CVE-2023-6610

An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_main.c.(CVE-2023-35827)

An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.(CVE-2023-6606)

An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.(CVE-2023-6610)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_main.c.(CVE-2023-35827)

An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.(CVE-2023-6606)

An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.(CVE-2023-6610)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.(CVE-2023-6606)

An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.(CVE-2023-6610)

The Linux Kernel, the operating system core itself.

Security Fix(es):

openeuler-linux-kernel-5.10.149-ext4_write_inline_data-kernel_bug-365020(CVE-2021-33631)

An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_main.c.(CVE-2023-35827)

An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.(CVE-2023-6606)

An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.(CVE-2023-6610)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.

We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a.

(CVE-2023-6817)

A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation.

A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().

We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.

(CVE-2023-6931)

A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation.

A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread.

We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.

(CVE-2023-6932)

The Linux Kernel, the operating system core itself.

Security Fix(es):

openeuler-linux-kernel-5.10.149-ext4_write_inline_data-kernel_bug-365020(CVE-2021-33631)

An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_main.c.(CVE-2023-35827)

An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.(CVE-2023-6606)

An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.(CVE-2023-6610)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.

We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a.

(CVE-2023-6817)

A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation.

A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().

We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.

(CVE-2023-6931)

A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation.

A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread.

We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.

(CVE-2023-6932)

The Linux Kernel, the operating system core itself.

Security Fix(es):

openeuler-linux-kernel-5.10.149-ext4_write_inline_data-kernel_bug-365020(CVE-2021-33631)

An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_main.c.(CVE-2023-35827)

An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.(CVE-2023-6606)

An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.(CVE-2023-6610)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.

We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a.

(CVE-2023-6817)

A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation.

A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().

We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.

(CVE-2023-6931)

A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation.

A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread.

We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.

(CVE-2023-6932)

The Linux Kernel, the operating system core itself.

Security Fix(es):

openeuler-linux-kernel-5.10.149-ext4_write_inline_data-kernel_bug-365020(CVE-2021-33631)

An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_main.c.(CVE-2023-35827)

A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This could allow a local unprivileged user to escalate their privileges on the system.(CVE-2023-6546)

An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.(CVE-2023-6606)

An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.(CVE-2023-6610)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.

We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a.

(CVE-2023-6817)

A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation.

A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().

We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.

(CVE-2023-6931)

An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)
• kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)
• kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)
• kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)
• kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination (CVE-2024-0646)
• kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)
• kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)
• kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073)
• kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() (CVE-2023-1838)
• kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)
• kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)
• kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its child's sibling_list (CVE-2023-5717)
• kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356)
• kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535)
• kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536)
• kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)
• kernel: OOB Access in smb2_dump_detail (CVE-2023-6610)
• kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)
• kernel: SEV-ES local priv escalation (CVE-2023-46813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-url: https://ubuntu.com/security/CVE-2023-7192
  • netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
• CVE-url: https://ubuntu.com/security/CVE-2023-6610
  • smb: client: fix potential OOB in smb2_dump_detail()
• CVE-url: https://ubuntu.com/security/CVE-2023-6606
  • smb: client: fix OOB in smbCalcSize()
• CVE-url: https://ubuntu.com/security/CVE-2023-6546
  • tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
• CVE-url: https://ubuntu.com/security/CVE-2023-6932
  • ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
• CVE-url: https://ubuntu.com/security/CVE-2023-6931
  • perf: Fix perf_event_validate_size()
  • perf: Fix perf_event_validate_size() lockdep splat

• CVE-url: https://ubuntu.com/security/CVE-2023-7192
  • netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
• CVE-url: https://ubuntu.com/security/CVE-2023-6610
  • smb: client: fix potential OOB in smb2_dump_detail()
• CVE-url: https://ubuntu.com/security/CVE-2023-6606
  • smb: client: fix OOB in smbCalcSize()
• CVE-url: https://ubuntu.com/security/CVE-2023-6546
  • tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
• CVE-url: https://ubuntu.com/security/CVE-2023-6932
  • ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
• CVE-url: https://ubuntu.com/security/CVE-2023-6931
  • perf: Fix perf_event_validate_size()
  • perf: Fix perf_event_validate_size() lockdep splat

• CVE-url: https://ubuntu.com/security/CVE-2023-7192
  • netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
• CVE-url: https://ubuntu.com/security/CVE-2023-6610
  • smb: client: fix potential OOB in smb2_dump_detail()
• CVE-url: https://ubuntu.com/security/CVE-2023-6606
  • smb: client: fix OOB in smbCalcSize()
• CVE-url: https://ubuntu.com/security/CVE-2023-6546
  • tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
• CVE-url: https://ubuntu.com/security/CVE-2023-6932
  • ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
• CVE-url: https://ubuntu.com/security/CVE-2023-6931
  • perf: Fix perf_event_validate_size()
  • perf: Fix perf_event_validate_size() lockdep splat
• CVE-2023-4244 // CVE-url: https://ubuntu.com/security/CVE-2023-4244
  • netfilter: nf_tables: don't skip expired elements during walk
  • netfilter: nf_tables: GC transaction API to avoid race with control plane
  • netfilter: nf_tables: adapt set backend to use GC transaction API
  • netfilter: nf_tables: remove busy mark and gc batch API
  • netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path
  • netfilter: nf_tables: GC transaction race with netns dismantle
  • netfilter: nf_tables: GC transaction race with abort path
  • netfilter: nft_dynset: disallow object maps
• CVE-url: https://ubuntu.com/security/CVE-2023-4244
  • netfilter: nf_tables: pass ctx to nf_tables_expr_destroy()
  • netfilter: nf_tables: use net_generic infra for transaction data
  • netfilter: nftables: add nft_pernet() helper function
  • netfilter: nftables: rename set element data activation/deactivation functions
  • netfilter: nf_tables: fix chain dependency validation
  • netfilter: nf_tables: place all set backends in one single module
  • netfilter: nf_tables: make sets built-in
• Miscellaneous Ubuntu changes
  • [Config] updateconfigs for CONFIG_NFT_SET_RBTREE CONFIG_NFT_SET_HASH CONFIG_NFT_SET_BITMAP

