CVE-2023-5717

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation.

If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer.

We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach().(CVE-2022-44033)

An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.(CVE-2022-45919)

An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur.(CVE-2023-31083)

An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.(CVE-2023-31085)

Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable. A (malicious) guest administrator could cause a denial of service (DoS) in a backend domain (other than dom0) by disabling a paravirtualized device. A malicious backend could cause DoS in a guest running a Linux kernel by disabling a paravirtualized device.(CVE-2023-34324)

A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure.(CVE-2023-39194)

An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.(CVE-2023-45863)

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation.

If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer.

We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.

(CVE-2023-5717)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach().(CVE-2022-44033)

An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.(CVE-2022-45919)

An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur.(CVE-2023-31083)

An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.(CVE-2023-31085)

Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable. A (malicious) guest administrator could cause a denial of service (DoS) in a backend domain (other than dom0) by disabling a paravirtualized device. A malicious backend could cause DoS in a guest running a Linux kernel by disabling a paravirtualized device.(CVE-2023-34324)

A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure.(CVE-2023-39194)

An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.(CVE-2023-45863)

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation.

If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer.

We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.

(CVE-2023-5717)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach().(CVE-2022-44033)

An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.(CVE-2022-45919)

VUL-0: CVE-2023-2593: kernel: Linux Kernel ksmbd Memory Exhaustion Denial-of-Service Vulnerability(CVE-2023-2593)

There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem.(CVE-2023-2898)

An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur.(CVE-2023-31083)

An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.(CVE-2023-31085)

VUL-0: CVE-2023-32246: kernel: Linux Kernel ksmbd RCU Callback Race Condition Local Privilege Escalation Vulnerability(CVE-2023-32246)

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.(CVE-2023-32254)

Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable. A (malicious) guest administrator could cause a denial of service (DoS) in a backend domain (other than dom0) by disabling a paravirtualized device. A malicious backend could cause DoS in a guest running a Linux kernel by disabling a paravirtualized device.(CVE-2023-34324)

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39189)

A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure.(CVE-2023-39192)

A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39193)

A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information…

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach().(CVE-2022-44033)

An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.(CVE-2022-45919)

VUL-0: CVE-2023-2593: kernel: Linux Kernel ksmbd Memory Exhaustion Denial-of-Service Vulnerability(CVE-2023-2593)

There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem.(CVE-2023-2898)

An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur.(CVE-2023-31083)

An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.(CVE-2023-31085)

VUL-0: CVE-2023-32246: kernel: Linux Kernel ksmbd RCU Callback Race Condition Local Privilege Escalation Vulnerability(CVE-2023-32246)

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.(CVE-2023-32254)

Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable. A (malicious) guest administrator could cause a denial of service (DoS) in a backend domain (other than dom0) by disabling a paravirtualized device. A malicious backend could cause DoS in a guest running a Linux kernel by disabling a paravirtualized device.(CVE-2023-34324)

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39189)

A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure.(CVE-2023-39192)

A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39193)

A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information…

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach().(CVE-2022-44033)

An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.(CVE-2022-45919)

VUL-0: CVE-2023-2593: kernel: Linux Kernel ksmbd Memory Exhaustion Denial-of-Service Vulnerability(CVE-2023-2593)

There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem.(CVE-2023-2898)

An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur.(CVE-2023-31083)

An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.(CVE-2023-31085)

VUL-0: CVE-2023-32246: kernel: Linux Kernel ksmbd RCU Callback Race Condition Local Privilege Escalation Vulnerability(CVE-2023-32246)

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.(CVE-2023-32254)

Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable. A (malicious) guest administrator could cause a denial of service (DoS) in a backend domain (other than dom0) by disabling a paravirtualized device. A malicious backend could cause DoS in a guest running a Linux kernel by disabling a paravirtualized device.(CVE-2023-34324)

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39189)

A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure.(CVE-2023-39192)

A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39193)

A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information…

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)
• kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)
• kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)
• kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)
• kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination (CVE-2024-0646)
• kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)
• kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)
• kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073)
• kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() (CVE-2023-1838)
• kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)
• kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)
• kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its child's sibling_list (CVE-2023-5717)
• kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356)
• kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535)
• kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536)
• kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)
• kernel: OOB Access in smb2_dump_detail (CVE-2023-6610)
• kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)
• kernel: SEV-ES local priv escalation (CVE-2023-46813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2023-31085 // CVE-url: https://ubuntu.com/security/CVE-2023-31085
  • ubi: Refuse attaching if mtd's erasesize is 0
• Jammy update: v5.15.121 upstream stable release (LP: #2032689) // CVE-url: https://ubuntu.com/security/CVE-2023-4132
  • media: usb: siano: Fix warning due to null work_func_t function pointer
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-4132
  • media: usb: siano: Fix use after free bugs caused by do_submit_urb
• CVE-2023-5717 // CVE-url: https://ubuntu.com/security/CVE-2023-5717
  • perf: Disallow mis-matched inherited group reads
• CVE-url: https://ubuntu.com/security/CVE-2023-1838
  • Fix double fget() in vhost_net_set_backend()
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-1077
  • sched/rt: pick_next_rt_entity(): check list_entry
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-1076
  • net: add sock_init_data_uid()
  • tun: tun_chr_open(): correctly initialize socket uid
  • tap: tap_open(): correctly initialize socket uid
• CVE-url: https://ubuntu.com/security/CVE-2023-45863
  • kobject: Fix slab-out-of-bounds in fill_kobj_path()
• CVE-url: https://ubuntu.com/security/CVE-2023-45871
  • igb: set max size RX buffer when store bad packet is enabled
• Jammy update: v5.15.100 upstream stable release (LP: #2020387) // CVE-url: https://ubuntu.com/security/CVE-2023-45862
  • USB: ene_usb6250: Allocate enough memory for full object
• CVE-url: https://ubuntu.com/security/CVE-2023-39189
  • netfilter: nfnetlink_osf: avoid OOB read

