CVE-2024-0565

An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.

An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.

An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.

The Linux Kernel, the operating system core itself.

Security Fix(es):

An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within nf_tables_newtable function enables an attacker to achieve out-of-bounds access.(CVE-2023-6040)

An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.(CVE-2024-0565)

A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and writes to the dst array. On each iteration, 8 bytes are written, but dst is an array of u32, so each element only has space for 4 bytes. That means every iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local user to cause a denial of service or potentially break NetFilter functionality.(CVE-2024-0607)

An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)
• kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931)
• kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546,ZDI-CAN-20527)
• kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (CVE-2024-0565)
• kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (CVE-2023-51042)
• kernel: ext4: kernel bug in ext4_write_inline_data_end() (CVE-2021-33631)
• kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)

Bug Fix(es):

• OCP 4.12 crashed due to use-after-free in libceph in rhel8 (JIRA:AlmaLinux-21394)
• kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (JIRA:AlmaLinux-24010)
• Screen floods with random colour suggesting something not initialised (JIRA:AlmaLinux-21055)
• kernel: vmxgfx: NULL pointer dereference in vmw_cmd_dx_define_query (JIRA:AlmaLinux-22766)
• tx-checksumming required for accessing port in OpenShift for AlmaLinux 8.6 (JIRA:AlmaLinux-20822)
• kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (JIRA:AlmaLinux-22077)
• kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (JIRA:AlmaLinux-22930)
• rbd: don't move requests to the running list on errors [8.x] (JIRA:AlmaLinux-24204)
• kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (JIRA:AlmaLinux-24479)
• ceph: several cap and snap fixes (JIRA:AlmaLinux-20909)
• [RHVH] Migration hangs between RHVH release bellow 4.5.1 and RHVH over or equal 4.5.2 release (JIRA:AlmaLinux-23063)
• unable to access smsc95xx based interface unless you start outgoing traffic. (JIRA:AlmaLinux-25719)
• [AlmaLinux8] ] BUG bio-696 (Not tainted): Poison overwritten (JIRA:AlmaLinux-26101)
• kernel: GSM multiplexing race condition leads to privilege escalation (JIRA:AlmaLinux-19954)
• backport smartpqi: fix disable_managed_interrupts (JIRA:AlmaLinux-26139)
• kernel: ext4: kernel bug in ext4_write_inline_data_end() (JIRA:AlmaLinux-26331)
• ceph: always check dir caps asynchronously (JIRA:AlmaLinux-27496)

Enhancement(s):

• [IBM 8.10 FEAT] Upgrade the qeth driver to latest from upstream, e.g. kernel 6.4 (JIRA:AlmaLinux-25811)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)
• kernel: multiple use-after-free vulnerabilities (CVE-2024-1086, CVE-2023-3567, CVE-2023-4133, CVE-2023-6932, CVE-2023-39198, CVE-2023-51043, CVE-2023-51779, CVE-2023-51780, CVE-2024-1085, CVE-2024-26582)
• kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)
• kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)
• kernel: multiple NULL pointer dereference vulnerabilities (CVE-2022-38096, CVE-2023-6622, CVE-2023-6915, CVE-2023-42754, CVE-2023-46862, CVE-2023-52574, CVE-2024-0841, CVE-2023-52448)
• kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934)
• kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040)
• kernel: GC's deletion of an SKB races with unix_stream_read_generic() leading to UAF (CVE-2023-6531)
• kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931)
• kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023)
• kernel: irdma: Improper access control (CVE-2023-25775)
• Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464)
• kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c (CVE-2023-28866)
• kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl (CVE-2023-31083)
• kernel: multiple out-of-bounds read vulnerabilities (CVE-2023-37453, CVE-2023-39189, CVE-2023-39193, CVE-2023-6121, CVE-2023-39194)
• kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP (CVE-2023-42756)
• kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write (CVE-2023-45863)
• kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)
• kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489)
• kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522)
• kernel: multiple memory leak vulnerabilities (CVE-2023-52529, CVE-2023-52581)
• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)
• kernel: net/core: kernel crash in ETH_P_1588 flow dissector (CVE-2023-52580)
• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)
• kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (CVE-2024-0565)
• kernel: tls: race between async notify and socket close (CVE-2024-26583)
• kernel: tls: handle backlogging of crypto requests (CVE-2024-26584)
• kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585)
• kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)
• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)
• kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)
• kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-26609)
• kernel: local dos vulnerability in scatterwalk_copychunks (CVE-2023-6176)
• kernel: perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476)
• kernel: netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620)
• kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References…