• CVE-url: https://ubuntu.com/security/CVE-2023-7192
  • netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
• CVE-url: https://ubuntu.com/security/CVE-2023-6610
  • smb: client: fix potential OOB in smb2_dump_detail()
• CVE-url: https://ubuntu.com/security/CVE-2023-6606
  • smb: client: fix OOB in smbCalcSize()
• CVE-url: https://ubuntu.com/security/CVE-2023-6546
  • tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
• CVE-url: https://ubuntu.com/security/CVE-2023-6932
  • ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
• CVE-url: https://ubuntu.com/security/CVE-2023-6931
  • perf: Fix perf_event_validate_size()
  • perf: Fix perf_event_validate_size() lockdep splat
• CVE-2023-4244 // CVE-url: https://ubuntu.com/security/CVE-2023-4244
  • netfilter: nf_tables: don't skip expired elements during walk
  • netfilter: nf_tables: GC transaction API to avoid race with control plane
  • netfilter: nf_tables: adapt set backend to use GC transaction API
  • netfilter: nf_tables: remove busy mark and gc batch API
  • netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path
  • netfilter: nf_tables: GC transaction race with netns dismantle
  • netfilter: nf_tables: GC transaction race with abort path
  • netfilter: nft_dynset: disallow object maps
• CVE-url: https://ubuntu.com/security/CVE-2023-4244
  • netfilter: nf_tables: pass ctx to nf_tables_expr_destroy()
  • netfilter: nf_tables: use net_generic infra for transaction data
  • netfilter: nftables: add nft_pernet() helper function
  • netfilter: nftables: rename set element data activation/deactivation functions
  • netfilter: nf_tables: fix chain dependency validation
  • netfilter: nf_tables: place all set backends in one single module
  • netfilter: nf_tables: make sets built-in
• Miscellaneous Ubuntu changes
  • [Config] updateconfigs for CONFIG_NFT_SET_RBTREE CONFIG_NFT_SET_HASH CONFIG_NFT_SET_BITMAP

• net_sched: cls_route: remove from list when handle is 0 {CVE-2022-2588}
• netfilter: nf_tables: do not allow RULE_ID to refer to another chain {CVE-2022-2586}
• netfilter: nf_tables: do not allow SET_ID to refer to another table {CVE-2022-2586}
• netfilter: nf_tables: prevent OOB access in nft_byteorder_eval {CVE-2023-35001}
• smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}

• net_sched: cls_route: remove from list when handle is 0 {CVE-2022-2588}
• netfilter: nf_tables: do not allow RULE_ID to refer to another chain {CVE-2022-2586}
• netfilter: nf_tables: do not allow SET_ID to refer to another table {CVE-2022-2586}
• netfilter: nf_tables: prevent OOB access in nft_byteorder_eval {CVE-2023-35001}
• smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}

• bpf: Fix re-attachment branch in bpf_tracing_prog_attach {CVE-2024-26591}
• ext4: improve error recovery code paths in __ext4_remount() {CVE-2024-0775}
• smb: client: fix OOB in receive_encrypted_standard() {CVE-2024-0565}
• mtd: Fix gluebi NULL pointer dereference caused by ftl notifier {CVE-2023-52449}
• net: prevent mss overflow in skb_segment() {CVE-2023-52435}
• smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• atm: Fix Use-After-Free in do_vcc_ioctl {CVE-2023-51780}
• ida: Fix crash in ida_free when the bitmap is empty {CVE-2023-6915}
• nvmet: nul-terminate the NQNs passed in the connect command {CVE-2023-6121}
• netfilter: nf_tables: Reject tables of unsupported family {CVE-2023-6040}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• NFSD: fix use-after-free in nfsd4_ssc_setup_dul() {CVE-2023-1652}
• x86/bugs: Flush IBP in ib_prctl_set() {CVE-2023-0045}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• x86: Clear .brk area at early boot {CVE-2022-36123}
• misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one {CVE-2023-39197}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• ipv6: rpl: Fix Route of Death. {CVE-2023-2156}
• ipv6: Fix out-of-bounds access in ipv6_find_tlv() {CVE-2023-2156}
• net: rpl: fix rpl header size calculation {CVE-2023-2156}
• memstick: r592: Fix UAF bug in r592_remove due to race condition {CVE-2023-3141}
• ovl: fix use after free in struct ovl_aio_req {CVE-2023-1252}
• drm/amdgpu: Fix potential fence use-after-free v2 {CVE-2023-51042}
• netfilter: nf_tables: reject QUEUE/DROP verdict parameters {CVE-2024-1086}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}
• drm/atomic: Fix potential use-after-free in nonblocking commits {CVE-2023-51043}
• nvmet-tcp: Fix the H2C expected PDU len calculation {CVE-2023-6356}
• nvmet-tcp: remove boilerplate code {CVE-2023-6356}
• nvmet-tcp: fix a crash in nvmet_req_complete() {CVE-2023-6356}
• nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length {CVE-2023-6356}
• net: tls, update curr on splice as well {CVE-2024-0646}
• smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
• smb: client: fix potential OOB in cifs_dump_detail() {CVE-2023-6610}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• RDMA/core: Update CMA destination address on rdma_resolve_addr {CVE-2023-2176}
• RDMA/core: Refactor rdma_bind_addr {CVE-2023-2176}
• nfp: fix use-after-free in area_cache_get() {CVE-2022-3545}
• netfilter: nf_tables: skip bound chain on rule flush {CVE-2023-3777}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• drivers: net: slip: fix NPD bug in sl_tx_timeout() {CVE-2022-41858}
• net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve {CVE-2023-4623}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• nvmet-tcp: Fix a possible UAF in queue intialization setup {CVE-2023-5178}
• net: tun: fix bugs for oversize packet when napi frags enabled {CVE-2023-3812}
• netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c {CVE-2023-42753}
• bpf: Fix incorrect verifier pruning due to missing register precision taints {CVE-2023-2163}
• net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4206}…

• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• wifi: mac80211: fix MBSSID parsing use-after-free {CVE-2022-42719}
• mac80211: always allocate struct ieee802_11_elems {CVE-2022-42719}
• netfilter: nf_tables: initialize registers in nft_do_chain() {CVE-2022-1016}
• xprtrdma: fix incorrect header size calculations {CVE-2022-0812}
• net: usb: fix memory leak in smsc75xx_bind {CVE-2021-47171}
• i2c: i801: Don't generate an interrupt on bus reset {CVE-2021-47153}
• pid: take a reference when initializing cad_pid {CVE-2021-47118}
• Input: appletouch - initialize work before device registration {CVE-2021-46932}
• HID: usbhid: fix info leak in hid_submit_ctrl {CVE-2021-46906}
• quota: check block number when reading the block in quota file {CVE-2021-45868}
• mwifiex: Fix skb_over_panic in mwifiex_usb_recv() {CVE-2021-43976}
• atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait {CVE-2021-43975}
• isdn: cpai: check ctr->cnr to avoid array index out of bound {CVE-2021-43389}
• usb: hso: fix error handling code of hso_create_net_device {CVE-2021-37159}
• can: bcm: fix infoleak in struct bcm_msg_head {CVE-2021-34693}
• dm ioctl: fix out of bounds array access when no devices {CVE-2021-31916}
• KVM: x86: hyper-v: Fix Hyper-V context null-ptr-deref {CVE-2021-30178}
• perf/x86/intel: Fix a crash caused by zero PEBS status {CVE-2021-28971}
• btrfs: fix race when cloning extent buffer during rewind of an old root {CVE-2021-28964}
• ovl: fix missing negative dentry check in ovl_rename() {CVE-2021-20321}
• drm/ttm/nouveau: don't call tt destroy callback on alloc failure. {CVE-2021-20292}
• bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() {CVE-2021-4159}
• btrfs: unlock newly allocated extent buffer after error {CVE-2021-4149}
• tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. {CVE-2021-3679}
• net: mac802154: Fix general protection fault {CVE-2021-3659}
• nfsd4: readdirplus shouldn't return parent of export {CVE-2021-3178}
• Bluetooth: SMP: Fail if remote and local public keys are identical {CVE-2021-0129}
• drm/nouveau: clean up all clients on device removal {CVE-2020-27820}
• drm/nouveau: Add a dedicated mutex for the clients list {CVE-2020-27820}
• drm/nouveau: use drm_dev_unplug() during device removal {CVE-2020-27820}
• Bluetooth: SMP: Fail if remote and local public keys are identical {CVE-2020-26555}
• vsock: Fix memory leak in vsock_connect() {CVE-2022-3629}
• RDMA/core: Don't infoleak GRH fields {CVE-2021-3923}
• xen/netfront: force data bouncing when backend is untrusted {CVE-2022-33741}
• net: Rename and export copy_skb_header
• floppy: use a statically allocated error counter {CVE-2022-1652}
• fuse: fix pipe buffer lifetime for direct_io {CVE-2022-1011}
• aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts {CVE-2024-26898}
• smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
• media: pvrusb2: fix use after free on context disconnection {CVE-2023-52445}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• xfs: verify buffer contents when we skip log replay {CVE-2023-2124}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-1989}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• net/sched: cls_tcindex: downgrade to imperfect hash {CVE-2023-1829}
• xen/netfront: fix leaking data in shared pages {CVE-2022-33740}
• can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path {CVE-2022-28390}
• xen/blkfront: fix leaking data in shared pages {CVE-2022-26365}
• mISDN: fix use-after-free bugs in l1oip timer…

Upstream version 6.6.14 with many bugfixes and at least the following security fixes: An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. (CVE-2023-6610) An unprivileged guest can cause Denial of Service (DoS) of the host by sending network packets to the backend, causing the backend to crash. Data corruption or privilege escalation have not been ruled out. https://xenbits.xen.org/xsa/advisory-448.html (CVE-2023-46838)

Upstream version 6.6.14 with many bugfixes and at least the following security fixes: An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. (CVE-2023-6610) An unprivileged guest can cause Denial of Service (DoS) of the host by sending network packets to the backend, causing the backend to crash. Data corruption or privilege escalation have not been ruled out. https://xenbits.xen.org/xsa/advisory-448.html (CVE-2023-46838)

These are all security issues fixed in the kernel-devel-6.6.11-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.6.17-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2023-6610 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

• kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation (CVE-2024-0193)

• kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination (CVE-2024-0646)

• kernel: Use-after-free in nft_verdict_dump due to a race between set GC and transaction (CVE-2023-4244)

• kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its child's sibling_list (CVE-2023-5717)

• kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356)

• kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535)

• kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536)

• kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)

• kernel: OOB Access in smb2_dump_detail (CVE-2023-6610)

• kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (CVE-2023-51042)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-26555: Fixed an issue during BR/EDR PIN code pairing in the Bluetooth subsystem that would allow replay attacks (bsc#1179610 bsc#1215237).
• CVE-2023-6121: Fixed an information leak via dmesg when receiving a crafted packet in the NVMe-oF/TCP subsystem (bsc#1217250).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsystem when adding a new event (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free issue when receiving an IGMP query packet due to reference count mismanagement (bsc#1218253).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).

The following non-security bugs were fixed:

• Reviewed and added more information to README.SUSE (jsc#PED-5021).
• Enabled multibuild for kernel packages (JSC-SLE#5501, boo#1211226, bsc#1218184).
• clocksource: Avoid accidental unstable marking of clocksources (bsc#1218105).
• clocksource: Suspend the watchdog temporarily when high read latency detected (bsc#1218105).
• efi/mokvar: Reserve the table only if it is in boot services data (bsc#1215375).

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).

The following non-security bugs were fixed:

• Fix termination state for idr_for_each_entry_ul() (bsc#1109837).
• Input: powermate - fix use-after-free in powermate_config_complete (git-fixes).
• KVM: s390/mm: Properly reset no-dat (git-fixes bsc#1218057).
• KVM: s390: vsie: fix wrong VIR 37 when MSO is used (git-fixes bsc#1217936).
• Limit kernel-source build to architectures for which the kernel binary is built (bsc#1108281).
• PCI: Disable ATS for specific Intel IPU E2000 devices (bsc#1218622).
• Resolve build warnings from previous series due to missing commit for Ice Lake freerunning counters perf/x86/intel/uncore: Add box_offsets for free-running counters (jsc#PED-5023 bsc#1211439).
• Revert 'Limit kernel-source-azure build to architectures for which we build binaries (bsc#1108281).'
• bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent (git-fixes).
• bcache: Remove unnecessary NULL point check in node allocations (git-fixes).
• bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (git-fixes).
• bcache: check return value from btree_node_alloc_replacement() (git-fixes).
• bcache: prevent potential division by zero error (git-fixes).
• bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce() (git-fixes).
• bcache: revert replacing IS_ERR_OR_NULL with IS_ERR (git-fixes).
• dm cache policy smq: ensure IO does not prevent cleaner policy progress (git-fixes).
• dm cache: add cond_resched() to various workqueue loops (git-fixes).
• dm crypt: add cond_resched() to dmcrypt_write() (git-fixes).
• dm flakey: do not corrupt the zero page (git-fixes).
• dm flakey: fix a crash with invalid table line (git-fixes).
• dm flakey: fix logic when corrupting a bio (git-fixes).
• dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (git-fixes).
• dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths (git-fixes).
• dm stats: check for and propagate alloc_percpu failure (git-fixes).
• dm thin: add cond_resched() to various workqueue loops (git-fixes).
• dm verity: do not perform FEC for failed readahead IO (git-fixes).
• dm verity: fix error handling for check_at_most_once on FEC (git-fixes).
• dm verity: skip redundant verity_handle_err() on I/O errors (git-fixes).
• dm-integrity: do not modify bio's immutable bio_vec in integrity_metadata() (git-fixes).
• dm-verity: align struct dm_verity_fec_io properly (git-fixes).
• dm: remove flush_scheduled_work() during local_exit() (git-fixes).
• doc/README.SUSE: Add how to update the config for module signing (jsc#PED-5021)
• doc/README.SUSE: Remove how to build…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1218335).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).
• CVE-2023-6622: Fixed a null pointer dereference vulnerability in nft_dynset_init() that could allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service (bsc#1217938).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).

