CVE-2024-26837

net: bridge: switchdev: Skip MDB replays of deferred events on offload

4.7 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: switchdev: Skip MDB replays of deferred events on offload

Before this change, generation of the list of MDB events to replay would race against the creation of new group memberships, either from the IGMP/MLD snooping logic or from user configuration.

While new memberships are immediately visible to walkers of br->mdb_list, the notification of their existence to switchdev event subscribers is deferred until a later point in time. So if a replay list was generated during a time that overlapped with such a window, it would also contain a replay of the not-yet-delivered event.

The driver would thus receive two copies of what the bridge internally considered to be one single event. On destruction of the bridge, only a single membership deletion event was therefore sent. As a consequence of this, drivers which reference count memberships (at least DSA), would be left with orphan groups in their hardware database when the bridge was destroyed.

This is only an issue when replaying additions. While deletion events may still be pending on the deferred queue, they will already have been removed from br->mdb_list, so no duplicates can be generated in that scenario.

To a user this meant that old group memberships, from a bridge in which a port was previously attached, could be reanimated (in hardware) when the port joined a new bridge, without the new bridge's knowledge.

For example, on an mv88e6xxx system, create a snooping bridge and immediately add a port to it:

root@infix-06-0b-00:~$ ip link add dev br0 up type bridge mcast_snooping 1 && \
> ip link set dev x3 up master br0

And then destroy the bridge:

root@infix-06-0b-00:~$ ip link del dev br0
root@infix-06-0b-00:~$ mvls atu
ADDRESS             FID  STATE      Q  F  0  1  2  3  4  5  6  7  8  9  a
DEV:0 Marvell 88E6393X
33:33:00:00:00:6a     1  static     -  -  0  .  .  .  .  .  .  .  .  .  .
33:33:ff:87:e4:3f     1  static     -  -  0  .  .  .  .  .  .  .  .  .  .
ff:ff:ff:ff:ff:ff     1  static     -  -  0  1  2  3  4  5  6  7  8  9  a
root@infix-06-0b-00:~$

The two IPv6 groups remain in the hardware database because the port (x3) is notified of the host's membership twice: once via the original event and once via a replay. Since only a single delete notification is sent, the count remains at 1 when the bridge is destroyed.

Then add the same port (or another port belonging to the same hardware domain) to a new bridge, this time with snooping disabled:

root@infix-06-0b-00:~$ ip link add dev br1 up type bridge mcast_snooping 0 && \
> ip link set dev x3 up master br1

All multicast, including the two IPv6 groups from br0, should now be flooded, according to the policy of br1. But instead the old memberships are still active in the hardware database, causing the switch to only forward traffic to those groups towards the CPU (port 0).

Eliminate the race in two steps:

Grab the write-side lock of the MDB while generating the replay list.

This prevents new memberships from showing up while we are generating the replay list. But it leaves the scenario in which a deferred event was already generated, but not delivered, before we grabbed the lock. Therefore:

Make sure that no deferred version of a replay event is already enqueued to the switchdev deferred queue, before adding it to the replay list, when replaying additions.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.17%Up 0.1 points since Apr 18, 2024

What each source reports

NVD Score used 4.7

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: switchdev: Skip MDB replays of deferred events on offload

Before this change, generation of the list of MDB events to replay would race against the creation of new group memberships, either from the IGMP/MLD snooping logic or from user configuration.

For example, on an mv88e6xxx system, create a snooping bridge and immediately add a port to it:

root@infix-06-0b-00:~$ ip link add dev br0 up type bridge mcast_snooping 1 && \
> ip link set dev x3 up master br0

And then destroy the bridge:

root@infix-06-0b-00:~$ ip link del dev br0
root@infix-06-0b-00:~$ mvls atu
ADDRESS             FID  STATE      Q  F  0  1  2  3  4  5  6  7  8  9  a
DEV:0 Marvell 88E6393X
33:33:00:00:00:6a     1  static     -  -  0  .  .  .  .  .  .  .  .  .  .
33:33:ff:87:e4:3f     1  static     -  -  0  .  .  .  .  .  .  .  .  .  .
ff:ff:ff:ff:ff:ff     1  static     -  -  0  1  2  3  4  5  6  7  8  9  a
root@infix-06-0b-00:~$

Then add the same port (or another port belonging to the same hardware domain) to a new bridge, this time with snooping disabled:

root@infix-06-0b-00:~$ ip link add dev br1 up type bridge mcast_snooping 0 && \
> ip link set dev x3 up master br1

Eliminate the race in two steps:

Grab the write-side lock of the MDB while generating the replay list.

Make sure that no deferred version of a replay event is already enqueued to the switchdev deferred queue, before adding it to the replay list, when replaying additions.

Record: CVE-2024-26837
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-362
Updated: 2026-11-02

CVE List No score

net: bridge: switchdev: Skip MDB replays of deferred events on offload

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: switchdev: Skip MDB replays of deferred events on offload

Before this change, generation of the list of MDB events to replay would race against the creation of new group memberships, either from the IGMP/MLD snooping logic or from user configuration.

For example, on an mv88e6xxx system, create a snooping bridge and immediately add a port to it:

root@infix-06-0b-00:~$ ip link add dev br0 up type bridge mcast_snooping 1 && \
> ip link set dev x3 up master br0

And then destroy the bridge:

root@infix-06-0b-00:~$ ip link del dev br0
root@infix-06-0b-00:~$ mvls atu
ADDRESS             FID  STATE      Q  F  0  1  2  3  4  5  6  7  8  9  a
DEV:0 Marvell 88E6393X
33:33:00:00:00:6a     1  static     -  -  0  .  .  .  .  .  .  .  .  .  .
33:33:ff:87:e4:3f     1  static     -  -  0  .  .  .  .  .  .  .  .  .  .
ff:ff:ff:ff:ff:ff     1  static     -  -  0  1  2  3  4  5  6  7  8  9  a
root@infix-06-0b-00:~$

Then add the same port (or another port belonging to the same hardware domain) to a new bridge, this time with snooping disabled:

root@infix-06-0b-00:~$ ip link add dev br1 up type bridge mcast_snooping 0 && \
> ip link set dev x3 up master br1

Eliminate the race in two steps:

Grab the write-side lock of the MDB while generating the replay list.

Make sure that no deferred version of a replay event is already enqueued to the switchdev deferred queue, before adding it to the replay list, when replaying additions.

Record: CVE-2024-26837
Updated: 2026-11-02

EUVDEUVD-2024-24099 No score

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: switchdev: Skip MDB replays of deferred events on offload

Before this change, generation of the list of MDB events to replay would race against the creation of new group memberships, either from the IGMP/MLD snooping logic or from user configuration.

For example, on an mv88e6xxx system, create a snooping bridge and immediately add a port to it:

root@infix-06-0b-00:~$ ip link add dev br0 up type bridge mcast_snooping 1 && \
> ip link set dev x3 up master br0

And then destroy the bridge:

root@infix-06-0b-00:~$ ip link del dev br0
root@infix-06-0b-00:~$ mvls atu
ADDRESS             FID  STATE      Q  F  0  1  2  3  4  5  6  7  8  9  a
DEV:0 Marvell 88E6393X
33:33:00:00:00:6a     1  static     -  -  0  .  .  .  .  .  .  .  .  .  .
33:33:ff:87:e4:3f     1  static     -  -  0  .  .  .  .  .  .  .  .  .  .
ff:ff:ff:ff:ff:ff     1  static     -  -  0  1  2  3  4  5  6  7  8  9  a
root@infix-06-0b-00:~$

Then add the same port (or another port belonging to the same hardware domain) to a new bridge, this time with snooping disabled:

root@infix-06-0b-00:~$ ip link add dev br1 up type bridge mcast_snooping 0 && \
> ip link set dev x3 up master br1

Eliminate the race in two steps:

Grab the write-side lock of the MDB while generating the replay list.