• netfilter: nf_tables: reject QUEUE/DROP verdict parameters {CVE-2024-1086}
• RDMA/core: Refactor rdma_bind_addr {CVE-2023-2176}
• RDMA/cma: Do not change route.addr.src_addr outside state checks
• RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
• drm/amdgpu: Fix potential fence use-after-free v2 {CVE-2023-51042}
• drm/atomic: Fix potential use-after-free in nonblocking commits {CVE-2023-51043}
• ext4: improve error recovery code paths in __ext4_remount() {CVE-2024-0775}
• net: tls, update curr on splice as well {CVE-2024-0646}
• writeback: avoid use-after-free after removing device {CVE-2024-0562}
• smb: client: fix OOB in receive_encrypted_standard() {CVE-2024-0565}
• netfilter: nf_tables: Reject tables of unsupported family {CVE-2023-6040}
• ida: Fix crash in ida_free when the bitmap is empty {CVE-2023-6915}
• atm: Fix Use-After-Free in do_vcc_ioctl {CVE-2023-51780}

• netfilter: nf_tables: reject QUEUE/DROP verdict parameters {CVE-2024-1086}
• RDMA/core: Refactor rdma_bind_addr {CVE-2023-2176}
• RDMA/cma: Do not change route.addr.src_addr outside state checks
• RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
• drm/amdgpu: Fix potential fence use-after-free v2 {CVE-2023-51042}
• drm/atomic: Fix potential use-after-free in nonblocking commits {CVE-2023-51043}
• ext4: improve error recovery code paths in __ext4_remount() {CVE-2024-0775}
• net: tls, update curr on splice as well {CVE-2024-0646}
• writeback: avoid use-after-free after removing device {CVE-2024-0562}
• smb: client: fix OOB in receive_encrypted_standard() {CVE-2024-0565}
• netfilter: nf_tables: Reject tables of unsupported family {CVE-2023-6040}
• ida: Fix crash in ida_free when the bitmap is empty {CVE-2023-6915}
• atm: Fix Use-After-Free in do_vcc_ioctl {CVE-2023-51780}

• bpf: Fix re-attachment branch in bpf_tracing_prog_attach {CVE-2024-26591}
• ext4: improve error recovery code paths in __ext4_remount() {CVE-2024-0775}
• smb: client: fix OOB in receive_encrypted_standard() {CVE-2024-0565}
• mtd: Fix gluebi NULL pointer dereference caused by ftl notifier {CVE-2023-52449}
• net: prevent mss overflow in skb_segment() {CVE-2023-52435}
• smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• atm: Fix Use-After-Free in do_vcc_ioctl {CVE-2023-51780}
• ida: Fix crash in ida_free when the bitmap is empty {CVE-2023-6915}
• nvmet: nul-terminate the NQNs passed in the connect command {CVE-2023-6121}
• netfilter: nf_tables: Reject tables of unsupported family {CVE-2023-6040}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• NFSD: fix use-after-free in nfsd4_ssc_setup_dul() {CVE-2023-1652}
• x86/bugs: Flush IBP in ib_prctl_set() {CVE-2023-0045}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• x86: Clear .brk area at early boot {CVE-2022-36123}
• misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one {CVE-2023-39197}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• ipv6: rpl: Fix Route of Death. {CVE-2023-2156}
• ipv6: Fix out-of-bounds access in ipv6_find_tlv() {CVE-2023-2156}
• net: rpl: fix rpl header size calculation {CVE-2023-2156}
• memstick: r592: Fix UAF bug in r592_remove due to race condition {CVE-2023-3141}
• ovl: fix use after free in struct ovl_aio_req {CVE-2023-1252}
• drm/amdgpu: Fix potential fence use-after-free v2 {CVE-2023-51042}
• netfilter: nf_tables: reject QUEUE/DROP verdict parameters {CVE-2024-1086}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}
• drm/atomic: Fix potential use-after-free in nonblocking commits {CVE-2023-51043}
• nvmet-tcp: Fix the H2C expected PDU len calculation {CVE-2023-6356}
• nvmet-tcp: remove boilerplate code {CVE-2023-6356}
• nvmet-tcp: fix a crash in nvmet_req_complete() {CVE-2023-6356}
• nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length {CVE-2023-6356}
• net: tls, update curr on splice as well {CVE-2024-0646}
• smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
• smb: client: fix potential OOB in cifs_dump_detail() {CVE-2023-6610}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• RDMA/core: Update CMA destination address on rdma_resolve_addr {CVE-2023-2176}
• RDMA/core: Refactor rdma_bind_addr {CVE-2023-2176}
• nfp: fix use-after-free in area_cache_get() {CVE-2022-3545}
• netfilter: nf_tables: skip bound chain on rule flush {CVE-2023-3777}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• drivers: net: slip: fix NPD bug in sl_tx_timeout() {CVE-2022-41858}
• net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve {CVE-2023-4623}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• nvmet-tcp: Fix a possible UAF in queue intialization setup {CVE-2023-5178}
• net: tun: fix bugs for oversize packet when napi frags enabled {CVE-2023-3812}
• netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c {CVE-2023-42753}
• bpf: Fix incorrect verifier pruning due to missing register precision taints {CVE-2023-2163}
• net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4206}…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

• kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931)

• kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546,ZDI-CAN-20527)

• kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (CVE-2024-0565)

• kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (CVE-2023-51042)

• kernel: ext4: kernel bug in ext4_write_inline_data_end() (CVE-2021-33631)

• kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)

Bug Fix(es):

• OCP 4.12 crashed due to use-after-free in libceph in rhel8 (JIRA:Rocky Linux-21394)

• kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (JIRA:Rocky Linux-24010)

• Screen floods with random colour suggesting something not initialised (JIRA:Rocky Linux-21055)

• kernel: vmxgfx: NULL pointer dereference in vmw_cmd_dx_define_query (JIRA:Rocky Linux-22766)

• tx-checksumming required for accessing port in OpenShift for Rocky Linux 8.6 (JIRA:Rocky Linux-20822)

• kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (JIRA:Rocky Linux-22077)

• kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (JIRA:Rocky Linux-22930)

• rbd: don't move requests to the running list on errors [8.x] (JIRA:Rocky Linux-24204)

• kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (JIRA:Rocky Linux-24479)

• ceph: several cap and snap fixes (JIRA:Rocky Linux-20909)

• [RHVH] Migration hangs between RHVH release bellow 4.5.1 and RHVH over or equal 4.5.2 release (JIRA:Rocky Linux-23063)

• unable to access smsc95xx based interface unless you start outgoing traffic. (JIRA:Rocky Linux-25719)

• [Rocky Linux8] ] BUG bio-696 (Not tainted): Poison overwritten (JIRA:Rocky Linux-26101)

• kernel: GSM multiplexing race condition leads to privilege escalation (JIRA:Rocky Linux-19954)

• backport smartpqi: fix disable_managed_interrupts (JIRA:Rocky Linux-26139)

• kernel: ext4: kernel bug in ext4_write_inline_data_end() (JIRA:Rocky Linux-26331)

• ceph: always check dir caps asynchronously (JIRA:Rocky Linux-27496)

Enhancement(s):

• [IBM 8.10 FEAT] Upgrade the qeth driver to latest from upstream, e.g. kernel 6.4 (JIRA:Rocky Linux-25811)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

• kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931)

• kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546,ZDI-CAN-20527)

• kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (CVE-2024-0565)

• kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (CVE-2023-51042)

• kernel: ext4: kernel bug in ext4_write_inline_data_end() (CVE-2021-33631)

• kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)

Bug Fix(es):

• kernel-rt: update RT source tree to the latest Rocky Linux-8.9.z3 Batch (JIRA:Rocky Linux-23853)

• kernel-rt: kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (JIRA:Rocky Linux-24015)

• kernel-rt: kernel: vmxgfx: NULL pointer dereference in vmw_cmd_dx_define_query (JIRA:Rocky Linux-22758)

• kernel-rt: kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (JIRA:Rocky Linux-22080)

• kernel-rt: kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (JIRA:Rocky Linux-22933)

• kernel-rt: kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (JIRA:Rocky Linux-24498)

• kernel-rt: kernel: GSM multiplexing race condition leads to privilege escalation (JIRA:Rocky Linux-19966)

• kernel-rt: kernel: ext4: kernel bug in ext4_write_inline_data_end() (JIRA:Rocky Linux-26334)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

• kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931)

• kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546,ZDI-CAN-20527)

• kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (CVE-2024-0565)

• kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (CVE-2023-51042)

• kernel: ext4: kernel bug in ext4_write_inline_data_end() (CVE-2021-33631)

• kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)

Bug Fix(es):

• OCP 4.12 crashed due to use-after-free in libceph in rhel8 (JIRA:Rocky Linux SIG Cloud-21394)

• kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (JIRA:Rocky Linux SIG Cloud-24010)

• Screen floods with random colour suggesting something not initialised (JIRA:Rocky Linux SIG Cloud-21055)

• kernel: vmxgfx: NULL pointer dereference in vmw_cmd_dx_define_query (JIRA:Rocky Linux SIG Cloud-22766)

• tx-checksumming required for accessing port in OpenShift for Rocky Linux SIG Cloud 8.6 (JIRA:Rocky Linux SIG Cloud-20822)

• kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (JIRA:Rocky Linux SIG Cloud-22077)

• kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (JIRA:Rocky Linux SIG Cloud-22930)

