CVE-2024-26921

In the Linux kernel, the following vulnerability has been resolved: inet: inet_defrag: prevent sk release while still in use ip_local_out() and other functions can pass skb->sk as function argument. If the skb is a fragment and reassembly happens before such function call returns, the sk must not be released. This affects skb fragments reassembled via netfilter or similar modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline. Eric Dumazet made an initial analysis of this bug. Quoting Eric: Calling ip_defrag() in output path is also implying skb_orphan(), which is buggy because output path relies on sk not disappearing. A relevant old patch about the issue was : 8282f27449bf ("inet: frag: Always orphan skbs inside ip_defrag()") [..] net/ipv4/ip_output.c depends on skb->sk being set, and probably to an inet socket, not an arbitrary one. If we orphan the packet in ipvlan, then downstream things like FQ packet scheduler will not work properly. We need to change ip_defrag() to only use skb_orphan() when really needed, ie whenever frag_list is going to be used. Eric suggested to stash sk in fragment queue and made an initial patch. However there is a problem with this: If skb is refragmented again right after, ip_do_fragment() will copy head->sk to the new fragments, and sets up destructor to sock_wfree. IOW, we have no choice but to fix up sk_wmem accouting to reflect the fully reassembled skb, else wmem will underflow. This change moves the orphan down into the core, to last possible moment. As ip_defrag_offset is aliased with sk_buff->sk member, we must move the offset into the FRAG_CB, else skb->sk gets clobbered. This allows to delay the orphaning long enough to learn if the skb has to be queued or if the skb is completing the reasm queue. In the former case, things work as before, skb is orphaned. This is safe because skb gets queued/stolen and won't continue past reasm engine. In the latter case, we will steal the skb->sk reference, reattach it to the head skb, and fix up wmem accouting when inet_frag inflates truesize.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Harden accesses to the reset domains

Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations if the SCMI driver misbehave.

Add an internal consistency check before any such domains descriptors accesses.(CVE-2022-48655)

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix pcluster use-after-free on UP platforms

During stress testing with CONFIG_SMP disabled, KASAN reports as below:

================================================================== BUG: KASAN: use-after-free in __mutex_lock+0xe5/0xc30 Read of size 8 at addr ffff8881094223f8 by task stress/7789

CPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> .. __mutex_lock+0xe5/0xc30 .. z_erofs_do_read_page+0x8ce/0x1560 .. z_erofs_readahead+0x31c/0x580 .. Freed by task 7787 kasan_save_stack+0x1e/0x40 kasan_set_track+0x20/0x30 kasan_set_free_info+0x20/0x40 __kasan_slab_free+0x10c/0x190 kmem_cache_free+0xed/0x380 rcu_core+0x3d5/0xc90 __do_softirq+0x12d/0x389

Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x97/0xb0 call_rcu+0x3d/0x3f0 erofs_shrink_workstation+0x11f/0x210 erofs_shrink_scan+0xdc/0x170 shrink_slab.constprop.0+0x296/0x530 drop_slab+0x1c/0x70 drop_caches_sysctl_handler+0x70/0x80 proc_sys_call_handler+0x20a/0x2f0 vfs_write+0x555/0x6c0 ksys_write+0xbe/0x160 do_syscall_64+0x3b/0x90

The root cause is that erofs_workgroup_unfreeze() doesn't reset to orig_val thus it causes a race that the pcluster reuses unexpectedly before freeing.

Since UP platforms are quite rare now, such path becomes unnecessary. Let's drop such specific-designed path directly instead.(CVE-2022-48674)

In the Linux kernel, the following vulnerability has been resolved:

usb: hub: Guard against accesses to uninitialized BOS descriptors

Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h access fields inside udev->bos without checking if it was allocated and initialized. If usb_get_bos_descriptor() fails for whatever reason, udev->bos will be NULL and those accesses will result in a crash:

BUG: kernel NULL pointer dereference, address: 0000000000000018 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 <HASH:1f9e 1> Hardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:hub_port_reset+0x193/0x788 Code: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 <48> 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89 e9 RSP: 0018:ffffab740c53fcf8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffa1bc5f678000 RCX: 0000000000000310 RDX: fffffffffffffdff RSI: 0000000000000286 RDI: ffffa1be9655b840 RBP: ffffab740c53fd70 R08: 00001b7d5edaa20c R09: ffffffffb005e060 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffffab740c53fd3e R14: 0000000000000032 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffffa1be96540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 000000022e80c005 CR4: 00000000003706e0 Call Trace: hub_event+0x73f/0x156e ? hub_activate+0x5b7/0x68f process_one_work+0x1a2/0x487 worker_thread+0x11a/0x288 kthread+0x13a/0x152 ? process_one_work+0x487/0x487 ? kthread_associate_blkcg+0x70/0x70 ret_from_fork+0x1f/0x30

Fall back to a default behavior if the BOS descriptor isn't accessible and skip all the functionalities that depend on it: LPM support…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup

Fix Oops in dasd_alias_get_start_dev() function caused by the pavgroup pointer being NULL.

The pavgroup pointer is checked on the entrance of the function but without the lcu->lock being held. Therefore there is a race window between dasd_alias_get_start_dev() and _lcu_update() which sets pavgroup to NULL with the lcu->lock held.