The following non-security bugs were fixed:

• Documentation: KVM: add separate directories for architecture-specific documentation (jsc#PED-7167).
• Documentation: KVM: update amd-memory-encryption.rst references (jsc#PED-7167).
• Documentation: KVM: update msr.rst reference (jsc#PED-7167).
• Documentation: KVM: update s390-diag.rst reference (jsc#PED-7167).
• Documentation: KVM: update s390-pv.rst reference (jsc#PED-7167).
• Documentation: drop more IDE boot options and ide-cd.rst (git-fixes).
• Documentation: qat: Use code block for qat sysfs example (git-fixes).
• Drop Documentation/ide/ (git-fixes).
• Fix crash on screen resize (bsc#1218229)
• Fix drm gem object underflow (bsc#1218092)
• KVM: arm64: Prevent kmemleak from accessing pKVM memory (jsc#PED-7167).
• KVM: s390/mm: Properly reset no-dat (git-fixes bsc#1218056).
• KVM: s390: vsie: fix wrong VIR 37 when MSO is used (git-fixes bsc#1217933).
• Revert 'PCI/ASPM: Remove pcie_aspm_pm_state_change()' (git-fixes).
• Revert 'PCI: acpiphp: Reassign resources on bridge if necessary' (git-fixes).
• Revert 'md: unlock mddev before reap sync_thread in action_store' (git-fixes).
• Revert 'swiotlb: panic if nslabs is too small' (git-fixes).
• Revert 'xhci: Loosen RPM as default policy to cover for AMD xHC 1.1' (git-fixes).
• USB: serial: ftdi_sio: update Actisense PIDs constant names (git-fixes).
• USB: serial: option: add Foxconn T99W265 with new baseline (git-fixes).
• USB: serial: option: add Quectel EG912Y module support (git-fixes).
• USB: serial: option: add Quectel RM500Q R13 firmware support (git-fixes).
• Update: drm/vmwgfx: Keep a gem reference to user bos in surfaces
• acpi: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 (git-fixes).
• acpi: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects (git-fixes).
• acpica: Add AML_NO_OPERAND_RESOLVE flag to Timer (git-fixes).
• afs: Fix afs_server_list to be cleaned up with RCU (git-fixes).
• afs: Fix dynamic root lookup DNS check (git-fixes).
• afs: Fix file locking on R/O volumes to operate in local mode (git-fixes).
• afs: Fix overwriting of result of DNS query (git-fixes).
• afs: Fix refcount underflow from error handling race…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095).
• CVE-2023-6121: Fixed an information leak via dmesg when receiving a crafted packet in the NVMe-oF/TCP subsystem (bsc#1217250).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsystem when adding a new event (bsc#1214158 bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free issue when receiving an IGMP query packet due to reference count mismanagement (bsc#1218253).
• CVE-2020-26555: Fixed an issue during BR/EDR PIN code pairing in the Bluetooth subsystem that would allow replay attacks (bsc#1179610 bsc#1215237).
• CVE-2023-51779: Fixed a use-after-free issue due to a race condition during Bluetooth message reception (bsc#1218559).

The following non-security bugs were fixed:

• Enabled the LLC counters for “perf” (perf stat) on the Ice-Lake and Rocket-Lake CPUs (jsc#PED-5023 bsc#1211439).
• Reviewed and added more information to README.SUSE (jsc#PED-5021).
• Enabled multibuild for kernel packages (JSC-SLE#5501, boo#1211226, bsc#1218184).
• Fix termination state for idr_for_each_entry_ul() (bsc#1109837).
• KVM: s390/mm: Properly reset no-dat (bsc#1218057).
• KVM: s390: vsie: fix wrong VIR 37 when MSO is used (bsc#1217936).
• PCI: Disable ATS for specific Intel IPU E2000 devices (bsc#1218622).
• gve: Add XDP DROP and TX support for GQI-QPL format (bsc#1214479).
• gve: Add XDP REDIRECT support for GQI-QPL format (bsc#1214479).
• gve: Changes to add new TX queues (bsc#1214479).
• gve: Control path for DQO-QPL (bsc#1214479).
• gve: Do not fully free QPL pages on prefill errors (bsc#1214479).
• gve: Fix gve interrupt names (bsc#1214479).
• gve: Fixes for napi_poll when budget is 0 (bsc#1214479).
• gve: RX path for DQO-QPL (bsc#1214479).
• gve: Set default duplex configuration to full (bsc#1214479).
• gve: Tx path for DQO-QPL (bsc#1214479).
• gve: Unify duplicate GQ min pkt desc size constants (bsc#1214479).
• gve: XDP support GQI-QPL: helper function changes (bsc#1214479).
• gve: fix frag_list chaining (bsc#1214479).
• gve: trivial spell fix Recive to Receive (bsc#1214479).
• gve: unify driver name usage (bsc#1214479).
• net/tg3: fix race condition in tg3_reset_task() (bsc#1217801).
• net/tg3: resolve deadlock in tg3_reset_task() during EEH (bsc#1217801).
• s390/vx: fix save/restore of fpu kernel context (bsc#1218362).
• tracing: Fix a possible race when disabling buffered events (bsc#1217036).
• tracing: Fix a warning when allocating buffered events fails (bsc#1217036).
• tracing: Fix incomplete locking when disabling buffered events (bsc#1217036).
• tracing: Fix warning in trace_buffered_event_disable() (bsc#1217036).