Make sure that no deferred version of a replay event is already enqueued to the switchdev deferred queue, before adding it to the replay list, when replaying additions.

Record: EUVD-2024-24099
Updated: 2026-11-02

GitHub AdvisoriesGHSA-8ppx-vmhm-cxj7 4.7

In the Linux kernel, the following vulnerability has been resolved: net: bridge: switchdev: Skip...

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: switchdev: Skip MDB replays of deferred events on offload

Before this change, generation of the list of MDB events to replay would race against the creation of new group memberships, either from the IGMP/MLD snooping logic or from user configuration.

For example, on an mv88e6xxx system, create a snooping bridge and immediately add a port to it:

root@infix-06-0b-00:~$ ip link add dev br0 up type bridge mcast_snooping 1 && \
> ip link set dev x3 up master br0

And then destroy the bridge:

root@infix-06-0b-00:~$ ip link del dev br0
root@infix-06-0b-00:~$ mvls atu
ADDRESS             FID  STATE      Q  F  0  1  2  3  4  5  6  7  8  9  a
DEV:0 Marvell 88E6393X
33:33:00:00:00:6a     1  static     -  -  0  .  .  .  .  .  .  .  .  .  .
33:33:ff:87:e4:3f     1  static     -  -  0  .  .  .  .  .  .  .  .  .  .
ff:ff:ff:ff:ff:ff     1  static     -  -  0  1  2  3  4  5  6  7  8  9  a
root@infix-06-0b-00:~$

Then add the same port (or another port belonging to the same hardware domain) to a new bridge, this time with snooping disabled:

root@infix-06-0b-00:~$ ip link add dev br1 up type bridge mcast_snooping 0 && \
> ip link set dev x3 up master br1

Eliminate the race in two steps:

Grab the write-side lock of the MDB while generating the replay list.

Make sure that no deferred version of a replay event is already enqueued to the switchdev deferred queue, before adding it to the replay list, when replaying additions.

Record: GHSA-8ppx-vmhm-cxj7
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-362
Updated: 2026-11-02

OSVAZL-59442 4.7

CVE-2024-26837 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: switchdev: Skip MDB replays of deferred events on offload

Before this change, generation of the list of MDB events to replay would race against the creation of new group memberships, either from the IGMP/MLD snooping logic or from user configuration.

For example, on an mv88e6xxx system, create a snooping bridge and immediately add a port to it:

root@infix-06-0b-00:~$ ip link add dev br0 up type bridge mcast_snooping 1 && \
> ip link set dev x3 up master br0

And then destroy the bridge:

root@infix-06-0b-00:~$ ip link del dev br0
root@infix-06-0b-00:~$ mvls atu
ADDRESS             FID  STATE      Q  F  0  1  2  3  4  5  6  7  8  9  a
DEV:0 Marvell 88E6393X
33:33:00:00:00:6a     1  static     -  -  0  .  .  .  .  .  .  .  .  .  .
33:33:ff:87:e4:3f     1  static     -  -  0  .  .  .  .  .  .  .  .  .  .
ff:ff:ff:ff:ff:ff     1  static     -  -  0  1  2  3  4  5  6  7  8  9  a
root@infix-06-0b-00:~$

Then add the same port (or another port belonging to the same hardware domain) to a new bridge, this time with snooping disabled:

root@infix-06-0b-00:~$ ip link add dev br1 up type bridge mcast_snooping 0 && \
> ip link set dev x3 up master br1

Eliminate the race in two steps:

Grab the write-side lock of the MDB while generating the replay list.

Make sure that no deferred version of a replay event is already enqueued to the switchdev deferred queue, before adding it to the replay list, when replaying additions.

Record: AZL-59442
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2024-26837 4.7

Record: BELL-CVE-2024-26837
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 30 moreShow less

OSVDEBIAN-CVE-2024-26837 4.7

In the Linux kernel, the following vulnerability has been resolved: net: bridge: switchdev: Skip MDB replays of deferred events on offload Before this change, generation of the list of MDB events to replay would race against the creation of new group memberships, either from the IGMP/MLD snooping logic or from user configuration. While new memberships are immediately visible to walkers of br->mdb_list, the notification of their existence to switchdev event subscribers is deferred until a later point in time. So if a replay list was generated during a time that overlapped with such a window, it would also contain a replay of the not-yet-delivered event. The driver would thus receive two copies of what the bridge internally considered to be one single event. On destruction of the bridge, only a single membership deletion event was therefore sent. As a consequence of this, drivers which reference count memberships (at least DSA), would be left with orphan groups in their hardware database when the bridge was destroyed. This is only an issue when replaying additions. While deletion events may still be pending on the deferred queue, they will already have been removed from br->mdb_list, so no duplicates can be generated in that scenario. To a user this meant that old group memberships, from a bridge in which a port was previously attached, could be reanimated (in hardware) when the port joined a new bridge, without the new bridge's knowledge. For example, on an mv88e6xxx system, create a snooping bridge and immediately add a port to it: root@infix-06-0b-00:~~$ ip link add dev br0 up type bridge mcast_snooping 1 && \ > ip link set dev x3 up master br0 And then destroy the bridge: root@infix-06-0b-00:~~$ ip link del dev br0 root@infix-06-0b-00:$ mvls atu ADDRESS FID STATE Q F 0 1 2 3 4 5 6 7 8 9 a DEV:0 Marvell 88E6393X 33:33:00:00:00:6a 1 static - - 0 . . . . . . . . . . 33:33:ff:87:e4:3f 1 static - - 0 . . . . . . . . . . ff:ff:ff:ff:ff:ff 1 static - - 0 1 2 3 4 5 6 7 8 9 a root@infix-06-0b-00:$ The two IPv6 groups remain in the hardware database because the port (x3) is notified of the host's membership twice: once via the original event and once via a replay. Since only a single delete notification is sent, the count remains at 1 when the bridge is destroyed. Then add the same port (or another port belonging to the same hardware domain) to a new bridge, this time with snooping disabled: root@infix-06-0b-00:~$ ip link add dev br1 up type bridge mcast_snooping 0 && \ > ip link set dev x3 up master br1 All multicast, including the two IPv6 groups from br0, should now be flooded, according to the policy of br1. But instead the old memberships are still active in the hardware database, causing the switch to only forward traffic to those groups towards the CPU (port 0). Eliminate the race in two steps: 1. Grab the write-side lock of the MDB while generating the replay list. This prevents new memberships from showing up while we are generating the replay list. But it leaves the scenario in which a deferred event was already generated, but not delivered, before we grabbed the lock. Therefore: 2. Make sure that no deferred version of a replay event is already enqueued to the switchdev deferred queue, before adding it to the replay list, when replaying additions.