Fix by checking the pavgroup pointer with lcu->lock held.(CVE-2022-48636)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix hang during unmount when stopping a space reclaim worker

Often when running generic/562 from fstests we can hang during unmount, resulting in a trace like this:

Sep 07 11:52:00 debian9 unknown: run fstests generic/562 at 2022-09-07 11:52:00 Sep 07 11:55:32 debian9 kernel: INFO: task umount:49438 blocked for more than 120 seconds. Sep 07 11:55:32 debian9 kernel: Not tainted 6.0.0-rc2-btrfs-next-122 #1 Sep 07 11:55:32 debian9 kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. Sep 07 11:55:32 debian9 kernel: task:umount state:D stack: 0 pid:49438 ppid: 25683 flags:0x00004000 Sep 07 11:55:32 debian9 kernel: Call Trace: Sep 07 11:55:32 debian9 kernel: <TASK> Sep 07 11:55:32 debian9 kernel: __schedule+0x3c8/0xec0 Sep 07 11:55:32 debian9 kernel: ? rcu_read_lock_sched_held+0x12/0x70 Sep 07 11:55:32 debian9 kernel: schedule+0x5d/0xf0 Sep 07 11:55:32 debian9 kernel: schedule_timeout+0xf1/0x130 Sep 07 11:55:32 debian9 kernel: ? lock_release+0x224/0x4a0 Sep 07 11:55:32 debian9 kernel: ? lock_acquired+0x1a0/0x420 Sep 07 11:55:32 debian9 kernel: ? trace_hardirqs_on+0x2c/0xd0 Sep 07 11:55:32 debian9 kernel: __wait_for_common+0xac/0x200 Sep 07 11:55:32 debian9 kernel: ? usleep_range_state+0xb0/0xb0 Sep 07 11:55:32 debian9 kernel: __flush_work+0x26d/0x530 Sep 07 11:55:32 debian9 kernel: ? flush_workqueue_prep_pwqs+0x140/0x140 Sep 07 11:55:32 debian9 kernel: ? trace_clock_local+0xc/0x30 Sep 07 11:55:32 debian9 kernel: __cancel_work_timer+0x11f/0x1b0 Sep 07 11:55:32 debian9 kernel: ? close_ctree+0x12b/0x5b3 [btrfs] Sep 07 11:55:32 debian9 kernel: ? __trace_bputs+0x10b/0x170 Sep 07 11:55:32 debian9 kernel: close_ctree+0x152/0x5b3 [btrfs] Sep 07 11:55:32 debian9 kernel: ? evict_inodes+0x166/0x1c0 Sep 07 11:55:32 debian9 kernel: generic_shutdown_super+0x71/0x120 Sep 07 11:55:32 debian9 kernel: kill_anon_super+0x14/0x30 Sep 07 11:55:32 debian9 kernel: btrfs_kill_super+0x12/0x20 [btrfs] Sep 07 11:55:32 debian9 kernel: deactivate_locked_super+0x2e/0xa0 Sep 07 11:55:32 debian9 kernel: cleanup_mnt+0x100/0x160 Sep 07 11:55:32 debian9 kernel: task_work_run+0x59/0xa0 Sep 07 11:55:32 debian9 kernel: exit_to_user_mode_prepare+0x1a6/0x1b0 Sep 07 11:55:32 debian9 kernel: syscall_exit_to_user_mode+0x16/0x40 Sep 07 11:55:32 debian9 kernel: do_syscall_64+0x48/0x90 Sep 07 11:55:32 debian9 kernel: entry_SYSCALL_64_after_hwframe+0x63/0xcd Sep 07 11:55:32 debian9 kernel: RIP: 0033:0x7fcde59a57a7 Sep 07 11:55:32 debian9 kernel: RSP: 002b:00007ffe914217c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 Sep 07 11:55:32 debian9 kernel: RAX: 0000000000000000 RBX: 00007fcde5ae8264 RCX: 00007fcde59a57a7 Sep 07 11:55:32 debian9 kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000055b57556cdd0 Sep 07 11:55:32 debian9 kernel: RBP: 000055b57556cba0 R08: 0000000000000000 R09: 00007ffe91420570 Sep 07 11:55:32 debian9 kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 Sep 07 11:55:32 debian9 kernel: R13: 000055b57556cdd0 R14: 000055b57556ccb8 R15: 0000000000000000 Sep 07 11:55:32 debian9 kernel: </TASK>

What happens is the following:

1. The…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup

Fix Oops in dasd_alias_get_start_dev() function caused by the pavgroup pointer being NULL.

The pavgroup pointer is checked on the entrance of the function but without the lcu->lock being held. Therefore there is a race window between dasd_alias_get_start_dev() and _lcu_update() which sets pavgroup to NULL with the lcu->lock held.

Fix by checking the pavgroup pointer with lcu->lock held.(CVE-2022-48636)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix hang during unmount when stopping a space reclaim worker

Often when running generic/562 from fstests we can hang during unmount, resulting in a trace like this:

Sep 07 11:52:00 debian9 unknown: run fstests generic/562 at 2022-09-07 11:52:00 Sep 07 11:55:32 debian9 kernel: INFO: task umount:49438 blocked for more than 120 seconds. Sep 07 11:55:32 debian9 kernel: Not tainted 6.0.0-rc2-btrfs-next-122 #1 Sep 07 11:55:32 debian9 kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. Sep 07 11:55:32 debian9 kernel: task:umount state:D stack: 0 pid:49438 ppid: 25683 flags:0x00004000 Sep 07 11:55:32 debian9 kernel: Call Trace: Sep 07 11:55:32 debian9 kernel: <TASK> Sep 07 11:55:32 debian9 kernel: __schedule+0x3c8/0xec0 Sep 07 11:55:32 debian9 kernel: ? rcu_read_lock_sched_held+0x12/0x70 Sep 07 11:55:32 debian9 kernel: schedule+0x5d/0xf0 Sep 07 11:55:32 debian9 kernel: schedule_timeout+0xf1/0x130 Sep 07 11:55:32 debian9 kernel: ? lock_release+0x224/0x4a0 Sep 07 11:55:32 debian9 kernel: ? lock_acquired+0x1a0/0x420 Sep 07 11:55:32 debian9 kernel: ? trace_hardirqs_on+0x2c/0xd0 Sep 07 11:55:32 debian9 kernel: __wait_for_common+0xac/0x200 Sep 07 11:55:32 debian9 kernel: ? usleep_range_state+0xb0/0xb0 Sep 07 11:55:32 debian9 kernel: __flush_work+0x26d/0x530 Sep 07 11:55:32 debian9 kernel: ? flush_workqueue_prep_pwqs+0x140/0x140 Sep 07 11:55:32 debian9 kernel: ? trace_clock_local+0xc/0x30 Sep 07 11:55:32 debian9 kernel: __cancel_work_timer+0x11f/0x1b0 Sep 07 11:55:32 debian9 kernel: ? close_ctree+0x12b/0x5b3 [btrfs] Sep 07 11:55:32 debian9 kernel: ? __trace_bputs+0x10b/0x170 Sep 07 11:55:32 debian9 kernel: close_ctree+0x152/0x5b3 [btrfs] Sep 07 11:55:32 debian9 kernel: ? evict_inodes+0x166/0x1c0 Sep 07 11:55:32 debian9 kernel: generic_shutdown_super+0x71/0x120 Sep 07 11:55:32 debian9 kernel: kill_anon_super+0x14/0x30 Sep 07 11:55:32 debian9 kernel: btrfs_kill_super+0x12/0x20 [btrfs] Sep 07 11:55:32 debian9 kernel: deactivate_locked_super+0x2e/0xa0 Sep 07 11:55:32 debian9 kernel: cleanup_mnt+0x100/0x160 Sep 07 11:55:32 debian9 kernel: task_work_run+0x59/0xa0 Sep 07 11:55:32 debian9 kernel: exit_to_user_mode_prepare+0x1a6/0x1b0 Sep 07 11:55:32 debian9 kernel: syscall_exit_to_user_mode+0x16/0x40 Sep 07 11:55:32 debian9 kernel: do_syscall_64+0x48/0x90 Sep 07 11:55:32 debian9 kernel: entry_SYSCALL_64_after_hwframe+0x63/0xcd Sep 07 11:55:32 debian9 kernel: RIP: 0033:0x7fcde59a57a7 Sep 07 11:55:32 debian9 kernel: RSP: 002b:00007ffe914217c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 Sep 07 11:55:32 debian9 kernel: RAX: 0000000000000000 RBX: 00007fcde5ae8264 RCX: 00007fcde59a57a7 Sep 07 11:55:32 debian9 kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000055b57556cdd0 Sep 07 11:55:32 debian9 kernel: RBP: 000055b57556cba0 R08: 0000000000000000 R09: 00007ffe91420570 Sep 07 11:55:32 debian9 kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 Sep 07 11:55:32 debian9 kernel: R13: 000055b57556cdd0 R14: 000055b57556ccb8 R15: 0000000000000000 Sep 07 11:55:32 debian9 kernel: </TASK>

What happens is the following:

1. The…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Fix DSP oops stack dump output contents

Fix @buf arg given to hex_dump_to_buffer() and stack address used in dump error output.(CVE-2021-47381)

In the Linux kernel, the following vulnerability has been resolved:

scsi: iscsi: Fix iscsi_task use after free

Commit d39df158518c ("scsi: iscsi: Have abort handler get ref to conn") added iscsi_get_conn()/iscsi_put_conn() calls during abort handling but then also changed the handling of the case where we detect an already completed task where we now end up doing a goto to the common put/cleanup code. This results in a iscsi_task use after free, because the common cleanup code will do a put on the iscsi_task.

This reverts the goto and moves the iscsi_get_conn() to after we've checked if the iscsi_task is valid.(CVE-2021-47427)

In the Linux kernel, the following vulnerability has been resolved:

spi: Fix deadlock when adding SPI controllers on SPI buses

Currently we have a global spi_add_lock which we take when adding new devices so that we can check that we're not trying to reuse a chip select that's already controlled. This means that if the SPI device is itself a SPI controller and triggers the instantiation of further SPI devices we trigger a deadlock as we try to register and instantiate those devices while in the process of doing so for the parent controller and hence already holding the global spi_add_lock. Since we only care about concurrency within a single SPI bus move the lock to be per controller, avoiding the deadlock.

This can be easily triggered in the case of spi-mux.(CVE-2021-47469)

(CVE-2023-39180)

In the Linux kernel, the following vulnerability has been resolved:

powerpc/powernv: Add a null pointer check in opal_powercap_init()

kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.(CVE-2023-52696)

In the Linux kernel, the following vulnerability has been resolved:

i2c: core: Run atomic i2c xfer when !preemptible

Since bae1d3a05a8b, i2c transfers are non-atomic if preemption is disabled. However, non-atomic i2c transfers require preemption (e.g. in wait_for_completion() while waiting for the DMA).

panic() calls preempt_disable_notrace() before calling emergency_restart(). Therefore, if an i2c device is used for the restart, the xfer should be atomic. This avoids warnings like:

[ 12.667612] WARNING: CPU: 1 PID: 1 at kernel/rcu/tree_plugin.h:318 rcu_note_context_switch+0x33c/0x6b0 [ 12.676926] Voluntary context switch within RCU read-side critical section! ... [ 12.742376] schedule_timeout from wait_for_completion_timeout+0x90/0x114 [ 12.749179] wait_for_completion_timeout from tegra_i2c_wait_completion+0x40/0x70 ... [ 12.994527] atomic_notifier_call_chain from machine_restart+0x34/0x58 [ 13.001050] machine_restart from panic+0x2a8/0x32c

Use !preemptible() instead, which is basically the same check as pre-v5.2.(CVE-2023-52791)

In the Linux kernel, the following vulnerability has been resolved:

hid: cp2112: Fix duplicate workqueue initialization

Previously the cp2112 driver called INIT_DELAYED_WORK within cp2112_gpio_irq_startup, resulting in duplicate initilizations of the workqueue on subsequent IRQ startups following an initial request. This resulted in a warning in set_work_data in workqueue.c, as well as a rare NULL dereference within process_one_work in workqueue.c.

