall() (git-fixes).
• x86/tdx: Dynamically disable SEPT violations from causing #VEs (git-fixes).
• x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (git-fixes).
• x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs (git-fixes).
• x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed()…

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
• CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
• CVE-2024-56590: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (bsc#1235038).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
• CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
• CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).

The following non security issues were fixed:

• ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (git-fixes).
• ACPI: PRM: Remove unnecessary strict handler address checks (git-fixes).
• ACPI: property: Do not pass NULL handles to acpi_attach_data() (git-fixes).
• ACPI: property: Fix buffer properties extraction for subnodes (git-fixes).
• KVM: SVM: Fix TSC_AUX virtualization setup (git-fixes).
• RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes).
• RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes).
• RDMA/hns: Fix the modification of max_send_sge (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
• RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes).
• RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes).
• RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
• arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled (git-fixes).
• cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls (git-fixes).
• cpuidle: Move IRQ state validation (git-fixes).
• cpuidle: haltpoll: Do not enable interrupts when entering idle (git-fixes).
• dm: free table mempools if not used in __bind (git-fixes).
• padata: Honor the caller's alignment in case of chunk_size 0 (bsc#1237563).
• platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (git-fixes).
• x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (git-fixes).
• x86/bugs: Use SBPB in write_ibpb() if applicable (git-fixes).
• x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (git-fixes).
• x86/tdx: Drop flags from __tdx_hypercall() (git-fixes).
• x86/tdx: Dynamically disable SEPT violations from causing #VEs (git-fixes).
• x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (git-fixes).
• x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs (git-fixes).
• x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed()…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50282: chardev: fix error handling in cdev_device_add() (bsc#1249739).
• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2022-50717: nvmet-tcp: add bounds check on Transfer Tag (bsc#1255844).
• CVE-2022-50726: net/mlx5: Fix possible use-after-free in async command interface (bsc#1256040).
• CVE-2022-50736: RDMA/siw: Fix immediate work request flush to completion queue (bsc#1256137).
• CVE-2022-50756: nvme-core: replace ctrl page size with a macro (bsc#1256216).
• CVE-2023-53215: sched/fair: Don't balance task to its current running CPU (bsc#1250397).
• CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
• CVE-2023-53761: USB: usbtmc: Fix direction for 0-length ioctl control messages (bsc#1255002).
• CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
• CVE-2023-54142: gtp: Fix use-after-free in __gtp_encap_destroy() (bsc#1256095).
• CVE-2023-54168: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() (bsc#1256053).
• CVE-2023-54243: netfilter: ebtables: fix table blob use-after-free (bsc#1255908).
• CVE-2025-38068: crypto: lzo - Fix compression buffer overrun (bsc#1245210).
• CVE-2025-38159: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (bsc#1245751).
• CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
• CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).
• CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).

The SUSE Linux Enterprise 15 SP3 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50282: chardev: fix error handling in cdev_device_add() (bsc#1249739).
• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2022-50717: nvmet-tcp: add bounds check on Transfer Tag (bsc#1255844).
• CVE-2022-50726: net/mlx5: Fix possible use-after-free in async command interface (bsc#1256040).
• CVE-2022-50736: RDMA/siw: Fix immediate work request flush to completion queue (bsc#1256137).
• CVE-2022-50756: nvme-core: replace ctrl page size with a macro (bsc#1256216).
• CVE-2023-53215: sched/fair: Don't balance task to its current running CPU (bsc#1250397).
• CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
• CVE-2023-53761: USB: usbtmc: Fix direction for 0-length ioctl control messages (bsc#1255002).
• CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
• CVE-2023-54142: gtp: Fix use-after-free in __gtp_encap_destroy() (bsc#1256095).
• CVE-2023-54168: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() (bsc#1256053).
• CVE-2023-54243: netfilter: ebtables: fix table blob use-after-free (bsc#1255908).
• CVE-2025-38068: crypto: lzo - Fix compression buffer overrun (bsc#1245210).
• CVE-2025-38159: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (bsc#1245751).
• CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
• CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).
• CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
• CVE-2022-50697: mrp: introduce active flags to prevent UAF when applicant uninit (bsc#1255594).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2023-53215: sched/fair: Don't balance task to its current running CPU (bsc#1250397).
• CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
• CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
• CVE-2023-54142: gtp: Fix use-after-free in __gtp_encap_destroy() (bsc#1256095).
• CVE-2023-54243: netfilter: ebtables: fix table blob use-after-free (bsc#1255908).
• CVE-2024-28956: x86/its: Enumerate Indirect Target Selection (ITS) bug (bsc#1242006).
• CVE-2024-36348: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
• CVE-2024-36349: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
• CVE-2024-36350: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
• CVE-2024-36357: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
• CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
• CVE-2025-38068: crypto: lzo - Fix compression buffer overrun (bsc#1245210).
• CVE-2025-38129: page_pool: fix inconsistency for page_pool_ring_lock() (bsc#1245723).
• CVE-2025-38159: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (bsc#1245751).
• CVE-2025-38375: virtio-net: ensure the received length does not exceed allocated size (bsc#1247177).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
• CVE-2025-40139: net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (bsc#1253409).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40300: Documentation/hw-vuln: Add VMSCAPE documentation (bsc#1247483).
• CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
• CVE-2025-68183: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (bsc#1255251).
• CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
• CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
• CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).
• CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).
• CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).
• CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).