• CVE-2023-31085 // CVE-url: https://ubuntu.com/security/CVE-2023-31085
  • ubi: Refuse attaching if mtd's erasesize is 0
• Jammy update: v5.15.121 upstream stable release (LP: #2032689) // CVE-url: https://ubuntu.com/security/CVE-2023-4132
  • media: usb: siano: Fix warning due to null work_func_t function pointer
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-4132
  • media: usb: siano: Fix use after free bugs caused by do_submit_urb
• CVE-2023-5717 // CVE-url: https://ubuntu.com/security/CVE-2023-5717
  • perf: Disallow mis-matched inherited group reads
• CVE-url: https://ubuntu.com/security/CVE-2023-1838
  • Fix double fget() in vhost_net_set_backend()
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-1077
  • sched/rt: pick_next_rt_entity(): check list_entry
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-1076
  • net: add sock_init_data_uid()
  • tun: tun_chr_open(): correctly initialize socket uid
  • tap: tap_open(): correctly initialize socket uid
• CVE-url: https://ubuntu.com/security/CVE-2023-45863
  • kobject: Fix slab-out-of-bounds in fill_kobj_path()
• CVE-url: https://ubuntu.com/security/CVE-2023-45871
  • igb: set max size RX buffer when store bad packet is enabled
• Jammy update: v5.15.100 upstream stable release (LP: #2020387) // CVE-url: https://ubuntu.com/security/CVE-2023-45862
  • USB: ene_usb6250: Allocate enough memory for full object
• CVE-url: https://ubuntu.com/security/CVE-2023-39189
  • netfilter: nfnetlink_osf: avoid OOB read

• CVE-url: https://ubuntu.com/security/CVE-2023-45871
  • igb: Limit maximum frame Rx based on MTU
  • igb: Only sync size of expected frame in ethtool testing
  • igb: Add support for ethtool private flag to allow use of legacy Rx
  • igb: Add support for using order 1 pages to receive large frames
  • igb: set max size RX buffer when store bad packet is enabled
• CVE-2023-31085 // CVE-url: https://ubuntu.com/security/CVE-2023-31085
  • ubi: Refuse attaching if mtd's erasesize is 0
• CVE-2023-5717 // CVE-url: https://ubuntu.com/security/CVE-2023-5717
  • perf: Disallow mis-matched inherited group reads
• Bionic update: upstream stable patchset 2022-09-23 (LP: #1990698) // CVE- url: https://ubuntu.com/security/CVE-2022-3629
  • vsock: Fix memory leak in vsock_connect()
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-1077
  • sched/rt: pick_next_rt_entity(): check list_entry
• CVE-url: https://ubuntu.com/security/CVE-2023-1077
  • sched/debug: Add SCHED_WARN_ON()
• CVE-url: https://ubuntu.com/security/CVE-2023-45863
  • kobject: Fix slab-out-of-bounds in fill_kobj_path()
• Jammy update: v5.15.100 upstream stable release (LP: #2020387) // CVE-url: https://ubuntu.com/security/CVE-2023-45862
  • USB: ene_usb6250: Allocate enough memory for full object
• CVE-url: https://ubuntu.com/security/CVE-2023-39189
  • netfilter: nfnetlink_osf: avoid OOB read

• CVE-url: https://ubuntu.com/security/CVE-2023-45871
  • igb: Limit maximum frame Rx based on MTU
  • igb: Only sync size of expected frame in ethtool testing
  • igb: Add support for ethtool private flag to allow use of legacy Rx
  • igb: Add support for using order 1 pages to receive large frames
  • igb: set max size RX buffer when store bad packet is enabled
• CVE-2023-31085 // CVE-url: https://ubuntu.com/security/CVE-2023-31085
  • ubi: Refuse attaching if mtd's erasesize is 0
• CVE-2023-5717 // CVE-url: https://ubuntu.com/security/CVE-2023-5717
  • perf: Disallow mis-matched inherited group reads
• Bionic update: upstream stable patchset 2022-09-23 (LP: #1990698) // CVE- url: https://ubuntu.com/security/CVE-2022-3629
  • vsock: Fix memory leak in vsock_connect()
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-1077
  • sched/rt: pick_next_rt_entity(): check list_entry
• CVE-url: https://ubuntu.com/security/CVE-2023-1077
  • sched/debug: Add SCHED_WARN_ON()
• CVE-url: https://ubuntu.com/security/CVE-2023-45863
  • kobject: Fix slab-out-of-bounds in fill_kobj_path()
• Jammy update: v5.15.100 upstream stable release (LP: #2020387) // CVE-url: https://ubuntu.com/security/CVE-2023-45862
  • USB: ene_usb6250: Allocate enough memory for full object
• CVE-url: https://ubuntu.com/security/CVE-2023-39189
  • netfilter: nfnetlink_osf: avoid OOB read

• ima: Fix use-after-free on a dentry's dname.name {CVE-2024-39494}
• ima: define ima_max_digest_data struct without a flexible array variable
• ima: detect changes to the backing overlay file
• tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). {CVE-2024-36904}
• af_unix: Fix garbage collector racing against connect() {CVE-2024-26923}
• net/ipv6: avoid possible UAF in ip6_route_mpath_notify() {CVE-2024-26852}
• net/mlx5: Fix a race on command flush flow {CVE-2022-48858}
• sctp: fix kernel-infoleak for SCTP sockets {CVE-2022-48855}
• libbpf: Fix use-after-free in btf_dump_name_dups {CVE-2022-3534}
• net: fix __dst_negative_advice() race {CVE-2024-36971}
• ext4: fix kernel BUG in 'ext4_write_inline_data_end()' {CVE-2021-33631}
• tipc: fix UAF in error path {CVE-2024-36886}
• smb: client: fix parsing of SMB3.1.1 POSIX create context {CVE-2023-52434}
• smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• perf: Disallow mis-matched inherited group reads {CVE-2023-5717}
• af_unix: Fix null-ptr-deref in unix_stream_sendpage(). {CVE-2023-4622}
• sched/rt: pick_next_rt_entity(): check list_entry {CVE-2023-1077}
• i2c: Fix a potential use after free {CVE-2019-25162}