• rbd: don't move requests to the running list on errors [8.x] (JIRA:Rocky Linux SIG Cloud-24204)

• kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (JIRA:Rocky Linux SIG Cloud-24479)

• ceph: several cap and snap fixes (JIRA:Rocky Linux SIG Cloud-20909)

• [RHVH] Migration hangs between RHVH release bellow 4.5.1 and RHVH over or equal 4.5.2 release (JIRA:Rocky Linux SIG Cloud-23063)

• unable to access smsc95xx based interface unless you start outgoing traffic. (JIRA:Rocky Linux SIG Cloud-25719)

• [Rocky Linux SIG Cloud8] ] BUG bio-696 (Not tainted): Poison overwritten (JIRA:Rocky Linux SIG Cloud-26101)

• kernel: GSM multiplexing race condition leads to privilege escalation (JIRA:Rocky Linux SIG Cloud-19954)

• backport smartpqi: fix disable_managed_interrupts (JIRA:Rocky Linux SIG Cloud-26139)

• kernel: ext4: kernel bug in ext4_write_inline_data_end() (JIRA:Rocky Linux SIG Cloud-26331)

• ceph: always check dir caps asynchronously (JIRA:Rocky Linux SIG Cloud-27496)

Enhancement(s):

• [IBM 8.10 FEAT] Upgrade the qeth driver to latest from upstream, e.g. kernel 6.4 (JIRA:Rocky Linux SIG Cloud-25811)

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-1086: Fixed a use-after-free vulnerability inside the nf_tables component that could have been exploited to achieve local privilege escalation (bsc#1219434).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218730).
• CVE-2023-46838: Fixed an issue with Xen netback processing of zero-length transmit fragment (bsc#1218836).
• CVE-2021-33631: Fixed an integer overflow in ext4_write_inline_data_end() (bsc#1219412).
• CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
• CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
• CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
• CVE-2023-47233: Fixed a use-after-free in the device unplugging (disconnect the USB by hotplug) code inside the brcm80211 component (bsc#1216702).
• CVE-2023-51043: Fixed use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c (bsc#1219120).
• CVE-2024-0775: Fixed use-after-free in __ext4_remount in fs/ext4/super.c that could allow a local user to cause an information leak problem while freeing the old quota file names before a potential failure (bsc#1219053).
• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1218832).
• CVE-2023-6915: Fixed a NULL pointer dereference problem in ida_free in lib/idr.c (bsc#1218804).
• CVE-2023-6040: Fixed an out-of-bounds access vulnerability while creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within nf_tables_newtable function (bsc#1218752).
• CVE-2023-51782: Fixed use-after-free in rose_ioctl in net/rose/af_rose.c because of a rose_accept race condition (bsc#1218757).

The following non-security bugs were fixed:

• Store the old kernel changelog entries in kernel-docs package (bsc#1218713).
• x86/entry/ia32: Ensure s32 is sign extended to s64 (bsc#1193285).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219429).
• CVE-2024-1086: Fixed a use-after-free vulnerability inside the nf_tables component that could have been exploited to achieve local privilege escalation (bsc#1219434).
• CVE-2023-51042: Fixed use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (bsc#1219128).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218730).
• CVE-2023-46838: Fixed an issue with Xen netback processing of zero-length transmit fragment (bsc#1218836).
• CVE-2021-33631: Fixed an integer overflow in ext4_write_inline_data_end() (bsc#1219412).
• CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
• CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
• CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
• CVE-2023-47233: Fixed a use-after-free in the device unplugging (disconnect the USB by hotplug) code inside the brcm80211 component (bsc#1216702).
• CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be exploited to achieve local privilege escalation (bsc#1215275).
• CVE-2023-51043: Fixed use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c (bsc#1219120).
• CVE-2024-0775: Fixed use-after-free in __ext4_remount in fs/ext4/super.c that could allow a local user to cause an information leak problem while freeing the old quota file names before a potential failure (bsc#1219053).
• CVE-2023-6040: Fixed an out-of-bounds access vulnerability while creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within nf_tables_newtable function (bsc#1218752).
• CVE-2024-0641: Fixed a denial of service vulnerability in tipc_crypto_key_revoke in net/tipc/crypto.c (bsc#1218916).
• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1218832).
• CVE-2023-6915: Fixed a NULL pointer dereference problem in ida_free in lib/idr.c (bsc#1218804).
• CVE-2023-51782: Fixed use-after-free in rose_ioctl in net/rose/af_rose.c because of a rose_accept race condition (bsc#1218757).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).