Initialize the workqueue within _probe instead.(CVE-2023-52853)

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix UAF issue in ksmbd_tcp_new_connection()

The race is between the handling of a new TCP connection and its disconnection. It leads to UAF on struct tcp_transport in ksmbd_tcp_new_connection() function.(CVE-2024-26592)

In the Linux kernel, the…

In the Linux kernel, the following vulnerability has been resolved: inet: inet_defrag: prevent sk release while still in use ip_local_out() and other functions can pass skb->sk as function argument. If the skb is a fragment and reassembly happens before such function call returns, the sk must not be released. This affects skb fragments reassembled via netfilter or similar modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline. Eric Dumazet made an initial analysis of this bug. Quoting Eric: Calling ip_defrag() in output path is also implying skb_orphan(), which is buggy because output path relies on sk not disappearing. A relevant old patch about the issue was : 8282f27449bf ("inet: frag: Always orphan skbs inside ip_defrag()") [..] net/ipv4/ip_output.c depends on skb->sk being set, and probably to an inet socket, not an arbitrary one. If we orphan the packet in ipvlan, then downstream things like FQ packet scheduler will not work properly. We need to change ip_defrag() to only use skb_orphan() when really needed, ie whenever frag_list is going to be used. Eric suggested to stash sk in fragment queue and made an initial patch. However there is a problem with this: If skb is refragmented again right after, ip_do_fragment() will copy head->sk to the new fragments, and sets up destructor to sock_wfree. IOW, we have no choice but to fix up sk_wmem accouting to reflect the fully reassembled skb, else wmem will underflow. This change moves the orphan down into the core, to last possible moment. As ip_defrag_offset is aliased with sk_buff->sk member, we must move the offset into the FRAG_CB, else skb->sk gets clobbered. This allows to delay the orphaning long enough to learn if the skb has to be queued or if the skb is completing the reasm queue. In the former case, things work as before, skb is orphaned. This is safe because skb gets queued/stolen and won't continue past reasm engine. In the latter case, we will steal the skb->sk reference, reattach it to the head skb, and fix up wmem accouting when inet_frag inflates truesize.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: powerpc: Fix access beyond end of drmem array (CVE-2023-52451)
• kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463)
• kernel: tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)
• kernel: ext4: avoid online resizing failures due to oversized flex bg (CVE-2023-52622)
• kernel: net/sched: flower: Fix chain template offload (CVE-2024-26669)
• kernel: stmmac: Clear variable when destroying workqueue (CVE-2024-26802)
• kernel: efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843)
• kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878)
• kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886)
• kernel: SUNRPC: fix a memleak in gss_import_v2_context (CVE-2023-52653)
• kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application (CVE-2024-21823)
• kernel: Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (CVE-2023-52658)
• kernel: ext4: fix corruption during on-line resize (CVE-2024-35807)
• kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (CVE-2024-35801)
• kernel: dyndbg: fix old BUG_ON in >control parser (CVE-2024-35947)
• kernel: net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893)
• kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (CVE-2024-35876)
• kernel: platform/x86: wmi: Fix opening of char device (CVE-2023-52864)
• kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (CVE-2023-52845)
• (CVE-2023-28746)
• (CVE-2023-52847)
• (CVE-2021-47548)
• (CVE-2024-36921)
• (CVE-2024-26921)
• (CVE-2021-47579)
• (CVE-2024-36927)
• (CVE-2024-39276)
• (CVE-2024-33621)
• (CVE-2024-27010)
• (CVE-2024-26960)
• (CVE-2024-38596)
• (CVE-2022-48743)
• (CVE-2024-26733)
• (CVE-2024-26586)
• (CVE-2024-26698)
• (CVE-2023-52619)

Bug Fix(es):

• AlmaLinux8.6 - Spinlock statistics may show negative elapsed time and incorrectly formatted output (JIRA:AlmaLinux-17678)
• [AWS][8.9]There are call traces found when booting debug-kernel for Amazon EC2 r8g.metal-24xl instance (JIRA:AlmaLinux-23841)
• [almalinux8] gfs2: Fix glock shrinker (JIRA:AlmaLinux-32941)
• lan78xx: Microchip LAN7800 never comes up after unplug and replug (JIRA:AlmaLinux-33437)
• [Hyper-V][AlmaLinux-8.10.z] Update hv_netvsc driver to TOT (JIRA:AlmaLinux-39074)
• Use-after-free on proc inode-i_sb triggered by fsnotify (JIRA:AlmaLinux-40167)
• blk-cgroup: Properly propagate the iostat update up the hierarchy [almalinux-8.10.z] (JIRA:AlmaLinux-40939)
• (JIRA:AlmaLinux-31798)
• (JIRA:AlmaLinux-10263)
• (JIRA:AlmaLinux-40901)
• (JIRA:AlmaLinux-43547)
• (JIRA:AlmaLinux-34876)

Enhancement(s):