• ima: Fix use-after-free on a dentry's dname.name {CVE-2024-39494}
• ima: define ima_max_digest_data struct without a flexible array variable
• ima: detect changes to the backing overlay file
• tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). {CVE-2024-36904}
• af_unix: Fix garbage collector racing against connect() {CVE-2024-26923}
• net/ipv6: avoid possible UAF in ip6_route_mpath_notify() {CVE-2024-26852}
• net/mlx5: Fix a race on command flush flow {CVE-2022-48858}
• sctp: fix kernel-infoleak for SCTP sockets {CVE-2022-48855}
• bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem. {CVE-2022-0500}
• bpf: Make per_cpu_ptr return rdonly PTR_TO_MEM. {CVE-2022-0500}
• bpf: Introduce MEM_RDONLY flag {CVE-2022-0500}
• bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL {CVE-2022-0500}
• bpf: Replace RET_XXX_OR_NULL with RET_XXX | PTR_MAYBE_NULL {CVE-2022-0500}
• bpf: Replace ARG_XXX_OR_NULL with ARG_XXX | PTR_MAYBE_NULL {CVE-2022-0500}
• bpf: Introduce composable reg, ret and arg types. {CVE-2022-0500}
• bpf: Extract nullable reg type conversion into a helper function {CVE-2022-0500}
• bpf: Rename bpf_reg_state variables {CVE-2022-0500}
• libbpf: Fix use-after-free in btf_dump_name_dups {CVE-2022-3534}
• net: fix __dst_negative_advice() race {CVE-2024-36971}
• ext4: fix kernel BUG in 'ext4_write_inline_data_end()' {CVE-2021-33631}
• tipc: fix UAF in error path {CVE-2024-36886}
• smb: client: fix parsing of SMB3.1.1 POSIX create context {CVE-2023-52434}
• smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• perf: Disallow mis-matched inherited group reads {CVE-2023-5717}
• af_unix: Fix null-ptr-deref in unix_stream_sendpage(). {CVE-2023-4622}
• sched/rt: pick_next_rt_entity(): check list_entry {CVE-2023-1077}
• i2c: Fix a potential use after free {CVE-2019-25162}

• tipc: Return non-zero value from tipc_udp_addr2str() on error {CVE-2024-42284}
• dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
• RDMA/iwcm: Fix a use-after-free related to destroying CM IDs {CVE-2024-42285}
• scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}
• ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
• block/ioctl: prefer different overflow check {CVE-2024-41000}
• ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." {CVE-2024-40984}
• net/sched: Fix UAF when resolving a clash {CVE-2024-41040}
• nvme: avoid double free special payload {CVE-2024-41073}
• x86/tdx: Allow 32-bit emulation by default {CVE-2024-25744}
• x86/entry: Do not allow external 0x80 interrupts {CVE-2024-25742}
• x86/entry: Convert INT 0x80 emulation to IDTENTRY {CVE-2024-25742}
• x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25742}
• x86: Make IA32_EMULATION boot time configurable {CVE-2024-25744}
• x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() {CVE-2024-25744}
• x86/elf: Make loading of 32bit processes depend on ia32_enabled() {CVE-2024-25744}
• x86/entry: Compile entry_SYSCALL32_ignore() unconditionally {CVE-2024-25744}
• x86/entry: Rename ignore_sysret() {CVE-2024-25744}
• x86/cpu: Don't write CSTAR MSR on Intel CPUs {CVE-2024-25744}
• x86: Introduce ia32_enabled() {CVE-2024-25742}
• x86: Fix misspelled Kconfig symbols {CVE-2024-25744}
• x86/sev: Harden #VC instruction emulation somewhat {CVE-2024-25742}
• objtool: Add entry UNRET validation {CVE-2024-25744}
• x86/cpu: Switch to arch_cpu_finalize_init() {CVE-2022-40982}
• init: Provide arch_cpu_finalize_init() {CVE-2022-40982}
• gfs2: Fix potential glock use-after-free on unmount {CVE-2024-38570}
• gfs2: Rename sd_{ glock => kill }_wait {CVE-2024-38570}
• gfs2: Remove ill-placed consistency check {CVE-2024-38570}
• gfs2: simplify gdlm_put_lock with out_free label {CVE-2024-38570}
• dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list {CVE-2024-40956}
• drm/amdgpu: add error handle to avoid out-of-bounds {CVE-2024-39471}
• net/mlx5: Discard command completions in internal error {CVE-2024-38555}
• net: bridge: xmit: make sure we have at least eth header len bytes {CVE-2024-38538}
• netfilter: nftables: exthdr: fix 4-byte stack OOB write {CVE-2023-52628}
• perf/core: Fix potential NULL deref {CVE-2023-5717}
• perf: Disallow mis-matched inherited group reads {CVE-2023-5717}

This kernel update is based on upstream 6.5.11 and fixes or adds mitigations for at least the following security issues:

A use-after-free vulnerability was found in drivers/nvme/target/tcp.cinnvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation in case that the attacker already has local privileges. (CVE-2023-5178)

x86: KVM: SVM: always update the x2avic msr interception: The following problem exists since x2avic was enabled in the KVM: svm_set_x2apic_msr_interception is called to enable the interception of the x2apic msrs. In particular it is called at the moment the guest resets its apic. Assuming that the guest's apic is in x2apic mode, the reset will bring it back to the xapic mode. The svm_set_x2apic_msr_interception however has an erroneous check for '!apic_x2apic_mode()' which prevents it from doing anything in this case. As a result of this, all x2apic msrs are left unintercepted, and that exposes the bare metal x2apic (if enabled) to the guest. Removing the erroneous '!apic_x2apic_mode()' check fixes that. (CVE-2023-5090)

In unprivileged Xen guests event handling can cause a deadlock with Xen console handling. The evtchn_rwlock and the hvc_lock are taken in opposite sequence in __hvc_poll() and in Xen console IRQ handling. This is fixed by xen/events: replace evtchn_rwlock with RCU (CVE-2023-34324)

A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free. We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705 (CVE-2023-5345)

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (CVE-2023-39189)

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges. (CVE-2023-5633)

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06. (CVE-2023-5717)

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it. (CVE-2023-46813)

A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to crash the system or escalate their privileges on the system. (CVE-2023-6176)

Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of…

This kernel update is based on upstream 6.5.11 and fixes or adds mitigations for at least the following security issues:

A use-after-free vulnerability was found in drivers/nvme/target/tcp.cinnvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation in case that the attacker already has local privileges. (CVE-2023-5178)

x86: KVM: SVM: always update the x2avic msr interception: The following problem exists since x2avic was enabled in the KVM: svm_set_x2apic_msr_interception is called to enable the interception of the x2apic msrs. In particular it is called at the moment the guest resets its apic. Assuming that the guest's apic is in x2apic mode, the reset will bring it back to the xapic mode. The svm_set_x2apic_msr_interception however has an erroneous check for '!apic_x2apic_mode()' which prevents it from doing anything in this case. As a result of this, all x2apic msrs are left unintercepted, and that exposes the bare metal x2apic (if enabled) to the guest. Removing the erroneous '!apic_x2apic_mode()' check fixes that. (CVE-2023-5090)