The following non-security bugs were fixed:

• Store the old kernel changelog entries in kernel-docs package (bsc#1218713).
• ACPI: LPIT: Avoid u32 multiplication overflow (git-fixes).
• ACPI: LPSS: Fix the fractional clock divider flags (git-fixes).
• ACPI: arm64: export acpi_arch_thermal_cpufreq_pctg() (bsc#1214377)
• ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error (git-fixes).
• ACPI: processor: reduce CPUFREQ thermal reduction pctg for Tegra241 (bsc#1214377)
• ACPI: property: Allow _DSD buffer data only for byte accessors (git-fixes).
• ACPI: resource: Add another DMI match for the TongFang GMxXGxx (git-fixes).
• ACPI: thermal: Add Thermal fast Sampling Period (_TFP) support (bsc#1214377)
• ACPI: video: check for error while searching for backlight device parent (git-fixes).
• ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140 (git-fixes).
• ALSA: hda/cs8409: Suppress vmaster control for Dolphin models (git-fixes).
• ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models (git-fixes).
• ALSA: hda/realtek: Enable headset mic on Lenovo M70 Gen5 (git-fixes).
• ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on HP ZBook (git-fixes).
• ALSA:…

The SUSE Linux Enterprise 15 SP3 LTSS kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-1086: Fixed a use-after-free vulnerability inside the nf_tables component that could have been exploited to achieve local privilege escalation (bsc#1219434).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218730).
• CVE-2023-46838: Fixed an issue with Xen netback processing of zero-length transmit fragment (bsc#1218836).
• CVE-2021-33631: Fixed an integer overflow in ext4_write_inline_data_end() (bsc#1219412).
• CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
• CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
• CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
• CVE-2023-47233: Fixed a use-after-free in the device unplugging (disconnect the USB by hotplug) code inside the brcm80211 component (bsc#1216702).
• CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be exploited to achieve local privilege escalation (bsc#1215275).
• CVE-2023-51043: Fixed use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c (bsc#1219120).
• CVE-2024-0775: Fixed use-after-free in __ext4_remount in fs/ext4/super.c that could allow a local user to cause an information leak problem while freeing the old quota file names before a potential failure (bsc#1219053).
• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1218832).
• CVE-2023-6915: Fixed a NULL pointer dereference problem in ida_free in lib/idr.c (bsc#1218804).
• CVE-2023-6040: Fixed an out-of-bounds access vulnerability while creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within nf_tables_newtable function (bsc#1218752).
• CVE-2023-51782: Fixed use-after-free in rose_ioctl in net/rose/af_rose.c because of a rose_accept race condition (bsc#1218757).

The following non-security bugs were fixed:

• Limit kernel-source build to architectures for which the kernel binary is built (bsc#1108281).
• x86/entry/ia32: Ensure s32 is sign extended to s64 (bsc#1193285).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-0340: Fixed information disclosure in vhost/vhost.c:vhost_new_msg() (bsc#1218689).
• CVE-2024-24860: Fixed a denial of service caused by a race condition in {min,max}_key_size_set() (bsc#1219608).
• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219429).
• CVE-2024-1086: Fixed a use-after-free vulnerability inside the nf_tables component that could have been exploited to achieve local privilege escalation (bsc#1219434).
• CVE-2023-51042: Fixed use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (bsc#1219128).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218730).
• CVE-2023-46838: Fixed an issue with Xen netback processing of zero-length transmit fragment (bsc#1218836).
• CVE-2021-33631: Fixed an integer overflow in ext4_write_inline_data_end() (bsc#1219412).
• CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
• CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
• CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
• CVE-2023-47233: Fixed a use-after-free in the device unplugging (disconnect the USB by hotplug) code inside the brcm80211 component (bsc#1216702).
• CVE-2023-51043: Fixed use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c (bsc#1219120).
• CVE-2024-0775: Fixed use-after-free in __ext4_remount in fs/ext4/super.c that could allow a local user to cause an information leak problem while freeing the old quota file names before a potential failure (bsc#1219053).
• CVE-2023-6040: Fixed an out-of-bounds access vulnerability while creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within nf_tables_newtable function (bsc#1218752).
• CVE-2024-0641: Fixed a denial of service vulnerability in tipc_crypto_key_revoke in net/tipc/crypto.c (bsc#1218916).
• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1218832).
• CVE-2023-6915: Fixed a NULL pointer dereference problem in ida_free in lib/idr.c (bsc#1218804).
• CVE-2023-51782: Fixed use-after-free in rose_ioctl in net/rose/af_rose.c because of a rose_accept race condition (bsc#1218757).