• [RFE] Add module parameters 'soft_reboot_cmd' and 'soft_active_on_boot' for customizing softdog configuration (JIRA:AlmaLinux-19723)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463)
• kernel: tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)
• kernel: ext4: avoid online resizing failures due to oversized flex bg (CVE-2023-52622)
• kernel: net/sched: flower: Fix chain template offload (CVE-2024-26669)
• kernel: stmmac: Clear variable when destroying workqueue (CVE-2024-26802)
• kernel: efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843)
• kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878)
• kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886)
• kernel: SUNRPC: fix a memleak in gss_import_v2_context (CVE-2023-52653)
• kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application (CVE-2024-21823)
• kernel: ext4: fix corruption during on-line resize (CVE-2024-35807)
• kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (CVE-2024-35801)
• kernel: dyndbg: fix old BUG_ON in >control parser (CVE-2024-35947)
• kernel: net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893)
• kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (CVE-2024-35876)
• kernel: platform/x86: wmi: Fix opening of char device (CVE-2023-52864)
• kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (CVE-2023-52845)
• kernel: Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (CVE-2023-52658)
• kernel: crash due to a missing check for leb_size (CVE-2024-25739)
• kernel: tcp: make sure init the accept_queue's spinlocks once (CVE-2024-26614)
• kernel: tcp: add sanity checks to rx zerocopy (CVE-2024-26640)
• kernel: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (CVE-2024-26870)
• kernel: nfs: fix UAF in direct writes (CVE-2024-26958)
• kernel: SUNRPC: fix some memleaks in gssx_dec_option_array (CVE-2024-27388)
• kernel: wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (CVE-2024-27434)
• kernel: of: Fix double free in of_parse_phandle_with_args_map (CVE-2023-52679)
• kernel: scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (CVE-2024-35930)
• kernel: wifi: iwlwifi: mvm: rfi: fix potential response leaks (CVE-2024-35912)
• kernel: block: prevent division by zero in blk_rq_stat_sum() (CVE-2024-35925)
• kernel: wifi: ath11k: decrease MHI channel buffer length to 8KB (CVE-2024-35938)
• kernel: wifi: cfg80211: check A-MSDU format more carefully (CVE-2024-35937)
• kernel: wifi: rtw89: fix null pointer access when abort scan (CVE-2024-35946)
• kernel: netfilter: nf_tables: honor table dormant flag from netdev release event path (CVE-2024-36005)
• kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (CVE-2024-36000)
• kernel: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (CVE-2024-36006)
• kernel: net: ieee802154: fix null deref in parse dev addr (CVE-2021-47257)
• kernel: mmc: sdio: fix possible resource leaks in some error paths (CVE-2023-52730)
• kernel: wifi: ath11k: fix gtk offload status event locking (CVE-2023-52777)
• (CVE-2023-52832)
• (CVE-2023-52803)
• (CVE-2023-52756)
• (CVE-2023-52834)
• (CVE-2023-52791)
• (CVE-2023-52764)
• (CVE-2021-47468)
• (CVE-2021-47284)
• (CVE-2024-36025)
• (CVE-2024-36941)
• (CVE-2024-36940)
• (CVE-2024-36904)
• (CVE-2024-36896)
• (CVE-2024-36954)
• (CVE-2024-36950)
• (CVE-2024-38575)
• (CVE-2024-36917)
• (CVE-2024-36016)
• (CVE-2023-52762)
• (CVE-2024-27025)
• (CVE-2021-47548)
• (CVE-2023-52619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

• CVE-url: https://ubuntu.com/security/CVE-2023-52664
  • net: atlantic: eliminate double free in error handling logic
• CVE-url: https://ubuntu.com/security/CVE-2023-52698
  • calipso: fix memory leak in netlbl_calipso_add_pass()
• CVE-url: https://ubuntu.com/security/CVE-2021-47466
  • mm, slub: fix potential memoryleak in kmem_cache_open()
• CVE-url: https://ubuntu.com/security/CVE-2023-52757
  • smb: client: fix potential deadlock when releasing mids
• CVE-url: https://ubuntu.com/security/CVE-2023-52749
  • spi: Fix null dereference on suspend
• CVE-url: https://ubuntu.com/security/CVE-2024-26921
  • net: ipv4: do not handle duplicate fragments as overlapping
  • net: IP defrag: encapsulate rbtree defrag code into callable functions
  • ipv4: remove unnecessary type castings
  • skb_expand_head() adjust skb->truesize incorrectly
  • inet: inet_defrag: prevent sk release while still in use
• CVE-url: https://ubuntu.com/security/CVE-2021-47082
  • tun: avoid double free in tun_free_netdev
• CVE-url: https://ubuntu.com/security/CVE-2024-36968
  • Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
• CVE-url: https://ubuntu.com/security/CVE-2023-52507
  • nfc: nci: assert requested protocol is valid
• CVE-url: https://ubuntu.com/security/CVE-2024-44944
  • netfilter: ctnetlink: use helper function to calculate expect ID
• CVE-url: https://ubuntu.com/security/CVE-2024-35861
  • smb: client: fix potential UAF in cifs_debug_files_proc_show()
  • smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()
• CVE-url: https://ubuntu.com/security/CVE-2024-35863
  • smb: client: fix potential UAF in smb2_is_valid_oplock_break()
• CVE-url: https://ubuntu.com/security/CVE-2024-35864
  • smb: client: fix potential UAF in smb2_is_valid_lease_break()
• CVE-url: https://ubuntu.com/security/CVE-2024-35867
  • smb: client: fix potential UAF in cifs_stats_proc_show()
• CVE-url: https://ubuntu.com/security/CVE-2024-35868
  • smb: client: fix potential UAF in cifs_stats_proc_write()
• CVE-url: https://ubuntu.com/security/CVE-2024-35896
  • netfilter: validate user input for expected length
• CVE-url: https://ubuntu.com/security/CVE-2024-27010
  • net/sched: Fix mirred deadlock on device recursion
• CVE-url: https://ubuntu.com/security/CVE-2024-26961
  • mac802154: fix llsec key resources release in mac802154_llsec_key_del
• CVE-url: https://ubuntu.com/security/CVE-2024-26958
  • NFS: Fix up commit deadlocks
  • nfs: fix UAF in direct writes
• CVE-url: https://ubuntu.com/security/CVE-2024-50115
  • KVM: nSVM: Don't strip host's C-bit from guest's CR3 when reading PDPTRs
  • KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
• CVE-url: https://ubuntu.com/security/CVE-2024-50148
  • Bluetooth: bnep: fix wild-memory-access in proto_unregister
• CVE-url: https://ubuntu.com/security/CVE-2024-40910
  • ax25: Fix refcount imbalance on inbound connections
• CVE-url: https://ubuntu.com/security/CVE-2024-53057
  • net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
• CVE-url: https://ubuntu.com/security/CVE-2021-47101
  • net: asix: fix uninit value bugs
  • asix: fix uninit-value in asix_mdio_read()
• CVE-url: https://ubuntu.com/security/CVE-2024-36952
  • scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
• CVE-url: https://ubuntu.com/security/CVE-2023-52488
  • regmap: Add regmap_noinc_read API
  • regmap: Add regmap_noinc_write API
  • serial: sc16is7xx: convert from raw to noinc regmap functions for FIFO
• CVE-url: https://ubuntu.com/security/CVE-2024-50142
  • xfrm: validate new SA's prefixlen using SA family when sel.family is unset
• CVE-url: https://ubuntu.com/security/CVE-2024-50256
  • netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()
• CVE-url:…