In unprivileged Xen guests event handling can cause a deadlock with Xen console handling. The evtchn_rwlock and the hvc_lock are taken in opposite sequence in __hvc_poll() and in Xen console IRQ handling. This is fixed by xen/events: replace evtchn_rwlock with RCU (CVE-2023-34324)

A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free. We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705 (CVE-2023-5345)

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (CVE-2023-39189)

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges. (CVE-2023-5633)

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06. (CVE-2023-5717)

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it. (CVE-2023-46813)

A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to crash the system or escalate their privileges on the system. (CVE-2023-6176)

Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

• kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation (CVE-2024-0193)

• kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination (CVE-2024-0646)

• kernel: Use-after-free in nft_verdict_dump due to a race between set GC and transaction (CVE-2023-4244)

• kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its child's sibling_list (CVE-2023-5717)

• kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356)

• kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535)

• kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536)

• kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)

• kernel: OOB Access in smb2_dump_detail (CVE-2023-6610)

• kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (CVE-2023-51042)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).
• CVE-2023-2006: Fixed a race condition in the RxRPC network protocol (bsc#1210447).
• CVE-2023-5633: Fixed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface (bsc#1216527).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in drivers/net/usb/lan78xx.c (bsc#1217068).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in drivers/vhost/vringh.c in the host side of a virtio ring (bsc#1215710).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-25775: Fixed improper access control in the Intel Ethernet Controller RDMA driver (bsc#1216959).
• CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo() (bsc#1216693).

The following non-security bugs were fixed:

• ACPI: FPDT: properly handle invalid FPDT subtables (git-fixes).
• ACPI: resource: Do IRQ override on TongFang GMxXGxx (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA (git-fixes).
• ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() (git-fixes).
• ALSA: hda/realtek - ALC287 Realtek I2S speaker platform support (git-fixes).
• ALSA: hda/realtek - Add Dell ALC295 to pin fall back table (git-fixes).
• ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS UX7602ZM (git-fixes).
• ALSA: hda/realtek: Add quirks for ASUS 2024 Zenbooks (git-fixes).
• ALSA: hda/realtek: Add quirks for HP Laptops (git-fixes).
• ALSA: hda/realtek: Add support dual speaker for Dell (git-fixes).
• ALSA: hda/realtek: Enable Mute LED on HP 255 G10 (git-fixes).
• ALSA: hda/realtek: Enable Mute LED on HP 255 G8 (git-fixes).
• ALSA: hda: ASUS UM5302LA: Added quirks for cs35L41/10431A83 on i2c bus (git-fixes).
• ALSA: hda: Disable power-save on KONTRON SinglePC (bsc#1217140).
• ALSA: hda: Fix possible null-ptr-deref when assigning a stream (git-fixes).
• ALSA: hda: cs35l41: Fix unbalanced pm_runtime_get() (git-fixes).
• ALSA: hda: cs35l41: Undo runtime PM changes at driver exit time (git-fixes).
• ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection (git-fixes).
• ALSA: info: Fix potential deadlock at disconnection (git-fixes).
• ALSA: usb-audio: add quirk flag to enable native DSD for McIntosh devices (git-fixes).
• ARM: 9321/1: memset: cast the constant byte to unsigned char (git-fixes).
• ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails (git-fixes).
• ASoC: SOF: core: Ensure sof_ops_free() is still called when probe never ran (git-fixes).
• ASoC: ams-delta.c: use component after check (git-fixes).
• ASoC: codecs: wsa-macro: fix uninitialized stack variables with name prefix (git-fixes).
• ASoC: cs35l41: Undo runtime PM changes at driver exit time (git-fixes).
• ASoC: cs35l41: Verify PM runtime resume errors in IRQ handler (git-fixes).
• ASoC: fsl: Fix PM disable depth imbalance in fsl_easrc_probe (git-fixes).
• ASoC: fsl: mpc5200_dma.c: Fix warning of Function parameter or member not described (git-fixes).
• ASoC: hdmi-codec: register hpd callback on component probe (git-fixes).
• ASoC: rt5650: fix the wrong result…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).
• CVE-2023-2006: Fixed a race condition in the RxRPC network protocol (bsc#1210447).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in drivers/net/usb/lan78xx.c (bsc#1217068).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in drivers/vhost/vringh.c in the host side of a virtio ring (bsc#1215710).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-25775: Fixed improper access control in the Intel Ethernet Controller RDMA driver (bsc#1216959).
• CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo() (bsc#1216693).

The following non-security bugs were fixed:

• ACPI: FPDT: properly handle invalid FPDT subtables (git-fixes).
• ACPI: resource: Do IRQ override on TongFang GMxXGxx (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA (git-fixes).
• ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() (git-fixes).
• ALSA: hda/realtek - Add Dell ALC295 to pin fall back table (git-fixes).
• ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC (git-fixes).
• ALSA: hda/realtek: Add quirks for HP Laptops (git-fixes).
• ALSA: hda/realtek: Enable Mute LED on HP 255 G10 (git-fixes).
• ALSA: hda/realtek: Enable Mute LED on HP 255 G8 (git-fixes).
• ALSA: hda: Disable power-save on KONTRON SinglePC (bsc#1217140).
• ALSA: hda: Fix possible null-ptr-deref when assigning a stream (git-fixes).
• ALSA: hda: cs35l41: Fix unbalanced pm_runtime_get() (git-fixes).
• ALSA: hda: cs35l41: Undo runtime PM changes at driver exit time (git-fixes).
• ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection (git-fixes).
• ALSA: info: Fix potential deadlock at disconnection (git-fixes).
• ARM: 9321/1: memset: cast the constant byte to unsigned char (git-fixes).
• ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails (git-fixes).
• ASoC: ams-delta.c: use component after check (git-fixes).
• ASoC: codecs: wsa-macro: fix uninitialized stack variables with name prefix (git-fixes).
• ASoC: cs35l41: Undo runtime PM changes at driver exit time (git-fixes).
• ASoC: cs35l41: Verify PM runtime resume errors in IRQ handler (git-fixes).
• ASoC: fsl: Fix PM disable depth imbalance in fsl_easrc_probe (git-fixes).
• ASoC: fsl: mpc5200_dma.c: Fix warning of Function parameter or member not described (git-fixes).
• ASoC: hdmi-codec: register hpd callback on component probe (git-fixes).
• ASoC: rt5650: fix the wrong result of key button (git-fixes).
• ASoC: simple-card: fixup asoc_simple_probe() error handling (git-fixes).
• ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings (git-fixes).
• Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE (git-fixes).
• Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables (git-fixes).
• Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559 (git-fixes).
• Bluetooth: btusb: Add date->evt_skb is NULL check (git-fixes).
• Disable Loongson drivers Loongson is a mips architecture, it does not make sense to build Loongson drivers on other architectures.
• Documentation: networking: correct possessive 'its' (bsc#1215458).
• Drivers:…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2006: Fixed a race condition in the RxRPC network protocol (bsc#1210447).
• CVE-2023-25775: Fixed improper access control in the Intel Ethernet Controller RDMA driver (bsc#1216959).
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-46813: Fixed SEV-ES local priv escalation (bsc#1212649).
• CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo() (bsc#1216693).
• CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in drivers/vhost/vringh.c in the host side of a virtio ring (bsc#1215710).
• CVE-2023-5633: Fixed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface (bsc#1216527).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in drivers/net/usb/lan78xx.c (bsc#1217068).
• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).