The following non-security bugs were fixed:

• Store the old kernel changelog entries in kernel-docs package (bsc#1218713).
• bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent (git-fixes).
• bcache: Remove unnecessary NULL point check in node allocations (git-fixes).
• bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (git-fixes).
• bcache: avoid NULL checking to c->root in run_cache_set() (git-fixes).
• bcache: avoid oversize memory allocation by small stripe_size (git-fixes).
• bcache: check return value from btree_node_alloc_replacement() (git-fixes).
• bcache: fixup btree_cache_wait list damage (git-fixes).
• bcache: fixup init dirty data errors (git-fixes).
• bcache: fixup lock c->root error (git-fixes).
• bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race (git-fixes).
• bcache: prevent potential division by zero error (git-fixes).
• bcache: remove redundant assignment to variable cur_idx (git-fixes).
• bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce() (git-fixes).
• bcache: revert replacing IS_ERR_OR_NULL with IS_ERR (git-fixes).
• block: Fix kabi header include (bsc#1218929).
• block: free the extended dev_t minor later (bsc#1218930).
• clocksource: Skip watchdog check for large watchdog intervals (bsc#1217217).
• clocksource: disable watchdog checks on TSC when TSC…

The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-1086: Fixed a use-after-free vulnerability inside the nf_tables component that could have been exploited to achieve local privilege escalation (bsc#1219434).
• CVE-2024-0775: Fixed use-after-free in __ext4_remount in fs/ext4/super.c that could allow a local user to cause an information leak problem while freeing the old quota file names before a potential failure (bsc#1219053).
• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1218832).
• CVE-2023-6915: Fixed a NULL pointer dereference problem in ida_free in lib/idr.c (bsc#1218804).
• CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
• CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
• CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
• CVE-2023-6040: Fixed an out-of-bounds access vulnerability while creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within nf_tables_newtable function (bsc#1218752).
• CVE-2023-51782: Fixed use-after-free in rose_ioctl in net/rose/af_rose.c because of a rose_accept race condition (bsc#1218757).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218730).
• CVE-2023-51043: Fixed use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c (bsc#1219120).
• CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be exploited to achieve local privilege escalation (bsc#1215275).
• CVE-2023-47233: Fixed a use-after-free in the device unplugging (disconnect the USB by hotplug) code inside the brcm80211 component (bsc#1216702).
• CVE-2023-46838: Fixed an issue with Xen netback processing of zero-length transmit fragment (bsc#1218836).
• CVE-2021-33631: Fixed an integer overflow in ext4_write_inline_data_end() (bsc#1219412).

The following non-security bugs were fixed:

• build: Limit kernel-source build to architectures for which the kernel binary is built (bsc#1108281).
• docs: Store the old kernel changelog entries in kernel-docs package (bsc#1218713)
• mkspec: Include constraints for both multibuild and plain package always
• rpm/kernel-docs.spec.in: fix build with 6.8 Since upstream commit f061c9f7d058
• rpm/kernel-source.rpmlintrc: add action-ebpf Upstream commit a79d8ba734bd
• rpm/mkspec: use kernel-source: prefix for constraints on multibuild Otherwise the constraints are not applied with multibuild enabled.
• x86/entry/ia32: Ensure s32 is sign extended to s64 (bsc#1193285).

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219429).
• CVE-2024-1086: Fixed a use-after-free vulnerability inside the nf_tables component that could have been exploited to achieve local privilege escalation (bsc#1219434).
• CVE-2023-51042: Fixed use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (bsc#1219128).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218730).
• CVE-2023-46838: Fixed an issue with Xen netback processing of zero-length transmit fragment (bsc#1218836).
• CVE-2021-33631: Fixed an integer overflow in ext4_write_inline_data_end() (bsc#1219412).
• CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
• CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
• CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
• CVE-2023-47233: Fixed a use-after-free in the device unplugging (disconnect the USB by hotplug) code inside the brcm80211 component (bsc#1216702).
• CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be exploited to achieve local privilege escalation (bsc#1215275).
• CVE-2023-51043: Fixed use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c (bsc#1219120).
• CVE-2024-0775: Fixed use-after-free in __ext4_remount in fs/ext4/super.c that could allow a local user to cause an information leak problem while freeing the old quota file names before a potential failure (bsc#1219053).
• CVE-2023-6040: Fixed an out-of-bounds access vulnerability while creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within nf_tables_newtable function (bsc#1218752).
• CVE-2024-0641: Fixed a denial of service vulnerability in tipc_crypto_key_revoke in net/tipc/crypto.c (bsc#1218916).
• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1218832).
• CVE-2023-6915: Fixed a NULL pointer dereference problem in ida_free in lib/idr.c (bsc#1218804).
• CVE-2023-51782: Fixed use-after-free in rose_ioctl in net/rose/af_rose.c because of a rose_accept race condition (bsc#1218757).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2024-0340: Fixed information disclosure in vhost/vhost.c:vhost_new_msg() (bsc#1218689).
• CVE-2024-24860: Fixed a denial of service caused by a race condition in {min,max}_key_size_set() (bsc#1219608).