• CVE-url: https://ubuntu.com/security/CVE-2023-52664
  • net: atlantic: eliminate double free in error handling logic
• CVE-url: https://ubuntu.com/security/CVE-2023-52698
  • calipso: fix memory leak in netlbl_calipso_add_pass()
• CVE-url: https://ubuntu.com/security/CVE-2021-47466
  • mm, slub: fix potential memoryleak in kmem_cache_open()
• CVE-url: https://ubuntu.com/security/CVE-2023-52757
  • smb: client: fix potential deadlock when releasing mids
• CVE-url: https://ubuntu.com/security/CVE-2023-52749
  • spi: Fix null dereference on suspend
• CVE-url: https://ubuntu.com/security/CVE-2024-26921
  • net: ipv4: do not handle duplicate fragments as overlapping
  • net: IP defrag: encapsulate rbtree defrag code into callable functions
  • ipv4: remove unnecessary type castings
  • skb_expand_head() adjust skb->truesize incorrectly
  • inet: inet_defrag: prevent sk release while still in use
• CVE-url: https://ubuntu.com/security/CVE-2021-47082
  • tun: avoid double free in tun_free_netdev
• CVE-url: https://ubuntu.com/security/CVE-2024-36968
  • Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
• CVE-url: https://ubuntu.com/security/CVE-2023-52507
  • nfc: nci: assert requested protocol is valid
• CVE-url: https://ubuntu.com/security/CVE-2024-44944
  • netfilter: ctnetlink: use helper function to calculate expect ID
• CVE-url: https://ubuntu.com/security/CVE-2024-35861
  • smb: client: fix potential UAF in cifs_debug_files_proc_show()
  • smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()
• CVE-url: https://ubuntu.com/security/CVE-2024-35863
  • smb: client: fix potential UAF in smb2_is_valid_oplock_break()
• CVE-url: https://ubuntu.com/security/CVE-2024-35864
  • smb: client: fix potential UAF in smb2_is_valid_lease_break()
• CVE-url: https://ubuntu.com/security/CVE-2024-35867
  • smb: client: fix potential UAF in cifs_stats_proc_show()
• CVE-url: https://ubuntu.com/security/CVE-2024-35868
  • smb: client: fix potential UAF in cifs_stats_proc_write()
• CVE-url: https://ubuntu.com/security/CVE-2024-35896
  • netfilter: validate user input for expected length
• CVE-url: https://ubuntu.com/security/CVE-2024-27010
  • net/sched: Fix mirred deadlock on device recursion
• CVE-url: https://ubuntu.com/security/CVE-2024-26961
  • mac802154: fix llsec key resources release in mac802154_llsec_key_del
• CVE-url: https://ubuntu.com/security/CVE-2024-26958
  • NFS: Fix up commit deadlocks
  • nfs: fix UAF in direct writes
• CVE-url: https://ubuntu.com/security/CVE-2024-50115
  • KVM: nSVM: Don't strip host's C-bit from guest's CR3 when reading PDPTRs
  • KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
• CVE-url: https://ubuntu.com/security/CVE-2024-50148
  • Bluetooth: bnep: fix wild-memory-access in proto_unregister
• CVE-url: https://ubuntu.com/security/CVE-2024-40910
  • ax25: Fix refcount imbalance on inbound connections
• CVE-url: https://ubuntu.com/security/CVE-2024-53057
  • net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
• CVE-url: https://ubuntu.com/security/CVE-2021-47101
  • net: asix: fix uninit value bugs
  • asix: fix uninit-value in asix_mdio_read()
• CVE-url: https://ubuntu.com/security/CVE-2024-36952
  • scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
• CVE-url: https://ubuntu.com/security/CVE-2023-52488
  • regmap: Add regmap_noinc_read API
  • regmap: Add regmap_noinc_write API
  • serial: sc16is7xx: convert from raw to noinc regmap functions for FIFO
• CVE-url: https://ubuntu.com/security/CVE-2024-50142
  • xfrm: validate new SA's prefixlen using SA family when sel.family is unset
• CVE-url: https://ubuntu.com/security/CVE-2024-50256
  • netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()
• CVE-url:…