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-26555: Fixed an issue during BR/EDR PIN code pairing in the Bluetooth subsystem that would allow replay attacks (bsc#1179610 bsc#1215237).
• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsystem when adding a new event (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free issue when receiving an IGMP query packet due to reference count mismanagement (bsc#1218253).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).

The following non-security bugs were fixed:

• Enabled the LLC counters for “perf” (perf stat) on the Ice-Lake and Rocket-Lake CPUs (jsc#PED-5023 bsc#1211439).
• Reviewed and added more information to README.SUSE (jsc#PED-5021).
• Enabled multibuild for kernel packages (JSC-SLE#5501, boo#1211226, bsc#1218184).
• Fix termination state for idr_for_each_entry_ul() (bsc#1109837).
• KVM: s390/mm: Properly reset no-dat (bsc#1218057).
• KVM: s390: vsie: fix wrong VIR 37 when MSO is used (bsc#1217936).
• PCI: Disable ATS for specific Intel IPU E2000 devices (bsc#1218622).
• Previous perf cve-4.12->SLE12-SP5 manual merge was incorrect. Fix.
• gve: Add XDP DROP and TX support for GQI-QPL format (bsc#1214479).
• gve: Add XDP REDIRECT support for GQI-QPL format (bsc#1214479).
• gve: Changes to add new TX queues (bsc#1214479).
• gve: Control path for DQO-QPL (bsc#1214479).
• gve: Do not fully free QPL pages on prefill errors (bsc#1214479).
• gve: Fix gve interrupt names (bsc#1214479).
• gve: Fixes for napi_poll when budget is 0 (bsc#1214479).
• gve: RX path for DQO-QPL (bsc#1214479).
• gve: Set default duplex configuration to full (bsc#1214479).
• gve: Tx path for DQO-QPL (bsc#1214479).
• gve: Unify duplicate GQ min pkt desc size constants (bsc#1214479).
• gve: XDP support GQI-QPL: helper function changes (bsc#1214479).
• gve: fix frag_list chaining (bsc#1214479).
• gve: trivial spell fix Recive to Receive (bsc#1214479).
• gve: unify driver name usage (bsc#1214479).
• net/tg3: fix race condition in tg3_reset_task() (bsc#1217801).
• net/tg3: resolve deadlock in tg3_reset_task() during EEH (bsc#1217801).
• s390/vx: fix save/restore of fpu kernel context (bsc#1218362).
• tracing: Fix a possible race when disabling buffered events (bsc#1217036).
• tracing: Fix a warning when allocating buffered events fails (bsc#1217036).
• tracing: Fix incomplete locking when disabling buffered events (bsc#1217036).
• tracing: Fix warning in trace_buffered_event_disable() (bsc#1217036).

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).
• CVE-2023-6606: Fixed an out-of-bounds read vulnerability in smbCalcSize in fs/smb/client/netmisc.c that could allow a local attacker to crash the system or leak internal kernel information (bsc#1217947).
• CVE-2023-6610: Fixed an out-of-bounds read vulnerability in smb2_dump_detail in fs/smb/client/smb2ops.c that could allow a local attacker to crash the system or leak internal kernel information (bsc#1217946).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).

The following non-security bugs were fixed:

• doc/README.SUSE: Add how to update the config for module signing (jsc#PED-5021)
• doc/README.SUSE: Remove how to build modules using kernel-source (jsc#PED-5021)
• doc/README.SUSE: Simplify the list of references (jsc#PED-5021)

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on (bsc#1218447).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2020-26555: Fixed an issue during BR/EDR PIN code pairing in the Bluetooth subsystem that would allow replay attacks (bsc#1179610 bsc#1215237).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1218335).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).
• CVE-2023-6622: Fixed a null pointer dereference vulnerability in nft_dynset_init() that could allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service (bsc#1217938).
• CVE-2023-6121: Fixed an information leak via dmesg when receiving a crafted packet in the NVMe-oF/TCP subsystem (bsc#1217250).

The following non-security bugs were fixed:

• Reviewed and added more information to README.SUSE (jsc#PED-5021).
• Build in the correct KOTD repository with multibuild (JSC-SLE#5501, boo#1211226, bsc#1218184) With multibuild setting repository flags is no longer supported for individual spec files - see https://github.com/openSUSE/open-build-service/issues/3574 Add ExclusiveArch conditional that depends on a macro set up by bs-upload-kernel instead. With that each package should build only in one repository - either standard or QA. Note: bs-upload-kernel does not interpret rpm conditionals, and only uses the first ExclusiveArch line to determine the architectures to enable.
• KVM: s390/mm: Properly reset no-dat (bsc#1218056).
• KVM: s390: vsie: fix wrong VIR 37 when MSO is used (bsc#1217933).
• KVM: x86: Mask LVTPC when handling a PMI (jsc#PED-7322).
• NFS: Fix O_DIRECT locking issues (bsc#1211162).
• NFS: Fix a few more clear_bit() instances that need release semantics (bsc#1211162).
• NFS: Fix a potential data corruption (bsc#1211162).
• NFS: Fix a use after free in nfs_direct_join_group() (bsc#1211162).
• NFS: Fix error handling for O_DIRECT write scheduling (bsc#1211162).
• NFS: More O_DIRECT accounting fixes for error paths (bsc#1211162).
• NFS: More fixes for nfs_direct_write_reschedule_io() (bsc#1211162).
• NFS: Use the correct commit info in nfs_join_page_group() (bsc#1211162).
• NLM: Defend against file_lock changes after vfs_test_lock() (bsc#1217692).
• Updated SPI patches for NVIDIA Grace enablement (bsc#1212584, jsc#PED-3459).
• block: fix revalidate performance regression (bsc#1216057).
• bpf: Adjust insufficient default bpf_jit_limit (bsc#1218234).
• ceph: fix incorrect revoked caps assert in ceph_fill_file_size() (bsc#1217980).
• ceph: fix type promotion bug on 32bit systems (bsc#1217982).
• clocksource: Add a Kconfig option for WATCHDOG_MAX_SKEW (bsc#1215885 bsc#1217217).
• clocksource: Enable TSC watchdog checking of HPET and PMTMR only when requested (bsc#1215885 bsc#1217217).
• clocksource: Handle negative skews in 'skew is too large' messages (bsc#1215885 bsc#1217217).
• clocksource: Improve 'skew is too large' messages (bsc#1215885 bsc#1217217).
• clocksource: Improve read-back-delay message (bsc#1215885 bsc#1217217).
• clocksource: Loosen clocksource…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1218335).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).
• CVE-2023-6622: Fixed a null pointer dereference vulnerability in nft_dynset_init() that could allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service (bsc#1217938).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).