The following non-security bugs were fixed:

• Store the old kernel changelog entries in kernel-docs package (bsc#1218713).
• Documentation: RAS: Add index and address translation section (jsc#PED-7618).
• ACPI: LPIT: Avoid u32 multiplication overflow (git-fixes).
• ACPI: LPSS: Fix the fractional clock divider flags (git-fixes).
• ACPI: arm64: export acpi_arch_thermal_cpufreq_pctg() (bsc#1214377)
• ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error (git-fixes).
• ACPI: processor: reduce CPUFREQ thermal reduction pctg for Tegra241 (bsc#1214377)
• ACPI: property: Allow _DSD buffer data only for byte accessors (git-fixes).
• ACPI: resource: Add another DMI match for the TongFang GMxXGxx (git-fixes).
• ACPI: thermal: Add Thermal fast Sampling Period (_TFP) support (bsc#1214377)
• ACPI: video: check for error while searching for backlight device parent (git-fixes).
• ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140 (git-fixes).
• ALSA: hda/cs8409: Suppress vmaster…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219429).
• CVE-2024-1086: Fixed a use-after-free vulnerability inside the nf_tables component that could have been exploited to achieve local privilege escalation (bsc#1219434).
• CVE-2023-51042: Fixed use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (bsc#1219128).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218730).
• CVE-2023-46838: Fixed an issue with Xen netback processing of zero-length transmit fragment (bsc#1218836).
• CVE-2021-33631: Fixed an integer overflow in ext4_write_inline_data_end() (bsc#1219412).
• CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
• CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
• CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
• CVE-2023-47233: Fixed a use-after-free in the device unplugging (disconnect the USB by hotplug) code inside the brcm80211 component (bsc#1216702).
• CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be exploited to achieve local privilege escalation (bsc#1215275).
• CVE-2023-51043: Fixed use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c (bsc#1219120).
• CVE-2024-0775: Fixed use-after-free in __ext4_remount in fs/ext4/super.c that could allow a local user to cause an information leak problem while freeing the old quota file names before a potential failure (bsc#1219053).
• CVE-2023-6040: Fixed an out-of-bounds access vulnerability while creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within nf_tables_newtable function (bsc#1218752).
• CVE-2024-0641: Fixed a denial of service vulnerability in tipc_crypto_key_revoke in net/tipc/crypto.c (bsc#1218916).
• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1218832).
• CVE-2023-6915: Fixed a NULL pointer dereference problem in ida_free in lib/idr.c (bsc#1218804).
• CVE-2023-51782: Fixed use-after-free in rose_ioctl in net/rose/af_rose.c because of a rose_accept race condition (bsc#1218757).
• CVE-2024-0340: Fixed information disclosure in vhost/vhost.c:vhost_new_msg() (bsc#1218689).
• CVE-2024-24860: Fixed a denial of service caused by a race condition in {min,max}_key_size_set() (bsc#1219608).

The following non-security bugs were fixed:

• Store the old kernel changelog entries in kernel-docs package (bsc#1218713).
• bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent (git-fixes).
• bcache: Remove unnecessary NULL point check in node allocations (git-fixes).
• bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (git-fixes).
• bcache: avoid NULL checking to c->root in run_cache_set() (git-fixes).
• bcache: avoid oversize memory allocation by small stripe_size (git-fixes).
• bcache: check return value from btree_node_alloc_replacement() (git-fixes).
• bcache: fixup btree_cache_wait list damage (git-fixes).
• bcache: fixup init dirty data errors (git-fixes).
• bcache: fixup lock c->root error (git-fixes).
• bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race (git-fixes).
• bcache: prevent potential division by zero error (git-fixes).
• bcache: remove redundant assignment to variable cur_idx (git-fixes).
• bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce() (git-fixes).
• bcache: revert replacing IS_ERR_OR_NULL with IS_ERR (git-fixes).
• block: Fix kabi header include (bsc#1218929).
• block: free the extended dev_t…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219429).
• CVE-2024-1086: Fixed a use-after-free vulnerability inside the nf_tables component that could have been exploited to achieve local privilege escalation (bsc#1219434).
• CVE-2023-51042: Fixed use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (bsc#1219128).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218730).
• CVE-2023-46838: Fixed an issue with Xen netback processing of zero-length transmit fragment (bsc#1218836).
• CVE-2021-33631: Fixed an integer overflow in ext4_write_inline_data_end() (bsc#1219412).
• CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
• CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
• CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
• CVE-2023-47233: Fixed a use-after-free in the device unplugging (disconnect the USB by hotplug) code inside the brcm80211 component (bsc#1216702).
• CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be exploited to achieve local privilege escalation (bsc#1215275).
• CVE-2023-51043: Fixed use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c (bsc#1219120).
• CVE-2024-0775: Fixed use-after-free in __ext4_remount in fs/ext4/super.c that could allow a local user to cause an information leak problem while freeing the old quota file names before a potential failure (bsc#1219053).
• CVE-2023-6040: Fixed an out-of-bounds access vulnerability while creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within nf_tables_newtable function (bsc#1218752).
• CVE-2024-0641: Fixed a denial of service vulnerability in tipc_crypto_key_revoke in net/tipc/crypto.c (bsc#1218916).
• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1218832).
• CVE-2023-6915: Fixed a NULL pointer dereference problem in ida_free in lib/idr.c (bsc#1218804).
• CVE-2023-51782: Fixed use-after-free in rose_ioctl in net/rose/af_rose.c because of a rose_accept race condition (bsc#1218757).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2024-0340: Fixed information disclosure in vhost/vhost.c:vhost_new_msg() (bsc#1218689).
• CVE-2024-24860: Fixed a denial of service caused by a race condition in {min,max}_key_size_set() (bsc#1219608).

