CVE-2023-54057

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux SIG Cloud 8.10 Release Notes linked from the References section.

• gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully {CVE-2022-48660}
• ipv4: check for NULL idev in ip_route_use_hint() {CVE-2024-36008}
• KEYS: trusted: Do not use WARN when encode fails {CVE-2024-36975}
• Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027}
• xhci: Fix null pointer dereference when host dies {CVE-2023-52898}
• sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
• blk-mq: fix IO hang from sbitmap wakeup race {CVE-2024-26671}
• net: openvswitch: fix flow memory leak in ovs_flow_cmd_new {CVE-2023-52977}
• gpiolib: fix memory leak in gpiochip_setup_dev() {CVE-2022-48975}
• HID: betop: check shape of output reports {CVE-2023-53015}
• mm/swapfile: add cond_resched() in get_swap_pages() {CVE-2023-52932}
• HV: hv_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-52937}
• drm/i915: Fix a memory leak with reused mmap_offset {CVE-2023-53002}
• ptdma: pt_core_execute_cmd() should use spinlock {CVE-2023-53013}
• RDMA/core: Fix ib block iterator counter overflow {CVE-2023-53026}
• Bluetooth: hci_conn: Fix memory leaks {CVE-2023-53018}
• scsi: target: pscsi: Fix bio_put() for error case {CVE-2024-26760}
• sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}
• pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
• cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}
• ALSA: hda/cs8409: Fix possible NULL dereference {CVE-2024-50160}
• nbd: don't allow reconnect after disconnect {CVE-2025-21731}
• openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
• ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
• ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}
• net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
• wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
• ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
• ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping {CVE-2025-40121}
• i40e: Fix macvlan leak by synchronizing access to mac_filter_hash {CVE-2024-50041}
• net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() {CVE-2024-50000}
• bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}
• xsk: check IFF_UP earlier in Tx path {CVE-2023-53240}
• firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
• virtgpu: don't reset on shutdown {CVE-2025-38064}
• xen/netfront: fix crash when removing device {CVE-2022-48969}
• mptcp: do not fallback when OoO is present {CVE-2024-50185}
• can: j1939: add missing calls in NETDEV_UNREGISTER notification handler {CVE-2025-39925}
• netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160}
• xfs: fix use-after-free in xattr node block inactivation {CVE-2026-43053}
• ext4: fix racy may inline data check in dio write {CVE-2023-52786}
• drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini {CVE-2023-52738}
• macsec: fix UAF bug for real_dev {CVE-2022-49390}
• drm/i915/gem: Fix Virtual Memory mapping boundaries calculation {CVE-2024-42259}
• mm/shmem: disable PMD-sized page cache if needed {CVE-2024-42241}
• driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
• udmabuf: fix memory leak on last export_udmabuf() error path {CVE-2024-56712}
• ALSA: control: Avoid WARN() for symlink errors {CVE-2024-56657}
• mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM {CVE-2024-56611}
• eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}
• net: annotate data-races around sk->sk_{data_ready,write_space} {CVE-2026-23302}
• udmabuf: change folios array from kmalloc to kvmalloc {CVE-2024-56544}
• RDMA/mlx5: Move events notifier registration to be after device registration {CVE-2024-53224}
• dlm: fix possible lkb_resource…

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter

The 'acpiid' buffer in the parse_ivrs_acpihid function may overflow, because the string specifier in the format string sscanf() has no width limitation.

Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter The 'acpiid' buffer in the parse_ivrs_acpihid function may overflow, because the string specifier in the format string sscanf() has no width limitation. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
• CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
• CVE-2024-56590: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (bsc#1235038).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
• CVE-2025-40139: net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (bsc#1253409).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
• CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).

The following non security issues were fixed:

• ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (git-fixes).
• ACPI: PRM: Remove unnecessary strict handler address checks (git-fixes).
• ACPI: property: Do not pass NULL handles to acpi_attach_data() (git-fixes).
• ACPI: property: Fix buffer properties extraction for subnodes (git-fixes).
• KVM: SVM: Fix TSC_AUX virtualization setup (git-fixes).
• RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes).
• RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes).
• RDMA/hns: Fix the modification of max_send_sge (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
• RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes).
• RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes).
• RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
• arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled (git-fixes).
• cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls (git-fixes).
• cpuidle: Move IRQ state validation (git-fixes).
• cpuidle: haltpoll: Do not enable interrupts when entering idle (git-fixes).
• dm: free table mempools if not used in __bind (git-fixes).
• padata: Honor the caller's alignment in case of chunk_size 0 (bsc#1237563).
• platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (git-fixes).
• x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (git-fixes).
• x86/bugs: Use SBPB in write_ibpb() if applicable (git-fixes).
• x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (git-fixes).
• x86/tdx: Drop flags from __tdx_hypercall() (git-fixes).
• x86/tdx: Dynamically disable SEPT violations from causing #VEs (git-fixes).
• x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (git-fixes).
• x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs (git-fixes).
• x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed()…

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
• CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
• CVE-2024-56590: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (bsc#1235038).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
• CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
• CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).

The following non security issues were fixed:

• ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (git-fixes).
• ACPI: PRM: Remove unnecessary strict handler address checks (git-fixes).
• ACPI: property: Do not pass NULL handles to acpi_attach_data() (git-fixes).
• ACPI: property: Fix buffer properties extraction for subnodes (git-fixes).
• KVM: SVM: Fix TSC_AUX virtualization setup (git-fixes).
• RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes).
• RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes).
• RDMA/hns: Fix the modification of max_send_sge (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
• RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes).
• RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes).
• RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
• arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled (git-fixes).
• cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls (git-fixes).
• cpuidle: Move IRQ state validation (git-fixes).
• cpuidle: haltpoll: Do not enable interrupts when entering idle (git-fixes).
• dm: free table mempools if not used in __bind (git-fixes).
• padata: Honor the caller's alignment in case of chunk_size 0 (bsc#1237563).
• platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (git-fixes).
• x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (git-fixes).
• x86/bugs: Use SBPB in write_ibpb() if applicable (git-fixes).
• x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (git-fixes).
• x86/tdx: Drop flags from __tdx_hypercall() (git-fixes).
• x86/tdx: Dynamically disable SEPT violations from causing #VEs (git-fixes).
• x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (git-fixes).
• x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs (git-fixes).
• x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed()…

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter The 'acpiid' buffer in the parse_ivrs_acpihid function may overflow, because the string specifier in the format string sscanf() has no width limitation. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.