The following non-security bugs were fixed:

• Documentation: KVM: add separate directories for architecture-specific documentation (jsc#PED-7167).
• Documentation: KVM: update amd-memory-encryption.rst references (jsc#PED-7167).
• Documentation: KVM: update msr.rst reference (jsc#PED-7167).
• Documentation: KVM: update s390-diag.rst reference (jsc#PED-7167).
• Documentation: KVM: update s390-pv.rst reference (jsc#PED-7167).
• Documentation: drop more IDE boot options and ide-cd.rst (git-fixes).
• Documentation: qat: Use code block for qat sysfs example (git-fixes).
• Drop Documentation/ide/ (git-fixes).
• Fix crash on screen resize (bsc#1218229)
• Fix drm gem object underflow (bsc#1218092)
• Revert 'Limit kernel-source-azure build to architectures for which we build binaries (bsc#1108281).'
• Revert 'PCI/ASPM: Remove pcie_aspm_pm_state_change()' (git-fixes).
• Revert 'PCI: acpiphp: Reassign resources on bridge if necessary' (git-fixes).
• Revert 'md: unlock mddev before reap sync_thread in action_store' (git-fixes).
• Revert 'swiotlb: panic if nslabs is too small' (git-fixes).
• Revert 'xhci: Loosen RPM as default policy to cover for AMD xHC 1.1' (git-fixes).
• Update: drm/vmwgfx: Keep a gem reference to user bos in surfaces
• acpi: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 (git-fixes).
• acpi: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects (git-fixes).
• acpica: Add AML_NO_OPERAND_RESOLVE flag to Timer (git-fixes).
• afs: Fix afs_server_list to be cleaned up with RCU (git-fixes).
• afs: Fix dynamic root lookup DNS check (git-fixes).
• afs: Fix file locking on R/O volumes to operate in local mode (git-fixes).
• afs: Fix overwriting of result of DNS query (git-fixes).
• afs: Fix refcount underflow from error handling race (git-fixes).
• afs: Fix the dynamic root's d_delete to always delete unused dentries (git-fixes).
• afs: Fix use-after-free due to get/remove race in volume tree (git-fixes).
• afs: Make error on cell lookup failure consistent with OpenAFS (git-fixes).
• afs: Return ENOENT if no cell DNS record can be found (git-fixes).
• alsa: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).

The following non-security bugs were fixed:

• clocksource: Avoid accidental unstable marking of clocksources (bsc#1218105).
• clocksource: Suspend the watchdog temporarily when high read latency detected (bsc#1218105).
• doc/README.SUSE: Add how to update the config for module signing (jsc#PED-5021)
• doc/README.SUSE: Remove how to build modules using kernel-source (jsc#PED-5021)
• doc/README.SUSE: Simplify the list of references (jsc#PED-5021).
• efi/mokvar: Reserve the table only if it is in boot services data (bsc#1215375).
• io_uring: fix 32-bit compatability with sendmsg/recvmsg (bsc#1217709).

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).

The following non-security bugs were fixed:

• doc/README.SUSE: Add how to update the config for module signing (jsc#PED-5021)
• doc/README.SUSE: Remove how to build modules using kernel-source (jsc#PED-5021)
• doc/README.SUSE: Simplify the list of references (jsc#PED-5021)
• io_uring: fix 32-bit compatability with sendmsg/recvmsg (bsc#1217709).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2020-26555: Fixed an issue during BR/EDR PIN code pairing in the Bluetooth subsystem that would allow replay attacks (bsc#1179610 bsc#1215237).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1218335).
• CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsystem when adding a new event (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free issue when receiving an IGMP query packet due to reference count mismanagement (bsc#1218253).
• CVE-2023-6622: Fixed a null pointer dereference vulnerability in nft_dynset_init() that could allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service (bsc#1217938).
• CVE-2023-6121: Fixed an information leak via dmesg when receiving a crafted packet in the NVMe-oF/TCP subsystem (bsc#1217250).

The following non-security bugs were fixed:

• Reviewed and added more information to README.SUSE (jsc#PED-5021).
• Enabled multibuild for kernel packages (JSC-SLE#5501, boo#1211226, bsc#1218184).
• Drop drm/bridge lt9611uxc patches that have been reverted on stable trees
• KVM: s390/mm: Properly reset no-dat (bsc#1218056).
• KVM: s390: vsie: fix wrong VIR 37 when MSO is used (bsc#1217933).
• KVM: x86: Mask LVTPC when handling a PMI (jsc#PED-7322).
• NFS: Fix O_DIRECT locking issues (bsc#1211162).
• NFS: Fix a few more clear_bit() instances that need release semantics (bsc#1211162).
• NFS: Fix a potential data corruption (bsc#1211162).
• NFS: Fix a use after free in nfs_direct_join_group() (bsc#1211162).
• NFS: Fix error handling for O_DIRECT write scheduling (bsc#1211162).
• NFS: More O_DIRECT accounting fixes for error paths (bsc#1211162).
• NFS: More fixes for nfs_direct_write_reschedule_io() (bsc#1211162).
• NFS: Use the correct commit info in nfs_join_page_group() (bsc#1211162).
• NLM: Defend against file_lock changes after vfs_test_lock() (bsc#1217692).
• Updated SPI patches for NVIDIA Grace enablement (bsc#1212584 jsc#PED-3459)
• block: fix revalidate performance regression (bsc#1216057).
• bpf: Adjust insufficient default bpf_jit_limit (bsc#1218234).
• ceph: fix incorrect revoked caps assert in ceph_fill_file_size() (bsc#1217980).
• ceph: fix type promotion bug on 32bit systems (bsc#1217982).
• clocksource: Add a Kconfig option for WATCHDOG_MAX_SKEW (bsc#1215885 bsc#1217217).
• clocksource: Enable TSC watchdog checking of HPET and PMTMR only when requested (bsc#1215885 bsc#1217217).
• clocksource: Handle negative skews in 'skew is too large' messages (bsc#1215885 bsc#1217217).
• clocksource: Improve 'skew is too large' messages (bsc#1215885 bsc#1217217).
• clocksource: Improve read-back-delay message (bsc#1215885 bsc#1217217).
• clocksource: Loosen clocksource watchdog constraints (bsc#1215885 bsc#1217217).
• clocksource: Print clocksource name when clocksource is tested unstable (bsc#1215885 bsc#1217217).
• clocksource: Verify HPET and PMTMR when TSC unverified (bsc#1215885 bsc#1217217).
• dm_blk_ioctl: implement path failover for SG_IO (bsc#1183045, bsc#1216776).
• fuse: dax: set fc->dax to NULL in fuse_dax_conn_free() (bsc#1218659).
• libceph: use kernel_connect() (bsc#1217981).
• mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors (bsc#1218515). -…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1218335).
• CVE-2023-6606: Fixed an out-of-bounds read vulnerability in smbCalcSize in fs/smb/client/netmisc.c that could allow a local attacker to crash the system or leak internal kernel information (bsc#1217947).
• CVE-2023-6610: Fixed an out-of-bounds read vulnerability in smb2_dump_detail in fs/smb/client/smb2ops.c that could allow a local attacker to crash the system or leak internal kernel information (bsc#1217946).
• CVE-2023-6622: Fixed a null pointer dereference vulnerability in nft_dynset_init() that could allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service (bsc#1217938).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).