Record: DEBIAN-CVE-2024-26837
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2024:5101 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2024:5101
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:5102 7.8

Red Hat Security Advisory: kernel-rt security update

Record: RHSA-2024:5102
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:9315 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2024:9315
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:9546 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2024:9546
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-26837 4.7

Record: UBUNTU-CVE-2024-26837
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-11

OSVALSA-2024:5101 No score

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: powerpc: Fix access beyond end of drmem array (CVE-2023-52451)
kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463)
kernel: tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)
kernel: ext4: avoid online resizing failures due to oversized flex bg (CVE-2023-52622)
kernel: net/sched: flower: Fix chain template offload (CVE-2024-26669)
kernel: stmmac: Clear variable when destroying workqueue (CVE-2024-26802)
kernel: efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843)
kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878)
kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886)
kernel: SUNRPC: fix a memleak in gss_import_v2_context (CVE-2023-52653)
kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application (CVE-2024-21823)
kernel: Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (CVE-2023-52658)
kernel: ext4: fix corruption during on-line resize (CVE-2024-35807)
kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (CVE-2024-35801)
kernel: dyndbg: fix old BUG_ON in >control parser (CVE-2024-35947)
kernel: net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893)
kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (CVE-2024-35876)
kernel: platform/x86: wmi: Fix opening of char device (CVE-2023-52864)
kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (CVE-2023-52845)
(CVE-2023-28746)
(CVE-2023-52847)
(CVE-2021-47548)
(CVE-2024-36921)
(CVE-2024-26921)
(CVE-2021-47579)
(CVE-2024-36927)
(CVE-2024-39276)
(CVE-2024-33621)
(CVE-2024-27010)
(CVE-2024-26960)
(CVE-2024-38596)
(CVE-2022-48743)
(CVE-2024-26733)
(CVE-2024-26586)
(CVE-2024-26698)
(CVE-2023-52619)

Bug Fix(es):

AlmaLinux8.6 - Spinlock statistics may show negative elapsed time and incorrectly formatted output (JIRA:AlmaLinux-17678)
[AWS][8.9]There are call traces found when booting debug-kernel for Amazon EC2 r8g.metal-24xl instance (JIRA:AlmaLinux-23841)
[almalinux8] gfs2: Fix glock shrinker (JIRA:AlmaLinux-32941)
lan78xx: Microchip LAN7800 never comes up after unplug and replug (JIRA:AlmaLinux-33437)
[Hyper-V][AlmaLinux-8.10.z] Update hv_netvsc driver to TOT (JIRA:AlmaLinux-39074)
Use-after-free on proc inode-i_sb triggered by fsnotify (JIRA:AlmaLinux-40167)
blk-cgroup: Properly propagate the iostat update up the hierarchy [almalinux-8.10.z] (JIRA:AlmaLinux-40939)
(JIRA:AlmaLinux-31798)
(JIRA:AlmaLinux-10263)
(JIRA:AlmaLinux-40901)
(JIRA:AlmaLinux-43547)
(JIRA:AlmaLinux-34876)

Enhancement(s):

[RFE] Add module parameters 'soft_reboot_cmd' and 'soft_active_on_boot' for customizing softdog configuration (JIRA:AlmaLinux-19723)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

Record: ALSA-2024:5101
Updated: 2026-11-02

OSVALSA-2024:5102 No score

Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463)
kernel: tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)
kernel: ext4: avoid online resizing failures due to oversized flex bg (CVE-2023-52622)
kernel: net/sched: flower: Fix chain template offload (CVE-2024-26669)
kernel: stmmac: Clear variable when destroying workqueue (CVE-2024-26802)
kernel: efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843)
kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878)
kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886)
kernel: SUNRPC: fix a memleak in gss_import_v2_context (CVE-2023-52653)
kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application (CVE-2024-21823)
kernel: ext4: fix corruption during on-line resize (CVE-2024-35807)
kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (CVE-2024-35801)
kernel: dyndbg: fix old BUG_ON in >control parser (CVE-2024-35947)
kernel: net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893)
kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (CVE-2024-35876)
kernel: platform/x86: wmi: Fix opening of char device (CVE-2023-52864)
kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (CVE-2023-52845)
kernel: Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (CVE-2023-52658)
kernel: crash due to a missing check for leb_size (CVE-2024-25739)
kernel: tcp: make sure init the accept_queue's spinlocks once (CVE-2024-26614)
kernel: tcp: add sanity checks to rx zerocopy (CVE-2024-26640)
kernel: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (CVE-2024-26870)
kernel: nfs: fix UAF in direct writes (CVE-2024-26958)
kernel: SUNRPC: fix some memleaks in gssx_dec_option_array (CVE-2024-27388)
kernel: wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (CVE-2024-27434)
kernel: of: Fix double free in of_parse_phandle_with_args_map (CVE-2023-52679)
kernel: scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (CVE-2024-35930)
kernel: wifi: iwlwifi: mvm: rfi: fix potential response leaks (CVE-2024-35912)
kernel: block: prevent division by zero in blk_rq_stat_sum() (CVE-2024-35925)
kernel: wifi: ath11k: decrease MHI channel buffer length to 8KB (CVE-2024-35938)
kernel: wifi: cfg80211: check A-MSDU format more carefully (CVE-2024-35937)
kernel: wifi: rtw89: fix null pointer access when abort scan (CVE-2024-35946)
kernel: netfilter: nf_tables: honor table dormant flag from netdev release event path (CVE-2024-36005)
kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (CVE-2024-36000)
kernel: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (CVE-2024-36006)
kernel: net: ieee802154: fix null deref in parse dev addr (CVE-2021-47257)
kernel: mmc: sdio: fix possible resource leaks in some error paths (CVE-2023-52730)
kernel: wifi: ath11k: fix gtk offload status event locking (CVE-2023-52777)
(CVE-2023-52832)
(CVE-2023-52803)
(CVE-2023-52756)
(CVE-2023-52834)
(CVE-2023-52791)
(CVE-2023-52764)
(CVE-2021-47468)
(CVE-2021-47284)
(CVE-2024-36025)
(CVE-2024-36941)
(CVE-2024-36940)
(CVE-2024-36904)
(CVE-2024-36896)
(CVE-2024-36954)
(CVE-2024-36950)
(CVE-2024-38575)
(CVE-2024-36917)
(CVE-2024-36016)
(CVE-2023-52762)
(CVE-2024-27025)
(CVE-2021-47548)
(CVE-2023-52619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