The following non-security bugs were fixed:

• acpi: fpdt: properly handle invalid fpdt subtables (git-fixes).
• acpi: resource: do irq override on tongfang gmxxgxx (git-fixes).
• acpi: resource: skip irq override on asus expertbook b1402cva (git-fixes).
• acpi: sysfs: fix create_pnp_modalias() and create_of_modalias() (git-fixes).
• alsa: hda/realtek - add dell alc295 to pin fall back table (git-fixes).
• alsa: hda/realtek - alc287 realtek i2s speaker platform support (git-fixes).
• alsa: hda/realtek - enable internal speaker of asus k6500zc (git-fixes).
• alsa: hda/realtek: add quirk for asus ux7602zm (git-fixes).
• alsa: hda/realtek: add quirks for asus 2024 zenbooks (git-fixes).
• alsa: hda/realtek: add quirks for hp laptops (git-fixes).
• alsa: hda/realtek: add support dual speaker for dell (git-fixes).
• alsa: hda/realtek: enable mute led on hp 255 g10 (git-fixes).
• alsa: hda/realtek: enable mute led on hp 255 g8 (git-fixes).
• alsa: hda: asus um5302la: added quirks for cs35l41/10431a83 on i2c bus (git-fixes).
• alsa: hda: cs35l41: fix unbalanced pm_runtime_get() (git-fixes).
• alsa: hda: cs35l41: undo runtime pm changes at driver exit time (git-fixes).
• alsa: hda: disable power-save on kontron singlepc (bsc#1217140).
• alsa: hda: fix possible null-ptr-deref when assigning a stream (git-fixes).
• alsa: hda: intel-dsp-config: fix jsl chromebook quirk detection (git-fixes).
• alsa: info: fix potential deadlock at disconnection (git-fixes).
• alsa: usb-audio: add quirk flag to enable native dsd for mcintosh devices (git-fixes).
• arm/xen: fix xen_vcpu_info allocation alignment (git-fixes).
• arm64: add cortex-a520 cpu part definition (git-fixes)
• arm64: allow kprobes on el0 handlers (git-fixes)
• arm64: armv8_deprecated move emulation functions (git-fixes)
• arm64: armv8_deprecated: fix unused-function error (git-fixes)
• arm64: armv8_deprecated: fold ops into insn_emulation (git-fixes)
• arm64: armv8_deprecated: move aarch32 helper earlier (git-fixes)
• arm64: armv8_deprecated: rework deprected instruction handling (git-fixes)
• arm64: consistently pass esr_elx to die() (git-fixes)
• arm64: die(): pass 'err' as…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).

The following non-security bugs were fixed:

• ALSA: hda: Disable power-save on KONTRON SinglePC (bsc#1217140).
• Call flush_delayed_fput() from nfsd main-loop (bsc#1217408).
• net: mana: Configure hwc timeout from hardware (bsc#1214037).
• net: mana: Fix MANA VF unload when hardware is unresponsive (bsc#1214764).
• powerpc: Do not clobber f0/vs0 during fp|altivec register save (bsc#1217780).

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2006: Fixed a race condition in the RxRPC network protocol (bsc#1210447).
• CVE-2023-25775: Fixed improper access control in the Intel Ethernet Controller RDMA driver (bsc#1216959).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo() (bsc#1216693).
• CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in drivers/vhost/vringh.c in the host side of a virtio ring (bsc#1215710).
• CVE-2023-5633: Fixed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface (bsc#1216527).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in drivers/net/usb/lan78xx.c (bsc#1217068).
• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).

The following non-security bugs were fixed:

• acpi: fpdt: properly handle invalid fpdt subtables (git-fixes).
• acpi: resource: do irq override on tongfang gmxxgxx (git-fixes).
• acpi: resource: skip irq override on asus expertbook b1402cva (git-fixes).
• acpi: sysfs: fix create_pnp_modalias() and create_of_modalias() (git-fixes).
• alsa: hda/realtek - add dell alc295 to pin fall back table (git-fixes).
• alsa: hda/realtek - alc287 realtek i2s speaker platform support (git-fixes).
• alsa: hda/realtek - enable internal speaker of asus k6500zc (git-fixes).
• alsa: hda/realtek: add quirk for asus ux7602zm (git-fixes).
• alsa: hda/realtek: add quirks for asus 2024 zenbooks (git-fixes).
• alsa: hda/realtek: add quirks for hp laptops (git-fixes).
• alsa: hda/realtek: add support dual speaker for dell (git-fixes).
• alsa: hda/realtek: enable mute led on hp 255 g10 (git-fixes).
• alsa: hda/realtek: enable mute led on hp 255 g8 (git-fixes).
• alsa: hda: asus um5302la: added quirks for cs35l41/10431a83 on i2c bus (git-fixes).
• alsa: hda: cs35l41: fix unbalanced pm_runtime_get() (git-fixes).
• alsa: hda: cs35l41: undo runtime pm changes at driver exit time (git-fixes).
• alsa: hda: disable power-save on kontron singlepc (bsc#1217140).
• alsa: hda: fix possible null-ptr-deref when assigning a stream (git-fixes).
• alsa: hda: intel-dsp-config: fix jsl chromebook quirk detection (git-fixes).
• alsa: info: fix potential deadlock at disconnection (git-fixes).
• alsa: usb-audio: add quirk flag to enable native dsd for mcintosh devices (git-fixes).
• arm/xen: fix xen_vcpu_info allocation alignment (git-fixes).
• arm64: add cortex-a520 cpu part definition (git-fixes)
• arm64: allow kprobes on el0 handlers (git-fixes)
• arm64: armv8_deprecated move emulation functions (git-fixes)
• arm64: armv8_deprecated: fix unused-function error (git-fixes)
• arm64: armv8_deprecated: fold ops into insn_emulation (git-fixes)
• arm64: armv8_deprecated: move aarch32 helper earlier (git-fixes)
• arm64: armv8_deprecated: rework deprected instruction handling (git-fixes)
• arm64: consistently pass esr_elx to die() (git-fixes)
• arm64: die(): pass 'err' as long (git-fixes)
• arm64: factor insn read out of call_undef_hook() (git-fixes)
• arm64: factor out el1 ssbs emulation hook (git-fixes)
• arm64: report el1 undefs better (git-fixes)
• arm64: rework bti exception handling…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).