The following non-security bugs were fixed:

• Documentation: KVM: add separate directories for architecture-specific documentation (jsc#PED-7167).
• Documentation: KVM: update amd-memory-encryption.rst references (jsc#PED-7167).
• Documentation: KVM: update msr.rst reference (jsc#PED-7167).
• Documentation: KVM: update s390-diag.rst reference (jsc#PED-7167).
• Documentation: KVM: update s390-pv.rst reference (jsc#PED-7167).
• Documentation: drop more IDE boot options and ide-cd.rst (git-fixes).
• Documentation: qat: Use code block for qat sysfs example (git-fixes).
• Drop Documentation/ide/ (git-fixes).
• Fix crash in vmw_context_cotables_unref when 3d support is enabled (bsc#1218738)
• Fix crash on screen resize (bsc#1218229)
• Fix drm gem object underflow (bsc#1218092)
• Revert 'PCI/ASPM: Remove pcie_aspm_pm_state_change()' (git-fixes).
• Revert 'PCI: acpiphp: Reassign resources on bridge if necessary' (git-fixes).
• Revert 'md: unlock mddev before reap sync_thread in action_store' (git-fixes).
• Revert 'swiotlb: panic if nslabs is too small' (git-fixes).
• Revert 'xhci: Loosen RPM as default policy to cover for AMD xHC 1.1' (git-fixes).
• Update: drm/vmwgfx: Keep a gem reference to user bos in surfaces
• acpi: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 (git-fixes).
• acpi: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects (git-fixes).
• acpica: Add AML_NO_OPERAND_RESOLVE flag to Timer (git-fixes).
• afs: Fix afs_server_list to be cleaned up with RCU (git-fixes).
• afs: Fix dynamic root lookup DNS check (git-fixes).
• afs: Fix file locking on R/O volumes to operate in local mode (git-fixes).
• afs: Fix overwriting of result of DNS query (git-fixes).
• afs: Fix refcount underflow from error handling race (git-fixes).
• afs: Fix the dynamic root's d_delete to always delete unused dentries (git-fixes).
• afs: Fix use-after-free due to get/remove race in volume tree (git-fixes).
• afs: Make error on cell lookup failure consistent with OpenAFS…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-1086: Fixed a use-after-free vulnerability inside the nf_tables component that could have been exploited to achieve local privilege escalation (bsc#1219434).
• CVE-2024-0340: Fixed information disclosure in vhost/vhost.c:vhost_new_msg() (bsc#1218689).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218730).
• CVE-2023-46838: Fixed an issue with Xen netback processing of zero-length transmit fragment (bsc#1218836).
• CVE-2021-33631: Fixed an integer overflow in ext4_write_inline_data_end() (bsc#1219412).
• CVE-2023-47233: Fixed a use-after-free in the device unplugging (disconnect the USB by hotplug) code inside the brcm80211 component (bsc#1216702).
• CVE-2023-51043: Fixed use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c (bsc#1219120).
• CVE-2024-0775: Fixed use-after-free in __ext4_remount in fs/ext4/super.c that could allow a local user to cause an information leak problem while freeing the old quota file names before a potential failure (bsc#1219053).
• CVE-2023-6040: Fixed an out-of-bounds access vulnerability while creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within nf_tables_newtable function (bsc#1218752).
• CVE-2023-51782: Fixed use-after-free in rose_ioctl in net/rose/af_rose.c because of a rose_accept race condition (bsc#1218757).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
• CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
• CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
• CVE-2023-51042: Fixed use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (bsc#1219128).

The following non-security bugs were fixed:

• 9p: missing chunk of 'fs/9p: Do not update file type when updating file attributes' (git-fixes).
• ACPICA: Avoid cache flush inside virtual machines (git-fixes).
• GFS2: Flush the GFS2 delete workqueue before stopping the kernel threads (git-fixes).
• KVM: s390: vsie: Fix STFLE interpretive execution identification (git-fixes bsc#1219022).
• UAPI: ndctl: Fix g++-unsupported initialisation in headers (git-fixes).
• USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (git-fixes).
• USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (git-fixes).
• USB: serial: option: add entry for Sierra EM9191 with new firmware (git-fixes).
• USB: serial: option: fix FM101R-GL defines (git-fixes).
• acpi/nfit: Require opt-in for read-only label configurations (git-fixes).
• acpi/nfit: improve bounds checking for 'func' (git-fixes).
• affs: fix basic permission bits to actually work (git-fixes).
• aio: fix mremap after fork null-deref (git-fixes).
• asix: Add check for usbnet_get_endpoints (git-fixes).
• bnxt_en: Log unknown link speed appropriately (git-fixes).
• build: Limit kernel-source build to architectures for which the kernel binary is built (bsc#1108281).
• ceph: fix incorrect revoked caps assert in ceph_fill_file_size() (bsc#1219445).
• chardev: fix error handling in cdev_device_add() (git-fixes).
• configfs: fix a deadlock in configfs_symlink() (git-fixes).
• configfs: fix a race in configfs_{,un}register_subsystem() (git-fixes).
• configfs: fix a use-after-free in __configfs_open_file (git-fixes).
• configfs: fix config_item refcnt leak in configfs_rmdir() (git-fixes).
• configfs: fix memleak in configfs_release_bin_file (git-fixes).
• configfs: new object reprsenting tree fragments (git-fixes).
• configfs: provide exclusion between IO and removals (git-fixes).
• configfs: stash…

Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2023-46838)

It was discovered that the Habana's AI Processors driver in the Linux kernel did not properly initialize certain data structures before passing them to user space. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2023-50431)

Murray McAllister discovered that the VMware Virtual GPU DRM driver in the Linux kernel did not properly handle memory objects when storing surfaces, leading to a use-after-free vulnerability. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5633)

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly validate certain SMB messages, leading to an out-of-bounds read vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-6610)

It was discovered that the VirtIO subsystem in the Linux kernel did not properly initialize memory in some situations. A local attacker could use this to possibly expose sensitive information (kernel memory). (CVE-2024-0340)

Lonial Con discovered that the netfilter subsystem in the Linux kernel did not properly handle element deactivation in certain cases, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1085)

Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Architecture specifics;
• Block layer;
• ACPI drivers;
• Android drivers;
• EDAC drivers;
• GPU drivers;
• InfiniBand drivers;
• Media drivers;
• Multifunction device drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• PHY drivers;
• PWM drivers;
• SCSI drivers;
• SPMI drivers;
• TTY drivers;
• Userspace I/O drivers;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• SMB network file system;
• BPF subsystem;
• Logical Link Layer;
• Netfilter;
• Unix domain sockets;
• AppArmor security module; (CVE-2024-26599, CVE-2023-52604, CVE-2023-52439, CVE-2024-26627, CVE-2024-26601, CVE-2024-26628, CVE-2023-52607, CVE-2023-52456, CVE-2023-52602, CVE-2023-52443, CVE-2023-52599, CVE-2023-52603, CVE-2024-26588, CVE-2024-26581, CVE-2023-52600, CVE-2024-26624, CVE-2023-52584, CVE-2024-26625, CVE-2023-52606, CVE-2023-52463, CVE-2023-52464, CVE-2023-52597, CVE-2023-52595, CVE-2023-52458, CVE-2023-52457, CVE-2023-52438, CVE-2023-52469, CVE-2023-52462, CVE-2024-26589, CVE-2024-26592, CVE-2024-26594, CVE-2023-52601, CVE-2023-52593, CVE-2023-52436, CVE-2023-52447, CVE-2023-52587, CVE-2023-52445,…

Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2023-46838)

It was discovered that the Habana's AI Processors driver in the Linux kernel did not properly initialize certain data structures before passing them to user space. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2023-50431)

It was discovered that the device mapper driver in the Linux kernel did not properly validate target size during certain memory allocations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-52429, CVE-2024-23851)

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly validate certain SMB messages, leading to an out-of-bounds read vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-6610)

Yang Chaoming discovered that the KSMBD implementation in the Linux kernel did not properly validate request buffer sizes, leading to an out-of-bounds read vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-22705)

Chenyuan Yang discovered that the btrfs file system in the Linux kernel did not properly handle read operations on newly created subvolumes in certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-23850)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Android drivers;
• Userspace I/O drivers;
• F2FS file system;
• SMB network file system;
• Networking core; (CVE-2023-52434, CVE-2023-52436, CVE-2023-52435, CVE-2023-52439, CVE-2023-52438)

Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2023-46838)

It was discovered that the Habana's AI Processors driver in the Linux kernel did not properly initialize certain data structures before passing them to user space. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2023-50431)

It was discovered that the device mapper driver in the Linux kernel did not properly validate target size during certain memory allocations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-52429, CVE-2024-23851)

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly validate certain SMB messages, leading to an out-of-bounds read vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-6610)

Yang Chaoming discovered that the KSMBD implementation in the Linux kernel did not properly validate request buffer sizes, leading to an out-of-bounds read vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-22705)

Chenyuan Yang discovered that the btrfs file system in the Linux kernel did not properly handle read operations on newly created subvolumes in certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-23850)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Android drivers;
• Userspace I/O drivers;
• F2FS file system;
• SMB network file system;
• Networking core; (CVE-2023-52434, CVE-2023-52436, CVE-2023-52435, CVE-2023-52439, CVE-2023-52438)

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly validate certain SMB messages, leading to an out-of-bounds read vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-6610)

Supraja Sridhara, Benedict Schlüter, Mark Kuhne, Andrin Bertschi, and Shweta Shinde discovered that the Confidential Computing framework in the Linux kernel for x86 platforms did not properly handle 32-bit emulation on TDX and SEV. An attacker with access to the VMM could use this to cause a denial of service (guest crash) or possibly execute arbitrary code. (CVE-2024-25744)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Android drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• Null block device driver;
• Character device driver;
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I3C subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• ISDN/mISDN subsystem;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Parport drivers;
• PCI subsystem;
• Pin controllers subsystem;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI drivers;
• QCOM SoC drivers;
• Direct Digital Synthesis drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• VHOST drivers;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• Proc file system;
• SMB network file system;
• Core kernel;
• DMA mapping infrastructure;
• RCU subsystem;
• Tracing infrastructure;
• Radix Tree data structure library;
• Kernel userspace event delivery library;
• Objagg library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Ethernet bridge;
• CAN network layer;
• Networking core;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• KCM (Kernel Connection Multiplexor) sockets driver;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• Network traffic control;
• SCTP protocol;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• Wireless networking;
• AppArmor security module;
• Landlock security;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• SoC audio core drivers;
• USB sound devices; (CVE-2023-52751, CVE-2024-43902, CVE-2024-46791, CVE-2024-45018, CVE-2024-44987, CVE-2024-46763, CVE-2024-46724, CVE-2024-26893, CVE-2024-42283, CVE-2024-46738, CVE-2024-46819, CVE-2024-44982, CVE-2023-52889, CVE-2024-45025, CVE-2023-52918, CVE-2024-46800, CVE-2024-46756, CVE-2024-46719, CVE-2024-39472, CVE-2024-42292, CVE-2024-45006, CVE-2024-46675, CVE-2024-44971, CVE-2024-46731, CVE-2024-42286, CVE-2024-44954, CVE-2024-42274, CVE-2024-46746, CVE-2024-42276, CVE-2024-43869, CVE-2024-43830, CVE-2024-42288, CVE-2024-41042, CVE-2024-42126, CVE-2024-43870, CVE-2024-46805, CVE-2024-41078, CVE-2024-44966, CVE-2024-44989, CVE-2024-46795, CVE-2024-44988, CVE-2024-38577, CVE-2024-43839, CVE-2024-43909, CVE-2024-46745, CVE-2024-42285,…