Record: ALSA-2024:5102
Updated: 2026-11-02

OSVCLSA-2026-1783791447 No score

kernel: Fix of 307 CVEs

gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully {CVE-2022-48660}
ipv4: check for NULL idev in ip_route_use_hint() {CVE-2024-36008}
KEYS: trusted: Do not use WARN when encode fails {CVE-2024-36975}
Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027}
xhci: Fix null pointer dereference when host dies {CVE-2023-52898}
sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
blk-mq: fix IO hang from sbitmap wakeup race {CVE-2024-26671}
net: openvswitch: fix flow memory leak in ovs_flow_cmd_new {CVE-2023-52977}
gpiolib: fix memory leak in gpiochip_setup_dev() {CVE-2022-48975}
HID: betop: check shape of output reports {CVE-2023-53015}
mm/swapfile: add cond_resched() in get_swap_pages() {CVE-2023-52932}
HV: hv_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-52937}
drm/i915: Fix a memory leak with reused mmap_offset {CVE-2023-53002}
ptdma: pt_core_execute_cmd() should use spinlock {CVE-2023-53013}
RDMA/core: Fix ib block iterator counter overflow {CVE-2023-53026}
Bluetooth: hci_conn: Fix memory leaks {CVE-2023-53018}
scsi: target: pscsi: Fix bio_put() for error case {CVE-2024-26760}
sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}
ALSA: hda/cs8409: Fix possible NULL dereference {CVE-2024-50160}
nbd: don't allow reconnect after disconnect {CVE-2025-21731}
openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}
net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping {CVE-2025-40121}
i40e: Fix macvlan leak by synchronizing access to mac_filter_hash {CVE-2024-50041}
net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() {CVE-2024-50000}
bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}
xsk: check IFF_UP earlier in Tx path {CVE-2023-53240}
firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
virtgpu: don't reset on shutdown {CVE-2025-38064}
xen/netfront: fix crash when removing device {CVE-2022-48969}
mptcp: do not fallback when OoO is present {CVE-2024-50185}
can: j1939: add missing calls in NETDEV_UNREGISTER notification handler {CVE-2025-39925}
netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160}
xfs: fix use-after-free in xattr node block inactivation {CVE-2026-43053}
ext4: fix racy may inline data check in dio write {CVE-2023-52786}
drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini {CVE-2023-52738}
macsec: fix UAF bug for real_dev {CVE-2022-49390}
drm/i915/gem: Fix Virtual Memory mapping boundaries calculation {CVE-2024-42259}
mm/shmem: disable PMD-sized page cache if needed {CVE-2024-42241}
driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
udmabuf: fix memory leak on last export_udmabuf() error path {CVE-2024-56712}
ALSA: control: Avoid WARN() for symlink errors {CVE-2024-56657}
mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM {CVE-2024-56611}
eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}
net: annotate data-races around sk->sk_{data_ready,write_space} {CVE-2026-23302}
udmabuf: change folios array from kmalloc to kvmalloc {CVE-2024-56544}
RDMA/mlx5: Move events notifier registration to be after device registration {CVE-2024-53224}
dlm: fix possible lkb_resource…

Record: CLSA-2026-1783791447
Updated: 2026-11-02

OSV No score

net: bridge: switchdev: Skip MDB replays of deferred events on offload

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: switchdev: Skip MDB replays of deferred events on offload

Before this change, generation of the list of MDB events to replay would race against the creation of new group memberships, either from the IGMP/MLD snooping logic or from user configuration.

For example, on an mv88e6xxx system, create a snooping bridge and immediately add a port to it:

root@infix-06-0b-00:~$ ip link add dev br0 up type bridge mcast_snooping 1 && \
> ip link set dev x3 up master br0

And then destroy the bridge:

root@infix-06-0b-00:~$ ip link del dev br0
root@infix-06-0b-00:~$ mvls atu
ADDRESS             FID  STATE      Q  F  0  1  2  3  4  5  6  7  8  9  a
DEV:0 Marvell 88E6393X
33:33:00:00:00:6a     1  static     -  -  0  .  .  .  .  .  .  .  .  .  .
33:33:ff:87:e4:3f     1  static     -  -  0  .  .  .  .  .  .  .  .  .  .
ff:ff:ff:ff:ff:ff     1  static     -  -  0  1  2  3  4  5  6  7  8  9  a
root@infix-06-0b-00:~$

Then add the same port (or another port belonging to the same hardware domain) to a new bridge, this time with snooping disabled:

root@infix-06-0b-00:~$ ip link add dev br1 up type bridge mcast_snooping 0 && \
> ip link set dev x3 up master br1

Eliminate the race in two steps:

Grab the write-side lock of the MDB while generating the replay list.

Make sure that no deferred version of a replay event is already enqueued to the switchdev deferred queue, before adding it to the replay list, when replaying additions.

Record: CVE-2024-26837
Updated: 2026-11-02

OSVRLSA-2024:5101 No score

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: powerpc: Fix access beyond end of drmem array (CVE-2023-52451)
kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463)
kernel: tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)
kernel: ext4: avoid online resizing failures due to oversized flex bg (CVE-2023-52622)
kernel: net/sched: flower: Fix chain template offload (CVE-2024-26669)
kernel: stmmac: Clear variable when destroying workqueue (CVE-2024-26802)
kernel: efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843)
kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878)
kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886)
kernel: SUNRPC: fix a memleak in gss_import_v2_context (CVE-2023-52653)
kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application (CVE-2024-21823)
kernel: Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (CVE-2023-52658)
kernel: ext4: fix corruption during on-line resize (CVE-2024-35807)
kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (CVE-2024-35801)
kernel: dyndbg: fix old BUG_ON in >control parser (CVE-2024-35947)
kernel: net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893)
kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (CVE-2024-35876)
kernel: platform/x86: wmi: Fix opening of char device (CVE-2023-52864)
kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (CVE-2023-52845)
(CVE-2023-28746)
(CVE-2023-52847)
(CVE-2021-47548)
(CVE-2024-36921)
(CVE-2024-26921)
(CVE-2021-47579)
(CVE-2024-36927)
(CVE-2024-39276)
(CVE-2024-33621)
(CVE-2024-27010)
(CVE-2024-26960)
(CVE-2024-38596)
(CVE-2022-48743)
(CVE-2024-26733)
(CVE-2024-26586)
(CVE-2024-26698)
(CVE-2023-52619)

Bug Fix(es):

Rocky Linux8.6 - Spinlock statistics may show negative elapsed time and incorrectly formatted output (JIRA:Rocky Linux-17678)
[AWS][8.9]There are call traces found when booting debug-kernel for Amazon EC2 r8g.metal-24xl instance (JIRA:Rocky Linux-23841)
[rhel8] gfs2: Fix glock shrinker (JIRA:Rocky Linux-32941)
lan78xx: Microchip LAN7800 never comes up after unplug and replug (JIRA:Rocky Linux-33437)
[Hyper-V][Rocky Linux-8.10.z] Update hv_netvsc driver to TOT (JIRA:Rocky Linux-39074)
Use-after-free on proc inode-i_sb triggered by fsnotify (JIRA:Rocky Linux-40167)
blk-cgroup: Properly propagate the iostat update up the hierarchy [rhel-8.10.z] (JIRA:Rocky Linux-40939)
(JIRA:Rocky Linux-31798)
(JIRA:Rocky Linux-10263)
(JIRA:Rocky Linux-40901)
(JIRA:Rocky Linux-43547)
(JIRA:Rocky Linux-34876)

Enhancement(s):

[RFE] Add module parameters 'soft_reboot_cmd' and 'soft_active_on_boot' for customizing softdog configuration (JIRA:Rocky Linux-19723)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