The following non-security bugs were fixed:

• cpu/SMT: Allow enabling partial SMT states via sysfs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• cpu/SMT: Create topology_smt_thread_allowed() (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• cpu/SMT: Move SMT prototypes into cpu_smt.h (bsc#1214408).
• cpu/SMT: Move smt/control simple exit cases earlier (bsc#1214408).
• cpu/SMT: Remove topology_smt_supported() (bsc#1214408).
• cpu/SMT: Store the current/max number of threads (bsc#1214408).
• cpu/hotplug: Create SMT sysfs interface for all arches (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• dm-raid: remove useless checking in raid_message() (git-fixes).
• l2tp: fix refcount leakage on PPPoL2TP sockets (git-fixes).
• l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow (git-fixes).
• md/bitmap: always wake up md_thread in timeout_store (git-fixes).
• md/bitmap: factor out a helper to set timeout (git-fixes).
• md/raid10: Do not add spare disk when recovery fails (git-fixes).
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter (git-fixes).
• md/raid10: clean up md_add_new_disk() (git-fixes).
• md/raid10: fix io loss while replacement replace rdev (git-fixes).
• md/raid10: fix leak of 'r10bio->remaining' for recovery (git-fixes).
• md/raid10: fix memleak for 'conf->bio_split' (git-fixes).
• md/raid10: fix memleak of md thread (git-fixes).
• md/raid10: fix null-ptr-deref in raid10_sync_request (git-fixes).
• md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request (git-fixes).
• md/raid10: fix overflow of md/safe_mode_delay (git-fixes).
• md/raid10: fix wrong setting of max_corr_read_errors (git-fixes).
• md/raid10: improve code of mrdev in raid10_sync_request (git-fixes).
• md/raid10: prevent soft lockup while flush writes (git-fixes).
• md/raid10: prioritize adding disk to 'removed' mirror (git-fixes).
• md: Flush workqueue md_rdev_misc_wq in md_alloc() (git-fixes).
• md: add new workqueue for delete rdev (git-fixes).
• md: avoid signed overflow in slot_store() (git-fixes).
• md: do not return existing mddevs from mddev_find_or_alloc (git-fixes).
• md: factor out a mddev_alloc_unit helper from mddev_find (git-fixes).
• md: fix data corruption for raid456 when reshape restart while grow up (git-fixes).
• md: fix deadlock causing by sysfs_notify (git-fixes).
• md: fix incorrect declaration about claim_rdev in md_import_device (git-fixes).
• md: flush md_rdev_misc_wq for HOT_ADD_DISK case (git-fixes).
• md: get sysfs entry after redundancy attr group create (git-fixes).
• md: refactor mddev_find_or_alloc (git-fixes).
• md: remove lock_bdev / unlock_bdev (git-fixes).
• mm, memcg: add mem_cgroup_disabled checks in vmpressure and swap-related functions (bsc#1190208 (MM functional and performance backports) bsc#1216759).
• net-memcg: Fix scope of sockmem pressure indicators (bsc#1216759).
• net: mana: Configure hwc timeout from hardware (bsc#1214037).
• net: mana: Fix MANA VF unload when hardware is unresponsive (bsc#1214764).
• powerpc/pseries: Honour current SMT state when DLPAR onlining CPUs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• powerpc/pseries: Initialise CPU hotplug…

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2006: Fixed a race condition in the RxRPC network protocol (bsc#1210447).
• CVE-2023-25775: Fixed improper access control in the Intel Ethernet Controller RDMA driver (bsc#1216959).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo() (bsc#1216693).
• CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in drivers/vhost/vringh.c in the host side of a virtio ring (bsc#1215710).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in drivers/net/usb/lan78xx.c (bsc#1217068).
• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).

The following non-security bugs were fixed:

• acpi: fpdt: properly handle invalid fpdt subtables (git-fixes).
• acpi: resource: do irq override on tongfang gmxxgxx (git-fixes).
• acpi: resource: skip irq override on asus expertbook b1402cva (git-fixes).
• acpi: sysfs: fix create_pnp_modalias() and create_of_modalias() (git-fixes).
• alsa: hda/realtek - add dell alc295 to pin fall back table (git-fixes).
• alsa: hda/realtek - enable internal speaker of asus k6500zc (git-fixes).
• alsa: hda/realtek: add quirks for hp laptops (git-fixes).
• alsa: hda/realtek: enable mute led on hp 255 g10 (git-fixes).
• alsa: hda/realtek: enable mute led on hp 255 g8 (git-fixes).
• alsa: hda: cs35l41: fix unbalanced pm_runtime_get() (git-fixes).
• alsa: hda: cs35l41: undo runtime pm changes at driver exit time (git-fixes).
• alsa: hda: disable power-save on kontron singlepc (bsc#1217140).
• alsa: hda: fix possible null-ptr-deref when assigning a stream (git-fixes).
• alsa: hda: intel-dsp-config: fix jsl chromebook quirk detection (git-fixes).
• alsa: info: fix potential deadlock at disconnection (git-fixes).
• arm/xen: fix xen_vcpu_info allocation alignment (git-fixes).
• arm64: add cortex-a520 cpu part definition (git-fixes)
• arm64: allow kprobes on el0 handlers (git-fixes)
• arm64: armv8_deprecated move emulation functions (git-fixes)
• arm64: armv8_deprecated: fix unused-function error (git-fixes)
• arm64: armv8_deprecated: fold ops into insn_emulation (git-fixes)
• arm64: armv8_deprecated: move aarch32 helper earlier (git-fixes)
• arm64: armv8_deprecated: rework deprected instruction handling (git-fixes)
• arm64: consistently pass esr_elx to die() (git-fixes)
• arm64: die(): pass 'err' as long (git-fixes)
• arm64: factor insn read out of call_undef_hook() (git-fixes)
• arm64: factor out el1 ssbs emulation hook (git-fixes)
• arm64: report el1 undefs better (git-fixes)
• arm64: rework bti exception handling (git-fixes)
• arm64: rework el0 mrs emulation (git-fixes)
• arm64: rework fpac exception handling (git-fixes)
• arm64: split el0/el1 undef handlers (git-fixes)
• arm: 9321/1: memset: cast the constant byte to unsigned char (git-fixes).
• asoc: ams-delta.c: use component after check (git-fixes).
• asoc: codecs: wsa-macro: fix uninitialized stack variables with name prefix (git-fixes).
• asoc: cs35l41: undo runtime pm changes at driver exit time (git-fixes).
• asoc: cs35l41: verify pm runtime resume errors in irq handler (git-fixes).
• asoc: fsl: fix pm disable depth imbalance in…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).

The following non-security bugs were fixed:

• net: mana: Configure hwc timeout from hardware (bsc#1214037).
• net: mana: Fix MANA VF unload when hardware is unresponsive (bsc#1214764).
• powerpc: Do not clobber f0/vs0 during fp|altivec register save (bsc#1217780).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).

The following non-security bugs were fixed:

• USB: serial: option: add Quectel RM500U-CN modem (git-fixes).
• USB: serial: option: add Telit FE990 compositions (git-fixes).
• USB: serial: option: add UNISOC vendor and TOZED LT70C product (git-fixes).
• cpu/SMT: Allow enabling partial SMT states via sysfs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• cpu/SMT: Create topology_smt_thread_allowed() (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• cpu/SMT: Move SMT prototypes into cpu_smt.h (bsc#1214408).
• cpu/SMT: Move smt/control simple exit cases earlier (bsc#1214408).
• cpu/SMT: Remove topology_smt_supported() (bsc#1214408).
• cpu/SMT: Store the current/max number of threads (bsc#1214408).
• cpu/hotplug: Create SMT sysfs interface for all arches (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• dm-raid: remove useless checking in raid_message() (git-fixes).
• l2tp: fix refcount leakage on PPPoL2TP sockets (git-fixes).
• l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow (git-fixes).
• md/bitmap: always wake up md_thread in timeout_store (git-fixes).
• md/bitmap: factor out a helper to set timeout (git-fixes).
• md/raid10: Do not add spare disk when recovery fails (git-fixes).
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter (git-fixes).
• md/raid10: clean up md_add_new_disk() (git-fixes).
• md/raid10: fix io loss while replacement replace rdev (git-fixes).
• md/raid10: fix leak of 'r10bio->remaining' for recovery (git-fixes).
• md/raid10: fix memleak for 'conf->bio_split' (git-fixes).
• md/raid10: fix memleak of md thread (git-fixes).
• md/raid10: fix null-ptr-deref in raid10_sync_request (git-fixes).
• md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request (git-fixes).
• md/raid10: fix overflow of md/safe_mode_delay (git-fixes).
• md/raid10: fix wrong setting of max_corr_read_errors (git-fixes).
• md/raid10: improve code of mrdev in raid10_sync_request (git-fixes).
• md/raid10: prevent soft lockup while flush writes (git-fixes).
• md/raid10: prioritize adding disk to 'removed' mirror (git-fixes).
• md: Flush workqueue md_rdev_misc_wq in md_alloc() (git-fixes).
• md: add new workqueue for delete rdev (git-fixes).
• md: avoid signed overflow in slot_store() (git-fixes).
• md: do not return existing mddevs from mddev_find_or_alloc (git-fixes).
• md: factor out a mddev_alloc_unit helper from mddev_find (git-fixes).
• md: fix data corruption for raid456 when reshape restart while grow up (git-fixes).
• md: fix deadlock causing by sysfs_notify (git-fixes).
• md: fix incorrect declaration about claim_rdev in md_import_device (git-fixes).
• md: flush md_rdev_misc_wq for HOT_ADD_DISK case (git-fixes).
• md: get sysfs entry after redundancy attr group create (git-fixes).
• md: refactor mddev_find_or_alloc (git-fixes).
• md: remove lock_bdev / unlock_bdev (git-fixes).
• mm, memcg: add mem_cgroup_disabled checks in vmpressure and swap-related functions (bsc#1190208 (MM functional and performance backports) bsc#1216759).
• net-memcg: Fix scope of sockmem pressure indicators (bsc#1216759).
• net: mana: Configure hwc timeout from hardware (bsc#1214037).
• net: mana: Fix MANA VF unload…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).
• CVE-2023-2006: Fixed a race condition in the RxRPC network protocol (bsc#1210447).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in drivers/net/usb/lan78xx.c (bsc#1217068).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in drivers/vhost/vringh.c in the host side of a virtio ring (bsc#1215710).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-25775: Fixed improper access control in the Intel Ethernet Controller RDMA driver (bsc#1216959).
• CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo() (bsc#1216693).