The following non security issues were fixed:

• x86/CPU/AMD: Add ZenX generations flags (bsc#1238896).
• x86: make page fault handling disable interrupts properly (git-fixes).

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
• CVE-2022-50697: mrp: introduce active flags to prevent UAF when applicant uninit (bsc#1255594).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2023-53215: sched/fair: Don't balance task to its current running CPU (bsc#1250397).
• CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
• CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
• CVE-2023-54142: gtp: Fix use-after-free in __gtp_encap_destroy() (bsc#1256095).
• CVE-2023-54243: netfilter: ebtables: fix table blob use-after-free (bsc#1255908).
• CVE-2024-28956: x86/its: Enumerate Indirect Target Selection (ITS) bug (bsc#1242006).
• CVE-2024-36348: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
• CVE-2024-36349: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
• CVE-2024-36350: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
• CVE-2024-36357: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
• CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
• CVE-2024-46854: net: dpaa: Pad packets to ETH_ZLEN (bsc#1231084).
• CVE-2025-21738: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (bsc#1238917).
• CVE-2025-38068: crypto: lzo - Fix compression buffer overrun (bsc#1245210).
• CVE-2025-38129: page_pool: fix inconsistency for page_pool_ring_lock() (bsc#1245723).
• CVE-2025-38159: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (bsc#1245751).
• CVE-2025-38375: virtio-net: ensure the received length does not exceed allocated size (bsc#1247177).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
• CVE-2025-40139: net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (bsc#1253409).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40300: Documentation/hw-vuln: Add VMSCAPE documentation (bsc#1247483).
• CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
• CVE-2025-68183: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (bsc#1255251).
• CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
• CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
• CVE-2025-68312: usbnet: Prevents free active kevent (bsc#1255171).
• CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).
• CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).
• CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256623).
• CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).
• CVE-2025-71112: net: hns3: add VLAN id validation before using (bsc#1256726).
• CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).
• CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).
• CVE-2026-22999: net/sched: sch_qfq: do not free…

In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: Fix direction for 0-length ioctl control messages The syzbot fuzzer found a problem in the usbtmc driver: When a user submits an ioctl for a 0-length control transfer, the driver does not check that the direction is set to OUT: ------------[ cut here ]------------ usb 3-1: BOGUS control dir, pipe 80000b80 doesn't match bRequestType fd WARNING: CPU: 0 PID: 5100 at drivers/usb/core/urb.c:411 usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Modules linked in: CPU: 0 PID: 5100 Comm: syz-executor428 Not tainted 6.3.0-syzkaller-12049-g58390c8ce1bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 RIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Code: 7c 24 40 e8 1b 13 5c fb 48 8b 7c 24 40 e8 21 1d f0 fe 45 89 e8 44 89 f1 4c 89 e2 48 89 c6 48 c7 c7 e0 b5 fc 8a e8 19 c8 23 fb <0f> 0b e9 9f ee ff ff e8 ed 12 5c fb 0f b6 1d 12 8a 3c 08 31 ff 41 RSP: 0018:ffffc90003d2fb00 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8880789e9058 RCX: 0000000000000000 RDX: ffff888029593b80 RSI: ffffffff814c1447 RDI: 0000000000000001 RBP: ffff88801ea742f8 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff88802915e528 R13: 00000000000000fd R14: 0000000080000b80 R15: ffff8880222b3100 FS: 0000555556ca63c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9ef4d18150 CR3: 0000000073e5b000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153 usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1954 [inline] usbtmc_ioctl+0x1b3d/0x2840 drivers/usb/class/usbtmc.c:2097 To fix this, we must override the direction in the bRequestType field of the control request structure when the length is 0.