In the Linux kernel, the following vulnerability has been resolved: inet: inet_defrag: prevent sk release while still in use ip_local_out() and other functions can pass skb->sk as function argument. If the skb is a fragment and reassembly happens before such function call returns, the sk must not be released. This affects skb fragments reassembled via netfilter or similar modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline. Eric Dumazet made an initial analysis of this bug. Quoting Eric: Calling ip_defrag() in output path is also implying skb_orphan(), which is buggy because output path relies on sk not disappearing. A relevant old patch about the issue was : 8282f27449bf ('inet: frag: Always orphan skbs inside ip_defrag()') [.. net/ipv4/ip_output.c depends on skb->sk being set, and probably to an inet socket, not an arbitrary one. If we orphan the packet in ipvlan, then downstream things like FQ packet scheduler will not work properly. We need to change ip_defrag() to only use skb_orphan() when really needed, ie whenever frag_list is going to be used. Eric suggested to stash sk in fragment queue and made an initial patch. However there is a problem with this: If skb is refragmented again right after, ip_do_fragment() will copy head->sk to the new fragments, and sets up destructor to sock_wfree. IOW, we have no choice but to fix up sk_wmem accouting to reflect the fully reassembled skb, else wmem will underflow. This change moves the orphan down into the core, to last possible moment. As ip_defrag_offset is aliased with sk_buff->sk member, we must move the offset into the FRAG_CB, else skb->sk gets clobbered. This allows to delay the orphaning long enough to learn if the skb has to be queued or if the skb is completing the reasm queue. In the former case, things work as before, skb is orphaned. This is safe because skb gets queued/stolen and won't continue past reasm engine. In the latter case, we will steal the skb->sk reference, reattach it to the head skb, and fix up wmem accouting when inet_frag inflates truesize.)(CVE-2024-26921)

In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a peer that carries SCM_RIGHTS, two consecutive passes of scan_children() may see a different set of children. Leading to an incorrectly elevated inflight count, and then a dangling pointer within the gc_inflight_list. sockets are AF_UNIX/SOCK_STREAM S is an unconnected socket L is a listening in-flight socket bound to addr, not in fdtable V's fd will be passed via sendmsg(), gets inflight count bumped connect(S, addr) sendmsg(S, [V]); close(V) __unix_gc() ---------------- ------------------------- ----------- NS = unix_create1() skb1 = sock_wmalloc(NS) L = unix_find_other(addr) unix_state_lock(L) unix_peer(S) = NS // V count=1 inflight=0 NS = unix_peer(S) skb2 = sock_alloc() skb_queue_tail(NS, skb2[V]) // V became in-flight // V count=2 inflight=1 close(V) // V count=1 inflight=1 // GC candidate condition met for u in gc_inflight_list: if (total_refs == inflight_refs) add u to gc_candidates // gc_candidates={L, V} for u in gc_candidates: scan_children(u, dec_inflight) // embryo (skb1) was not // reachable from L yet, so V's // inflight remains unchanged __skb_queue_tail(L, skb1) unix_state_unlock(L) for u in gc_candidates: if (u.inflight) scan_children(u, inc_inflight_move_tail) // V count=1 inflight=2 (!) If there is a GC-candidate listening socket, lock/unlock its state. This makes GC wait until the end of any ongoing connect() to that socket. After flipping the lock, a possibly SCM-laden embryo is already enqueued. And if there is another embryo coming, it can not possibly carry SCM_RIGHTS. At this point, unix_inflight() can not happen because unix_gc_lock is already taken. Inflight graph remains…

In the Linux kernel, the following vulnerability has been resolved: tls: fix use-after-free on failed backlog decryption When the decrypt request goes to the backlog and crypto_aead_decrypt returns -EBUSY, tls_do_decryption will wait until all async decryptions have completed. If one of them fails, tls_do_decryption will return -EBADMSG and tls_decrypt_sg jumps to the error path, releasing all the pages. But the pages have been passed to the async callback, and have already been released by tls_decrypt_done. The only true async case is when crypto_aead_decrypt returns -EINPROGRESS. With -EBUSY, we already waited so we can tell tls_sw_recvmsg that the data is available for immediate copy, but we need to notify tls_decrypt_sg (via the new ->async_done flag) that the memory has already been released.)(CVE-2024-26800)

In the Linux kernel, the following vulnerability has been resolved: inet: inet_defrag: prevent sk release while still in use ip_local_out() and other functions can pass skb->sk as function argument. If the skb is a fragment and reassembly happens before such function call returns, the sk must not be released. This affects skb fragments reassembled via netfilter or similar modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline. Eric Dumazet made an initial analysis of this bug. Quoting Eric: Calling ip_defrag() in output path is also implying skb_orphan(), which is buggy because output path relies on sk not disappearing. A relevant old patch about the issue was : 8282f27449bf ('inet: frag: Always orphan skbs inside ip_defrag()') [.. net/ipv4/ip_output.c depends on skb->sk being set, and probably to an inet socket, not an arbitrary one. If we orphan the packet in ipvlan, then downstream things like FQ packet scheduler will not work properly. We need to change ip_defrag() to only use skb_orphan() when really needed, ie whenever frag_list is going to be used. Eric suggested to stash sk in fragment queue and made an initial patch. However there is a problem with this: If skb is refragmented again right after, ip_do_fragment() will copy head->sk to the new fragments, and sets up destructor to sock_wfree. IOW, we have no choice but to fix up sk_wmem accouting to reflect the fully reassembled skb, else wmem will underflow. This change moves the orphan down into the core, to last possible moment. As ip_defrag_offset is aliased with sk_buff->sk member, we must move the offset into the FRAG_CB, else skb->sk gets clobbered. This allows to delay the orphaning long enough to learn if the skb has to be queued or if the skb is completing the reasm queue. In the former case, things work as before, skb is orphaned. This is safe because skb gets queued/stolen and won't continue past reasm engine. In the latter case, we will steal the skb->sk reference, reattach it to the head skb, and fix up wmem accouting when inet_frag inflates truesize.)(CVE-2024-26921)

In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix race between free_swap_and_cache() and swapoff() There was previously a theoretical window where swapoff() could run and teardown a swap_info_struct while a call to free_swap_and_cache() was running in another thread. This could cause, amongst other bad possibilities, swap_page_trans_huge_swapped() (called by free_swap_and_cache()) to access the freed memory for swap_map. This is a theoretical problem and I haven't been able to provoke it from a test case. But there has been agreement based on code review that this is possible (see link below). Fix it by using get_swap_device()/put_swap_device(), which will stall swapoff(). There was an extra check in _swap_info_get() to confirm that the swap entry was not free. This isn't present in get_swap_device() because it doesn't make sense in general due to the race between getting the reference and swapoff. So I've added an equivalent check directly in free_swap_and_cache(). Details of how to provoke one possible issue (thanks to David…