Record: RLSA-2024:5101
Updated: 2026-11-02

OSVRLSA-2024:5102 No score

Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463)
kernel: tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)
kernel: ext4: avoid online resizing failures due to oversized flex bg (CVE-2023-52622)
kernel: net/sched: flower: Fix chain template offload (CVE-2024-26669)
kernel: stmmac: Clear variable when destroying workqueue (CVE-2024-26802)
kernel: efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843)
kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878)
kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886)
kernel: SUNRPC: fix a memleak in gss_import_v2_context (CVE-2023-52653)
kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application (CVE-2024-21823)
kernel: ext4: fix corruption during on-line resize (CVE-2024-35807)
kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (CVE-2024-35801)
kernel: dyndbg: fix old BUG_ON in >control parser (CVE-2024-35947)
kernel: net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893)
kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (CVE-2024-35876)
kernel: platform/x86: wmi: Fix opening of char device (CVE-2023-52864)
kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (CVE-2023-52845)
kernel: Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (CVE-2023-52658)
kernel: crash due to a missing check for leb_size (CVE-2024-25739)
kernel: tcp: make sure init the accept_queue's spinlocks once (CVE-2024-26614)
kernel: tcp: add sanity checks to rx zerocopy (CVE-2024-26640)
kernel: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (CVE-2024-26870)
kernel: nfs: fix UAF in direct writes (CVE-2024-26958)
kernel: SUNRPC: fix some memleaks in gssx_dec_option_array (CVE-2024-27388)
kernel: wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (CVE-2024-27434)
kernel: of: Fix double free in of_parse_phandle_with_args_map (CVE-2023-52679)
kernel: scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (CVE-2024-35930)
kernel: wifi: iwlwifi: mvm: rfi: fix potential response leaks (CVE-2024-35912)
kernel: block: prevent division by zero in blk_rq_stat_sum() (CVE-2024-35925)
kernel: wifi: ath11k: decrease MHI channel buffer length to 8KB (CVE-2024-35938)
kernel: wifi: cfg80211: check A-MSDU format more carefully (CVE-2024-35937)
kernel: wifi: rtw89: fix null pointer access when abort scan (CVE-2024-35946)
kernel: netfilter: nf_tables: honor table dormant flag from netdev release event path (CVE-2024-36005)
kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (CVE-2024-36000)
kernel: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (CVE-2024-36006)
kernel: net: ieee802154: fix null deref in parse dev addr (CVE-2021-47257)
kernel: mmc: sdio: fix possible resource leaks in some error paths (CVE-2023-52730)
kernel: wifi: ath11k: fix gtk offload status event locking (CVE-2023-52777)
(CVE-2023-52832)
(CVE-2023-52803)
(CVE-2023-52756)
(CVE-2023-52834)
(CVE-2023-52791)
(CVE-2023-52764)
(CVE-2021-47468)
(CVE-2021-47284)
(CVE-2024-36025)
(CVE-2024-36941)
(CVE-2024-36940)
(CVE-2024-36904)
(CVE-2024-36896)
(CVE-2024-36954)
(CVE-2024-36950)
(CVE-2024-38575)
(CVE-2024-36917)
(CVE-2024-36016)
(CVE-2023-52762)
(CVE-2024-27025)
(CVE-2021-47548)
(CVE-2023-52619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

Record: RLSA-2024:5102
Updated: 2026-11-02

OSVRXSA-2024:5101 No score

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: powerpc: Fix access beyond end of drmem array (CVE-2023-52451)
kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463)
kernel: tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)
kernel: ext4: avoid online resizing failures due to oversized flex bg (CVE-2023-52622)
kernel: net/sched: flower: Fix chain template offload (CVE-2024-26669)
kernel: stmmac: Clear variable when destroying workqueue (CVE-2024-26802)
kernel: efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843)
kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878)
kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886)
kernel: SUNRPC: fix a memleak in gss_import_v2_context (CVE-2023-52653)
kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application (CVE-2024-21823)
kernel: Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (CVE-2023-52658)
kernel: ext4: fix corruption during on-line resize (CVE-2024-35807)
kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (CVE-2024-35801)
kernel: dyndbg: fix old BUG_ON in >control parser (CVE-2024-35947)
kernel: net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893)
kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (CVE-2024-35876)
kernel: platform/x86: wmi: Fix opening of char device (CVE-2023-52864)
kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (CVE-2023-52845)
(CVE-2023-28746)
(CVE-2023-52847)
(CVE-2021-47548)
(CVE-2024-36921)
(CVE-2024-26921)
(CVE-2021-47579)
(CVE-2024-36927)
(CVE-2024-39276)
(CVE-2024-33621)
(CVE-2024-27010)
(CVE-2024-26960)
(CVE-2024-38596)
(CVE-2022-48743)
(CVE-2024-26733)
(CVE-2024-26586)
(CVE-2024-26698)
(CVE-2023-52619)

Bug Fix(es):

Rocky Linux SIG Cloud8.6 - Spinlock statistics may show negative elapsed time and incorrectly formatted output (JIRA:Rocky Linux SIG Cloud-17678)
[AWS][8.9]There are call traces found when booting debug-kernel for Amazon EC2 r8g.metal-24xl instance (JIRA:Rocky Linux SIG Cloud-23841)
[rhel8] gfs2: Fix glock shrinker (JIRA:Rocky Linux SIG Cloud-32941)
lan78xx: Microchip LAN7800 never comes up after unplug and replug (JIRA:Rocky Linux SIG Cloud-33437)
[Hyper-V][Rocky Linux SIG Cloud-8.10.z] Update hv_netvsc driver to TOT (JIRA:Rocky Linux SIG Cloud-39074)
Use-after-free on proc inode-i_sb triggered by fsnotify (JIRA:Rocky Linux SIG Cloud-40167)
blk-cgroup: Properly propagate the iostat update up the hierarchy [rhel-8.10.z] (JIRA:Rocky Linux SIG Cloud-40939)
(JIRA:Rocky Linux SIG Cloud-31798)
(JIRA:Rocky Linux SIG Cloud-10263)
(JIRA:Rocky Linux SIG Cloud-40901)
(JIRA:Rocky Linux SIG Cloud-43547)
(JIRA:Rocky Linux SIG Cloud-34876)

Enhancement(s):

[RFE] Add module parameters 'soft_reboot_cmd' and 'soft_active_on_boot' for customizing softdog configuration (JIRA:Rocky Linux SIG Cloud-19723)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

Record: RXSA-2024:5101
Updated: 2026-11-02

OSVSUSE-SU-2024:3194-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
CVE-2024-43911: Fix NULL dereference at band check in starting tx ba session (bsc#1229827).
CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
CVE-2024-36270: Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (bsc#1226798)
CVE-2024-36881: Reset ptes when close() for wr-protected ones (bsc#1225718).
CVE-2024-42316: Fix div-by-zero in vmpressure_calc_level() (bsc#1229353).
CVE-2024-43855: Fix deadlock between mddev_suspend and flush bio (bsc#1229342,).
CVE-2024-43864: Fix CT entry update leaks of modify header context (bsc#1229496)
CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
CVE-2024-42109: Unconditionally flush pending work before notifier (bsc#1228505)
CVE-2024-41084: Avoid null pointer dereference in region lookup (bsc#1228472)
CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
CVE-2024-27079: Add kABI workaround patch (bsc#1223742).
CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26809: Release elements in clone only from destroy path (bsc#1222633).
CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).
CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).
CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).
CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).
CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)
CVE-2024-27433: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
CVE-2024-40920: Fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
CVE-2024-40921: Pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
CVE-2024-36979: Fix vlan use-after-free (bsc#1226604).
CVE-2024-26590: Fix inconsistent per-file compression format (bsc#1220252,).
CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).
CVE-2024-42270: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404)
CVE-2024-42269: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402)
CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383) -…