The following non-security bugs were fixed:

• ACPI: FPDT: properly handle invalid FPDT subtables (git-fixes).
• ACPI: resource: Do IRQ override on TongFang GMxXGxx (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA (git-fixes).
• ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() (git-fixes).
• ALSA: hda/realtek - Add Dell ALC295 to pin fall back table (git-fixes).
• ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC (git-fixes).
• ALSA: hda/realtek: Add quirks for HP Laptops (git-fixes).
• ALSA: hda/realtek: Enable Mute LED on HP 255 G10 (git-fixes).
• ALSA: hda/realtek: Enable Mute LED on HP 255 G8 (git-fixes).
• ALSA: hda: Disable power-save on KONTRON SinglePC (bsc#1217140).
• ALSA: hda: Fix possible null-ptr-deref when assigning a stream (git-fixes).
• ALSA: hda: cs35l41: Fix unbalanced pm_runtime_get() (git-fixes).
• ALSA: hda: cs35l41: Undo runtime PM changes at driver exit time (git-fixes).
• ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection (git-fixes).
• ALSA: info: Fix potential deadlock at disconnection (git-fixes).
• ARM: 9321/1: memset: cast the constant byte to unsigned char (git-fixes).
• ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails (git-fixes).
• ASoC: ams-delta.c: use component after check (git-fixes).
• ASoC: codecs: wsa-macro: fix uninitialized stack variables with name prefix (git-fixes).
• ASoC: cs35l41: Undo runtime PM changes at driver exit time (git-fixes).
• ASoC: cs35l41: Verify PM runtime resume errors in IRQ handler (git-fixes).
• ASoC: fsl: Fix PM disable depth imbalance in fsl_easrc_probe (git-fixes).
• ASoC: fsl: mpc5200_dma.c: Fix warning of Function parameter or member not described (git-fixes).
• ASoC: hdmi-codec: register hpd callback on component probe (git-fixes).
• ASoC: rt5650: fix the wrong result of key button (git-fixes).
• ASoC: simple-card: fixup asoc_simple_probe() error handling (git-fixes).
• ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings (git-fixes).
• Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE (git-fixes).
• Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables (git-fixes).
• Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559 (git-fixes).
• Bluetooth: btusb: Add date->evt_skb is NULL check (git-fixes).
• Drivers: hv: vmbus: Remove unused extern declaration vmbus_ontimer() (git-fixes).
• HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W (git-fixes).
• HID: hyperv: Replace one-element array with…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).

The following non-security bugs were fixed:

• ALSA: hda: Disable power-save on KONTRON SinglePC (bsc#1217140).
• Call flush_delayed_fput() from nfsd main-loop (bsc#1217408).
• net: mana: Configure hwc timeout from hardware (bsc#1214037).
• net: mana: Fix MANA VF unload when hardware is unresponsive (bsc#1214764).
• powerpc: Do not clobber f0/vs0 during fp|altivec register save (bsc#1217780).

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).

The following non-security bugs were fixed:

• cpu/SMT: Allow enabling partial SMT states via sysfs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• cpu/SMT: Create topology_smt_thread_allowed() (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• cpu/SMT: Move SMT prototypes into cpu_smt.h (bsc#1214408).
• cpu/SMT: Move smt/control simple exit cases earlier (bsc#1214408).
• cpu/SMT: Remove topology_smt_supported() (bsc#1214408).
• cpu/SMT: Store the current/max number of threads (bsc#1214408).
• cpu/hotplug: Create SMT sysfs interface for all arches (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• dm-raid: remove useless checking in raid_message() (git-fixes).
• l2tp: fix refcount leakage on PPPoL2TP sockets (git-fixes).
• l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow (git-fixes).
• md/bitmap: always wake up md_thread in timeout_store (git-fixes).
• md/bitmap: factor out a helper to set timeout (git-fixes).
• md/raid10: Do not add spare disk when recovery fails (git-fixes).
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter (git-fixes).
• md/raid10: clean up md_add_new_disk() (git-fixes).
• md/raid10: fix io loss while replacement replace rdev (git-fixes).
• md/raid10: fix leak of 'r10bio->remaining' for recovery (git-fixes).
• md/raid10: fix memleak for 'conf->bio_split' (git-fixes).
• md/raid10: fix memleak of md thread (git-fixes).
• md/raid10: fix null-ptr-deref in raid10_sync_request (git-fixes).
• md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request (git-fixes).
• md/raid10: fix overflow of md/safe_mode_delay (git-fixes).
• md/raid10: fix wrong setting of max_corr_read_errors (git-fixes).
• md/raid10: improve code of mrdev in raid10_sync_request (git-fixes).
• md/raid10: prevent soft lockup while flush writes (git-fixes).
• md/raid10: prioritize adding disk to 'removed' mirror (git-fixes).
• md: Flush workqueue md_rdev_misc_wq in md_alloc() (git-fixes).
• md: add new workqueue for delete rdev (git-fixes).
• md: avoid signed overflow in slot_store() (git-fixes).
• md: do not return existing mddevs from mddev_find_or_alloc (git-fixes).
• md: factor out a mddev_alloc_unit helper from mddev_find (git-fixes).
• md: fix data corruption for raid456 when reshape restart while grow up (git-fixes).
• md: fix deadlock causing by sysfs_notify (git-fixes).
• md: fix incorrect declaration about claim_rdev in md_import_device (git-fixes).
• md: flush md_rdev_misc_wq for HOT_ADD_DISK case (git-fixes).
• md: get sysfs entry after redundancy attr group create (git-fixes).
• md: refactor mddev_find_or_alloc (git-fixes).
• md: remove lock_bdev / unlock_bdev (git-fixes).
• mm, memcg: add mem_cgroup_disabled checks in vmpressure and swap-related functions (bsc#1190208 (MM functional and performance backports) bsc#1216759).
• net-memcg: Fix scope of sockmem pressure indicators (bsc#1216759).
• net: mana: Configure hwc timeout from hardware (bsc#1214037).
• net: mana: Fix MANA VF unload when hardware is unresponsive (bsc#1214764).
• powerpc/pseries: Honour current SMT state when DLPAR onlining CPUs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• powerpc/pseries: Initialise CPU…

This update for the Linux Kernel 5.14.21-150500_13_5 fixes several issues.

The following security issues were fixed:

• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216644).
• CVE-2024-0775: Fixed use-after-free in __ext4_remount in fs/ext4/super.c that could allow a local user to cause an information leak problem while freeing the old quota file names before a potential failure (bsc#1219079).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220828).
• CVE-2024-1086: Fixed a use-after-free vulnerability inside the nf_tables component that could have been exploited to achieve local privilege escalation (bsc#1219435).

This update for the Linux Kernel 5.14.21-150500_13_24 fixes several issues.

The following security issues were fixed:

• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216644).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220828).
• CVE-2024-1086: Fixed a use-after-free vulnerability inside the nf_tables component that could have been exploited to achieve local privilege escalation (bsc#1219435).

This update for the Linux Kernel 5.14.21-150500_55_7 fixes several issues.

The following security issues were fixed:

• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216644).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220828).
• CVE-2024-1086: Fixed a use-after-free vulnerability inside the nf_tables component that could have been exploited to achieve local privilege escalation (bsc#1219435).