CVE-2023-53769

In the Linux kernel, the following vulnerability has been resolved: virt/coco/sev-guest: Double-buffer messages The encryption algorithms read and write directly to shared unencrypted memory, which may leak information as well as permit the host to tamper with the message integrity. Instead, copy whole messages in or out as needed before doing any computation on them.

In the Linux kernel, the following vulnerability has been resolved: virt/coco/sev-guest: Double-buffer messages The encryption algorithms read and write directly to shared unencrypted memory, which may leak information as well as permit the host to tamper with the message integrity. Instead, copy whole messages in or out as needed before doing any computation on them.

• wifi: ath11k: update channel list in reg notifier instead reg worker {CVE-2025-23133}
• wifi: cfg80211: call reg_notifier for self managed wiphy from driver hint {CVE-2025-23133}
• KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception {CVE-2025-37957}
• KVM: x86: forcibly leave nested mode on vCPU reset {CVE-2022-3344}
• RDMA/umem: Fix truncation for block sizes >= 4G {CVE-2026-53133}
• crypto: arm64/poly1305 - fix a read out-of-bound {CVE-2022-50231}
• tls: handle data disappearing from under the TLS ULP {CVE-2025-38616}
• Bluetooth: btmtk: validate WMT event SKB length before struct access {CVE-2026-46140}
• Bluetooth: L2CAP: complete CVE-2026-23395 hardening (chan_lock + ident clear + memset ordering)
• wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit {CVE-2026-31579}
• net: add exit_batch_rtnl() method
• rxrpc: Fix data-race warning and potential load/store tearing {CVE-2026-23118}
• virt/coco/sev-guest: Double-buffer messages {CVE-2023-53769}
• ASoC: SOF: avoid a NULL dereference with unsupported widgets {CVE-2023-54233}
• bnxt_en: Fix memory corruption when FW resources change during ifdown {CVE-2025-39810}
• scsi: qla2xxx: Free sp in error path to fix system crash {CVE-2025-71232}
• sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting {CVE-2026-23371}
• net: rfkill: prevent unlimited numbers of rfkill events from being created {CVE-2026-31670}
• intel_th: fix device leak on output open() {CVE-2026-23091}
• batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
• rxrpc: Fix call removal to use RCU safe deletion {CVE-2026-31642}
• i2c: s3c24xx: check the size of the SMBUS message before using it {CVE-2026-31627}
• Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop {CVE-2026-31498}
• mtd: rawnand: serialize lock/unlock against other NAND operations {CVE-2026-23434}
• x86/efi: defer freeing of boot services memory {CVE-2026-23352}
• KVM: Don't clobber irqfd routing type when deassigning irqfd {CVE-2026-23198}
• nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec {CVE-2026-23112}
• usb: typec: ucsi: Handle incorrect num_connectors capability {CVE-2025-71108}
• KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer {CVE-2025-71104}
• drm/ttm: Avoid NULL pointer deref for evicted BOs {CVE-2025-71083}
• amba: bus: fix refcount leak {CVE-2023-54230}
• exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree {CVE-2023-54194}
• octeontx2-af: Add validation for lmac type {CVE-2023-54129}
• rcu: dump vmalloc memory info safely {CVE-2023-54113}
• wifi: rtw88: use work to update rate to avoid RCU warning {CVE-2023-54071}
• bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps {CVE-2023-54033}
• ASoC: soc-compress: Reposition and add pcm_mutex {CVE-2023-53866}
• netlink: do not hard code device address lenth in fdb dumps {CVE-2023-53863}
• md/raid5-cache: fix a deadlock in r5l_exit_log() {CVE-2023-53848}
• tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak {CVE-2022-50824}
• net: stmmac: fix possible memory leak in stmmac_dvr_probe() {CVE-2022-50663}
• bpf: Fix reference state management for synchronous callbacks {CVE-2022-50650}
• blk-mq: fix tags leak when shrink nr_hw_queues {CVE-2023-54227}
• usbnet: Run unregister_netdev() before unbind() again {CVE-2022-49501}
• scsi: core: Wake up the error handler when final completions race against each other {CVE-2026-23110}
• scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
• perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563}
• Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ {CVE-2026-23395}
• Bluetooth: L2CAP: Fix responding with wrong PDU type
• netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
• CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
• CVE-2024-56590: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (bsc#1235038).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
• CVE-2025-40139: net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (bsc#1253409).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
• CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).

The following non security issues were fixed:

• ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (git-fixes).
• ACPI: PRM: Remove unnecessary strict handler address checks (git-fixes).
• ACPI: property: Do not pass NULL handles to acpi_attach_data() (git-fixes).
• ACPI: property: Fix buffer properties extraction for subnodes (git-fixes).
• KVM: SVM: Fix TSC_AUX virtualization setup (git-fixes).
• RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes).
• RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes).
• RDMA/hns: Fix the modification of max_send_sge (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
• RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes).
• RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes).
• RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
• arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled (git-fixes).
• cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls (git-fixes).
• cpuidle: Move IRQ state validation (git-fixes).
• cpuidle: haltpoll: Do not enable interrupts when entering idle (git-fixes).
• dm: free table mempools if not used in __bind (git-fixes).
• padata: Honor the caller's alignment in case of chunk_size 0 (bsc#1237563).
• platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (git-fixes).
• x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (git-fixes).
• x86/bugs: Use SBPB in write_ibpb() if applicable (git-fixes).
• x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (git-fixes).
• x86/tdx: Drop flags from __tdx_hypercall() (git-fixes).
• x86/tdx: Dynamically disable SEPT violations from causing #VEs (git-fixes).
• x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (git-fixes).
• x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs (git-fixes).
• x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed()…

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
• CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
• CVE-2024-56590: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (bsc#1235038).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
• CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
• CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).

The following non security issues were fixed:

• ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (git-fixes).
• ACPI: PRM: Remove unnecessary strict handler address checks (git-fixes).
• ACPI: property: Do not pass NULL handles to acpi_attach_data() (git-fixes).
• ACPI: property: Fix buffer properties extraction for subnodes (git-fixes).
• KVM: SVM: Fix TSC_AUX virtualization setup (git-fixes).
• RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes).
• RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes).
• RDMA/hns: Fix the modification of max_send_sge (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
• RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes).
• RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes).
• RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
• arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled (git-fixes).
• cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls (git-fixes).
• cpuidle: Move IRQ state validation (git-fixes).
• cpuidle: haltpoll: Do not enable interrupts when entering idle (git-fixes).
• dm: free table mempools if not used in __bind (git-fixes).
• padata: Honor the caller's alignment in case of chunk_size 0 (bsc#1237563).
• platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (git-fixes).
• x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (git-fixes).
• x86/bugs: Use SBPB in write_ibpb() if applicable (git-fixes).
• x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (git-fixes).
• x86/tdx: Drop flags from __tdx_hypercall() (git-fixes).
• x86/tdx: Dynamically disable SEPT violations from causing #VEs (git-fixes).
• x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (git-fixes).
• x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs (git-fixes).
• x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed()…