Record: SUSE-SU-2024:3194-1
Updated: 2026-11-02

OSVSUSE-SU-2024:3195-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
CVE-2024-43911: Fix NULL dereference at band check in starting tx ba session (bsc#1229827).
CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
CVE-2024-36881: Fix reset ptes when close() for wr-protected (bsc#1225718).
CVE-2024-42316: Fix div-by-zero in vmpressure_calc_level() (bsc#1229353).
CVE-2024-43855: Fix deadlock between mddev_suspend and flush bio (bsc#1229342).
CVE-2024-43864: Fix CT entry update leaks of modify header context (bsc#1229496).
CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
CVE-2024-42109: Unconditionally flush pending work before notifier (bsc#1228505).
CVE-2024-41084: Avoid null pointer dereference in region lookup (bsc#1228472).
CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
CVE-2024-27079: Fix NULL domain on device release (bsc#1223742).
CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26809: Release elements in clone only from destroy path (bsc#1222633).
CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).
CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).
CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).
CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).
CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)
CVE-2024-27433: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
CVE-2024-40920: Fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
CVE-2024-40921: Pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
CVE-2024-36979: Fix vlan use-after-free (bsc#1226604).
CVE-2024-26590: Fix inconsistent per-file compression format (bsc#1220252).
CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).
CVE-2024-42270: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404).
CVE-2024-42269: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402).
CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383)
CVE-2024-42312: Always initialize i_uid/i_gid (bsc#1229357)
CVE-2024-43854: Initialize integrity buffer to zero…

Record: SUSE-SU-2024:3195-1
Updated: 2026-11-02

OSVSUSE-SU-2024:3383-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-43911: wifi: mac80211: fix NULL dereference at band check in starting tx ba session (bsc#1229827).
CVE-2024-43899: drm/amd/display: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
CVE-2024-43880: kabi: lib: objagg: Put back removed metod in struct objagg_ops (bsc#1229481).
CVE-2024-43866: net/mlx5: Always drain health in shutdown callback (bsc#1229495).
CVE-2024-43864: net/mlx5e: Fix CT entry update leaks of modify header context (bsc#1229496).
CVE-2024-43855: md: fix deadlock between mddev_suspend and flush bio (bsc#1229342).
CVE-2024-43854: block: initialize integrity buffer to zero before writing it to media (bsc#1229345)
CVE-2024-43850: soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove (bsc#1229316).
CVE-2024-43839: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).
CVE-2024-43837: bpf: Fix updating attached freplace prog in prog_array map (bsc#1229297).
CVE-2024-43834: xdp: fix invalid wait context of page_pool_destroy() (bsc#1229314)
CVE-2024-43831: media: mediatek: vcodec: Handle invalid decoder vsi (bsc#1229309).
CVE-2024-43821: scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315).
CVE-2024-42322: ipvs: properly dereference pe in ip_vs_add_service (bsc#1229347)
CVE-2024-42318: landlock: Do not lose track of restrictions on cred_transfer (bsc#1229351).
CVE-2024-42316: mm/mglru: fix div-by-zero in vmpressure_calc_level() (bsc#1229353).
CVE-2024-42312: sysctl: always initialize i_uid/i_gid (bsc#1229357)
CVE-2024-42308: Update DRM patch reference (bsc#1229411)
CVE-2024-42301: dev/parport: fix the array out-of-bounds risk (bsc#1229407).
CVE-2024-42295: nilfs2: handle inconsistent state in nilfs_btnode_create_block() (bsc#1229370).
CVE-2024-42291: ice: Add a per-VF limit on number of FDIR filters (bsc#1229374).
CVE-2024-42290: irqchip/imx-irqsteer: Handle runtime power management correctly (bsc#1229379).
CVE-2024-42284: tipc: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
CVE-2024-42283: net: nexthop: Initialize all fields in dumped nexthops (bsc#1229383)
CVE-2024-42281: bpf: Fix a segment issue when downgrading gso_size (bsc#1229386).
CVE-2024-42277: iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
CVE-2024-42270: netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404).
CVE-2024-42269: netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402).
CVE-2024-42268: net/mlx5: Fix missing lock on sync reset reload (bsc#1229391).
CVE-2024-42247: wireguard: allowedips: avoid unaligned 64-bit memory accesses (bsc#1228988).
CVE-2024-42246: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).
CVE-2024-42245: Revert 'sched/fair: Make sure to try to detach at least one movable task' (bsc#1228978).
CVE-2024-42241: mm/shmem: disable PMD-sized page cache if needed (bsc#1228986).
CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list (bsc#1228723).
CVE-2024-42162: gve: Account for stopped queues when reading NIC stats (bsc#1228706).
CVE-2024-42161: bpf: avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756).
CVE-2024-42159: scsi: mpi3mr: fix sanitise num_phys (bsc#1228754).
CVE-2024-42158: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
CVE-2024-42157: s390/pkey: Wipe sensitive data on failure (bsc#1228727).
CVE-2024-42156: s390/pkey: Wipe copies of clear-key structures on failure (bsc#1228722).
CVE-2024-42155: s390/pkey: Wipe copies of protected- and secure-keys (bsc#1228733).
CVE-2024-42148: bnx2x: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).
CVE-2024-42145:…

Record: SUSE-SU-2024:3383-1
Updated: 2026-11-02

OSVSUSE-SU-2024:3569-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2022-48901: btrfs: do not start relocation until in progress drops are done (bsc#1229607).
CVE-2022-48911: kabi: add __nf_queue_get_refs() for kabi compliance. (bsc#1229633).
CVE-2022-48923: btrfs: prevent copying too big compressed lzo segment (bsc#1229662)
CVE-2022-48935: Fixed an unregister flowtable hooks on netns exit (bsc#1229619)
CVE-2023-52610: net/sched: act_ct: fix skb leak and crash on ooo frags (bsc#1221610).
CVE-2023-52916: media: aspeed: Fix memory overwrite if timing is 1600x900 (bsc#1230269).
CVE-2024-26640: tcp: add sanity checks to rx zerocopy (bsc#1221650).
CVE-2024-26759: mm/swap: fix race when skipping swapcache (bsc#1230340).
CVE-2024-26767: drm/amd/display: fixed integer types and null check locations (bsc#1230339).
CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).
CVE-2024-26837: net: bridge: switchdev: race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).
CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).
CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).
CVE-2024-38596: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (bsc#1226846).
CVE-2024-40910: Fix refcount imbalance on inbound connections (bsc#1227832).
CVE-2024-40973: media: mtk-vcodec: potential null pointer deference in SCP (bsc#1227890).
CVE-2024-40983: tipc: force a dst refcount before doing decryption (bsc#1227819).
CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620 CVE-2024-41082).
CVE-2024-42154: tcp_metrics: validate source addr length (bsc#1228507).
CVE-2024-42259: Fix Virtual Memory mapping boundaries calculation (bsc#1229156)
CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
CVE-2024-42304: ext4: make sure the first directory block is not a hole (bsc#1229364).
CVE-2024-42305: ext4: check dot and dotdot of dx_root before making dir indexed (bsc#1229363).
CVE-2024-42306: udf: Avoid using corrupted block bitmap buffer (bsc#1229362).
CVE-2024-43828: ext4: fix infinite loop when replaying fast_commit (bsc#1229394).
CVE-2024-43890: tracing: Fix overflow in get_free_elt() (bsc#1229764).
CVE-2024-43898: ext4: sanity check for NULL pointer after ext4_force_shutdown (bsc#1229753).
CVE-2024-43912: wifi: nl80211: disallow setting special AP channel widths (bsc#1229830)
CVE-2024-43914: md/raid5: avoid BUG_ON() while continue reshape after reassembling (bsc#1229790).
CVE-2024-44935: sctp: Fix null-ptr-deref in reuseport_add_sock() (bsc#1229810).
CVE-2024-44944: netfilter: ctnetlink: use helper function to calculate expect ID (bsc#1229899).
CVE-2024-44946: kcm: Serialise kcm_sendmsg() for the same socket (bsc#1230015).
CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set (bsc#1230180).
CVE-2024-44952: driver core: Fix uevent_show() vs driver detach race (bsc#1230178).
CVE-2024-44970: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (bsc#1230209).
CVE-2024-44971: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() (bsc#1230211).
CVE-2024-44986: ipv6: fix possible UAF in ip6_finish_output2() (bsc#1230230)
CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
CVE-2024-44988: net: dsa: mv88e6xxx: Fix out-of-bound access (bsc#1230192).
CVE-2024-44989: bonding: fix xfrm real_dev null pointer dereference (bsc#1230193).
CVE-2024-44990: bonding: fix null pointer deref in bond_ipsec_offload_ok (bsc#1230194).
CVE-2024-44998: atm: idt77252: prevent use after free in dequeue_rx() (bsc#1230171).
CVE-2024-44999: gtp: pull network headers in gtp_dev_xmit()…