The following non-security bugs were fixed:

• Documentation: RAS: Add index and address translation section (jsc#PED-7618).
• ACPI: LPIT: Avoid u32 multiplication overflow (git-fixes).
• ACPI: LPSS: Fix the fractional clock divider flags (git-fixes).
• ACPI: arm64: export acpi_arch_thermal_cpufreq_pctg() (bsc#1214377)
• ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error (git-fixes).
• ACPI: processor: reduce CPUFREQ thermal reduction pctg for Tegra241 (bsc#1214377)
• ACPI: property: Allow _DSD buffer data only for byte accessors (git-fixes).
• ACPI: resource: Add another DMI match for the TongFang GMxXGxx (git-fixes).
• ACPI: thermal: Add Thermal fast Sampling Period (_TFP) support (bsc#1214377)
• ACPI: video: check for error while searching for backlight device parent (git-fixes).
• ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140 (git-fixes).
• ALSA: hda/cs8409: Suppress vmaster control for Dolphin models (git-fixes).
• ALSA: hda/realtek: Add quirks for ASUS…

This update for the Linux Kernel 5.14.21-150500_11 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have allowed a local user to crash the system or potentially escalate their privileges (bsc#1218613).
• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219432).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).

This update for the Linux Kernel 5.14.21-150500_13_11 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have allowed a local user to crash the system or potentially escalate their privileges (bsc#1218613).
• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219432).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).

This update for the Linux Kernel 5.14.21-150500_13_27 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219432).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).

This update for the Linux Kernel 5.3.18-150300_59_141 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).

This update for the Linux Kernel 5.14.21-150500_53 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have allowed a local user to crash the system or potentially escalate their privileges (bsc#1218613).
• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219432).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).

This update for the Linux Kernel 5.14.21-150500_55_39 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219432).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).

This update for the Linux Kernel 5.3.18-150300_59_115 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have allowed a local user to crash the system or potentially escalate their privileges (bsc#1218613).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).

This update for the Linux Kernel 5.3.18-150300_59_138 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).

This update for the Linux Kernel 5.3.18-150300_59_130 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have allowed a local user to crash the system or potentially escalate their privileges (bsc#1218613).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).

This update for the Linux Kernel 5.14.21-150500_55_28 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have allowed a local user to crash the system or potentially escalate their privileges (bsc#1218613).
• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219432).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).

This update for the Linux Kernel 5.14.21-150500_55_7 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have allowed a local user to crash the system or potentially escalate their privileges (bsc#1218613).
• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219432).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).

This update for the Linux Kernel 5.3.18-150200_24_163 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have allowed a local user to crash the system or potentially escalate their privileges (bsc#1218613).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).

This update for the Linux Kernel 5.14.21-150500_55_31 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219432).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).

This update for the Linux Kernel 5.14.21-150400_24_81 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have allowed a local user to crash the system or potentially escalate their privileges (bsc#1218613).
• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219432).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).

This update for the Linux Kernel 5.14.21-150400_24_92 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219432).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).

This update for the Linux Kernel 5.14.21-150400_24_103 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219432).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).

This update for the Linux Kernel 5.14.21-150400_24_55 fixes several issues.

The following security issues were fixed:

• CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receive_encrypted_standard in fs/smb/client/smb2ops.c (bsc#1219078).
• CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have allowed a local user to crash the system or potentially escalate their privileges (bsc#1218613).
• CVE-2024-1085: Fixed nf_tables use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (bsc#1219432).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219296).