Record: SUSE-SU-2024:3569-1
Updated: 2026-11-02

OSVSUSE-SU-2024:3587-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2022-48901: btrfs: do not start relocation until in progress drops are done (bsc#1229607).
CVE-2022-48911: kabi: add __nf_queue_get_refs() for kabi compliance. (bsc#1229633).
CVE-2022-48923: btrfs: prevent copying too big compressed lzo segment (bsc#1229662)
CVE-2022-48935: Fixed an unregister flowtable hooks on netns exit (bsc#1229619)
CVE-2023-52610: net/sched: act_ct: fix skb leak and crash on ooo frags (bsc#1221610).
CVE-2023-52916: media: aspeed: Fix memory overwrite if timing is 1600x900 (bsc#1230269).
CVE-2024-26640: tcp: add sanity checks to rx zerocopy (bsc#1221650).
CVE-2024-26759: mm/swap: fix race when skipping swapcache (bsc#1230340).
CVE-2024-26767: drm/amd/display: fixed integer types and null check locations (bsc#1230339).
CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).
CVE-2024-26837: net: bridge: switchdev: race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).
CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).
CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).
CVE-2024-38596: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (bsc#1226846).
CVE-2024-40910: Fix refcount imbalance on inbound connections (bsc#1227832).
CVE-2024-40973: media: mtk-vcodec: potential null pointer deference in SCP (bsc#1227890).
CVE-2024-40983: tipc: force a dst refcount before doing decryption (bsc#1227819).
CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620 CVE-2024-41082).
CVE-2024-42154: tcp_metrics: validate source addr length (bsc#1228507).
CVE-2024-42259: Fix Virtual Memory mapping boundaries calculation (bsc#1229156)
CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
CVE-2024-42304: ext4: make sure the first directory block is not a hole (bsc#1229364).
CVE-2024-42305: ext4: check dot and dotdot of dx_root before making dir indexed (bsc#1229363).
CVE-2024-42306: udf: Avoid using corrupted block bitmap buffer (bsc#1229362).
CVE-2024-43828: ext4: fix infinite loop when replaying fast_commit (bsc#1229394).
CVE-2024-43890: tracing: Fix overflow in get_free_elt() (bsc#1229764).
CVE-2024-43898: ext4: sanity check for NULL pointer after ext4_force_shutdown (bsc#1229753).
CVE-2024-43912: wifi: nl80211: disallow setting special AP channel widths (bsc#1229830)
CVE-2024-43914: md/raid5: avoid BUG_ON() while continue reshape after reassembling (bsc#1229790).
CVE-2024-44935: sctp: Fix null-ptr-deref in reuseport_add_sock() (bsc#1229810).
CVE-2024-44944: netfilter: ctnetlink: use helper function to calculate expect ID (bsc#1229899).
CVE-2024-44946: kcm: Serialise kcm_sendmsg() for the same socket (bsc#1230015).
CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set (bsc#1230180).
CVE-2024-44952: driver core: Fix uevent_show() vs driver detach race (bsc#1230178).
CVE-2024-44970: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (bsc#1230209).
CVE-2024-44971: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() (bsc#1230211).
CVE-2024-44986: ipv6: fix possible UAF in ip6_finish_output2() (bsc#1230230)
CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
CVE-2024-44988: net: dsa: mv88e6xxx: Fix out-of-bound access (bsc#1230192).
CVE-2024-44989: bonding: fix xfrm real_dev null pointer dereference (bsc#1230193).
CVE-2024-44990: bonding: fix null pointer deref in bond_ipsec_offload_ok (bsc#1230194).
CVE-2024-44998: atm: idt77252: prevent use after free in dequeue_rx() (bsc#1230171).
CVE-2024-44999: gtp: pull network headers in…

Record: SUSE-SU-2024:3587-1
Updated: 2026-11-02

OSVSUSE-SU-2024:3592-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2022-48901: btrfs: do not start relocation until in progress drops are done (bsc#1229607).
CVE-2022-48911: kabi: add __nf_queue_get_refs() for kabi compliance. (bsc#1229633).
CVE-2022-48923: btrfs: prevent copying too big compressed lzo segment (bsc#1229662)
CVE-2022-48935: Fixed an unregister flowtable hooks on netns exit (bsc#1229619)
CVE-2023-52610: net/sched: act_ct: fix skb leak and crash on ooo frags (bsc#1221610).
CVE-2023-52916: media: aspeed: Fix memory overwrite if timing is 1600x900 (bsc#1230269).
CVE-2024-26640: tcp: add sanity checks to rx zerocopy (bsc#1221650).
CVE-2024-26759: mm/swap: fix race when skipping swapcache (bsc#1230340).
CVE-2024-26767: drm/amd/display: fixed integer types and null check locations (bsc#1230339).
CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).
CVE-2024-26837: net: bridge: switchdev: race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).
CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).
CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).
CVE-2024-38596: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (bsc#1226846).
CVE-2024-40910: Fix refcount imbalance on inbound connections (bsc#1227832).
CVE-2024-40973: media: mtk-vcodec: potential null pointer deference in SCP (bsc#1227890).
CVE-2024-40983: tipc: force a dst refcount before doing decryption (bsc#1227819).
CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620 CVE-2024-41082).
CVE-2024-42154: tcp_metrics: validate source addr length (bsc#1228507).
CVE-2024-42259: Fix Virtual Memory mapping boundaries calculation (bsc#1229156)
CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
CVE-2024-42304: ext4: make sure the first directory block is not a hole (bsc#1229364).
CVE-2024-42305: ext4: check dot and dotdot of dx_root before making dir indexed (bsc#1229363).
CVE-2024-42306: udf: Avoid using corrupted block bitmap buffer (bsc#1229362).
CVE-2024-43828: ext4: fix infinite loop when replaying fast_commit (bsc#1229394).
CVE-2024-43890: tracing: Fix overflow in get_free_elt() (bsc#1229764).
CVE-2024-43898: ext4: sanity check for NULL pointer after ext4_force_shutdown (bsc#1229753).
CVE-2024-43912: wifi: nl80211: disallow setting special AP channel widths (bsc#1229830)
CVE-2024-43914: md/raid5: avoid BUG_ON() while continue reshape after reassembling (bsc#1229790).
CVE-2024-44935: sctp: Fix null-ptr-deref in reuseport_add_sock() (bsc#1229810).
CVE-2024-44944: netfilter: ctnetlink: use helper function to calculate expect ID (bsc#1229899).
CVE-2024-44946: kcm: Serialise kcm_sendmsg() for the same socket (bsc#1230015).
CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set (bsc#1230180).
CVE-2024-44952: driver core: Fix uevent_show() vs driver detach race (bsc#1230178).
CVE-2024-44954: ALSA: line6: Fix racy access to midibuf (bsc#1230176).
CVE-2024-44970: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (bsc#1230209).
CVE-2024-44971: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() (bsc#1230211).
CVE-2024-44986: ipv6: fix possible UAF in ip6_finish_output2() (bsc#1230230)
CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
CVE-2024-44988: net: dsa: mv88e6xxx: Fix out-of-bound access (bsc#1230192).
CVE-2024-44989: bonding: fix xfrm real_dev null pointer dereference (bsc#1230193).
CVE-2024-44990: bonding: fix null pointer deref in bond_ipsec_offload_ok (bsc#1230194).
CVE-2024-44998: atm: idt77252: prevent use after free in dequeue_rx()…

Record: SUSE-SU-2024:3592-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20044-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 kernel was updated to receive various security bugfixes.

This release includes the first live patch.

The following security bugs were fixed:

CVE-2023-52489: mm/sparsemem: fix race in accessing memory_section->usage (bsc#1221326).
CVE-2023-52581: netfilter: nf_tables: fix memleak when more than 255 elements expired (bsc#1220877).
CVE-2023-52859: perf: hisi: Fix use-after-free when register pmu fails (bsc#1225582).
CVE-2023-52889: apparmor: Fix null pointer deref when receiving skb during sock creation (bsc#1229287,).
CVE-2024-26590: erofs: fix inconsistent per-file compression format (bsc#1220252).
CVE-2024-26631: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
CVE-2024-26668: netfilter: nft_limit: reject configurations that cause integer overflow (bsc#1222335).
CVE-2024-26669: kABI fix for net/sched: flower: Fix chain template offload (bsc#1222350).
CVE-2024-26677: blacklist.conf: Add e7870cf13d20 ("rxrpc: Fix delayed ACKs to not set the reference serial number") (bsc#1222387)
CVE-2024-26735: ipv6: sr: fix possible use-after-free and null-ptr-deref (bsc#1222372).
CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26809: netfilter: nft_set_pipapo: release elements in clone only from destroy path (bsc#1222633).
CVE-2024-26812: kABI: vfio: struct virqfd kABI workaround (bsc#1222808).
CVE-2024-26835: netfilter: nf_tables: set dormant flag on hook register failure (bsc#1222967).
CVE-2024-26837: net: bridge: switchdev: Skip MDB replays of deferred events on offload (bsc#1222973).
CVE-2024-26851: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (bsc#1223074)
CVE-2024-27010: net/sched: Fix mirred deadlock on device recursion (bsc#1223720).
CVE-2024-27011: netfilter: nf_tables: fix memleak in map from abort path (bsc#1223803).
CVE-2024-27024: net/rds: fix WARNING in rds_conn_connect_if_down (bsc#1223777).
CVE-2024-27079: iommu/vt-d: Fix NULL domain on device release (bsc#1223742).
CVE-2024-27403: kabi: restore const specifier in flow_offload_route_init() (bsc#1224415).
CVE-2024-27433: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
CVE-2024-35897: netfilter: nf_tables: discard table flag update with pending basechain deletion (bsc#1224510).
CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
CVE-2024-36286: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
CVE-2024-36489: tls: fix missing memory barrier in tls_init (bsc#1226874)
CVE-2024-36881: mm/userfaultfd: reset ptes when close() for wr-protected ones (bsc#1225718).
CVE-2024-36929: net: core: reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).
CVE-2024-36933: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).
CVE-2024-36979: net: bridge: mst: fix vlan use-after-free syzbot reported a suspicious rcu usage[1] in bridge's mst code. (bsc#1226604).
CVE-2024-38662: selftests/bpf: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
CVE-2024-39489: ipv6: sr: fix memleak in seg6_hmac_init_algo (bsc#1227623)
CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).
CVE-2024-40905: ipv6: fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
CVE-2024-40909: bpf: Fix a potential use-after-free in bpf_link_free() (bsc#1227798).
CVE-2024-40920: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
CVE-2024-40921: net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
CVE-2024-40938: landlock: fix d_parent…

Record: SUSE-SU-2025:20044-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20047-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52489: mm/sparsemem: fix race in accessing memory_section->usage (bsc#1221326).
CVE-2023-52581: netfilter: nf_tables: fix memleak when more than 255 elements expired (bsc#1220877).
CVE-2023-52859: perf: hisi: Fix use-after-free when register pmu fails (bsc#1225582).
CVE-2023-52889: apparmor: Fix null pointer deref when receiving skb during sock creation (bsc#1229287).
CVE-2024-26590: erofs: fix inconsistent per-file compression format (bsc#1220252).
CVE-2024-26631: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
CVE-2024-26668: netfilter: nft_limit: reject configurations that cause integer overflow (bsc#1222335).
CVE-2024-26669: kABI fix for net/sched: flower: Fix chain template offload (bsc#1222350).
CVE-2024-26677: Blacklist e7870cf13d20 (" Fix delayed ACKs to not set the reference serial number") (bsc#1222387)
CVE-2024-26735: ipv6: sr: fix possible use-after-free and null-ptr-deref (bsc#1222372).
CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26809: netfilter: nft_set_pipapo: release elements in clone only from destroy path (bsc#1222633).
CVE-2024-26812: kABI: vfio: struct virqfd kABI workaround (bsc#1222808).
CVE-2024-26835: netfilter: nf_tables: set dormant flag on hook register failure (bsc#1222967).
CVE-2024-26837: net: bridge: switchdev: race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).
CVE-2024-26851: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (bsc#1223074)
CVE-2024-27010: net/sched: Fix mirred deadlock on device recursion (bsc#1223720).
CVE-2024-27011: netfilter: nf_tables: fix memleak in map from abort path (bsc#1223803).
CVE-2024-27024: net/rds: fix WARNING in rds_conn_connect_if_down (bsc#1223777).
CVE-2024-27079: iommu/vt-d: Fix NULL domain on device release (bsc#1223742).
CVE-2024-27403: kabi: restore const specifier in flow_offload_route_init() (bsc#1224415).
CVE-2024-27433: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
CVE-2024-35897: netfilter: nf_tables: discard table flag update with pending basechain deletion (bsc#1224510).
CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
CVE-2024-36286: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
CVE-2024-36489: tls: fix missing memory barrier in tls_init (bsc#1226874)
CVE-2024-36881: mm/userfaultfd: Fix reset ptes when close() for wr-protected (bsc#1225718).
CVE-2024-36929: net: core: reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).
CVE-2024-36933: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).
CVE-2024-36979: net: bridge: mst: fix vlan use-after-free (bsc#1226604).
CVE-2024-38662: selftests/bpf: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
CVE-2024-39489: ipv6: sr: fix memleak in seg6_hmac_init_algo (bsc#1227623)
CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).
CVE-2024-40905: ipv6: fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
CVE-2024-40909: bpf: Fix a potential use-after-free in bpf_link_free() (bsc#1227798).
CVE-2024-40920: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
CVE-2024-40921: net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
CVE-2024-40938: landlock: fix d_parent walk (bsc#1227840).
CVE-2024-40939: net: wwan: iosm: Fix tainted…

Record: SUSE-SU-2025:20047-1
Updated: 2026-11-02

OSVUSN-7455-1 No score

linux, linux-aws, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-igx, linux-oracle, linux-raspi vulnerabilities

Jann Horn discovered that the watch_queue event notification subsystem in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or escalate their privileges. (CVE-2022-0995)