In the Linux kernel, the following vulnerability has been resolved: tls: fix use-after-free on failed backlog decryption When the decrypt request goes to the backlog and crypto_aead_decrypt returns -EBUSY, tls_do_decryption will wait until all async decryptions have completed. If one of them fails, tls_do_decryption will return -EBADMSG and tls_decrypt_sg jumps to the error path, releasing all the pages. But the pages have been passed to the async callback, and have already been released by tls_decrypt_done. The only true async case is when crypto_aead_decrypt returns -EINPROGRESS. With -EBUSY, we already waited so we can tell tls_sw_recvmsg that the data is available for immediate copy, but we need to notify tls_decrypt_sg (via the new ->async_done flag) that the memory has already been released.)(CVE-2024-26800)

In the Linux kernel, the following vulnerability has been resolved: inet: inet_defrag: prevent sk release while still in use ip_local_out() and other functions can pass skb->sk as function argument. If the skb is a fragment and reassembly happens before such function call returns, the sk must not be released. This affects skb fragments reassembled via netfilter or similar modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline. Eric Dumazet made an initial analysis of this bug. Quoting Eric: Calling ip_defrag() in output path is also implying skb_orphan(), which is buggy because output path relies on sk not disappearing. A relevant old patch about the issue was : 8282f27449bf ('inet: frag: Always orphan skbs inside ip_defrag()') [.. net/ipv4/ip_output.c depends on skb->sk being set, and probably to an inet socket, not an arbitrary one. If we orphan the packet in ipvlan, then downstream things like FQ packet scheduler will not work properly. We need to change ip_defrag() to only use skb_orphan() when really needed, ie whenever frag_list is going to be used. Eric suggested to stash sk in fragment queue and made an initial patch. However there is a problem with this: If skb is refragmented again right after, ip_do_fragment() will copy head->sk to the new fragments, and sets up destructor to sock_wfree. IOW, we have no choice but to fix up sk_wmem accouting to reflect the fully reassembled skb, else wmem will underflow. This change moves the orphan down into the core, to last possible moment. As ip_defrag_offset is aliased with sk_buff->sk member, we must move the offset into the FRAG_CB, else skb->sk gets clobbered. This allows to delay the orphaning long enough to learn if the skb has to be queued or if the skb is completing the reasm queue. In the former case, things work as before, skb is orphaned. This is safe because skb gets queued/stolen and won't continue past reasm engine. In the latter case, we will steal the skb->sk reference, reattach it to the head skb, and fix up wmem accouting when inet_frag inflates truesize.)(CVE-2024-26921)

In the Linux kernel, the following vulnerability has been resolved: watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger When the cpu5wdt module is removing, the origin code uses del_timer() to de-activate the timer. If the timer handler is running, del_timer() could not stop it and will return directly. If the port region is released by release_region() and then the timer handler cpu5wdt_trigger() calls outb() to write into the region that is released, the use-after-free bug will happen. Change del_timer() to timer_shutdown_sync() in order that the timer handler could be finished before the port region is released.)(CVE-2024-38630)

In the Linux kernel, the following vulnerability has been resolved: exec: Fix ToCToU between perm check and set-uid/gid usage When opening a file for exec via do_filp_open(), permission checking is done against the file's metadata at that moment, and on success, a file pointer is passed back. Much later in the execve() code path, the file metadata (specifically mode, uid, and gid) is used to determine if/how to set the…

Upstream kernel version 6.6.28 fix bugs and vulnerabilities. The kmod-virtualbox and kmod-xtables-addons packages have been updated to work with this new kernel. dwarves is a new requirement to build the kernel. For information about the vulnerabilities see the links.

Upstream kernel version 6.6.28 fix bugs and vulnerabilities. For information about the vulnerabilities see the links.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: powerpc: Fix access beyond end of drmem array (CVE-2023-52451)

• kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463)

• kernel: tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)

• kernel: ext4: avoid online resizing failures due to oversized flex bg (CVE-2023-52622)

• kernel: net/sched: flower: Fix chain template offload (CVE-2024-26669)

• kernel: stmmac: Clear variable when destroying workqueue (CVE-2024-26802)

• kernel: efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843)

• kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878)

• kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886)

• kernel: SUNRPC: fix a memleak in gss_import_v2_context (CVE-2023-52653)

• kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application (CVE-2024-21823)

• kernel: Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (CVE-2023-52658)

• kernel: ext4: fix corruption during on-line resize (CVE-2024-35807)

• kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (CVE-2024-35801)

• kernel: dyndbg: fix old BUG_ON in >control parser (CVE-2024-35947)

• kernel: net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893)

• kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (CVE-2024-35876)

• kernel: platform/x86: wmi: Fix opening of char device (CVE-2023-52864)

• kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (CVE-2023-52845)

• (CVE-2023-28746)

• (CVE-2023-52847)

• (CVE-2021-47548)

• (CVE-2024-36921)

• (CVE-2024-26921)

• (CVE-2021-47579)

• (CVE-2024-36927)

• (CVE-2024-39276)

• (CVE-2024-33621)

• (CVE-2024-27010)

• (CVE-2024-26960)

• (CVE-2024-38596)

• (CVE-2022-48743)

• (CVE-2024-26733)

• (CVE-2024-26586)

• (CVE-2024-26698)

• (CVE-2023-52619)

Bug Fix(es):

• Rocky Linux8.6 - Spinlock statistics may show negative elapsed time and incorrectly formatted output (JIRA:Rocky Linux-17678)

• [AWS][8.9]There are call traces found when booting debug-kernel for Amazon EC2 r8g.metal-24xl instance (JIRA:Rocky Linux-23841)

• [rhel8] gfs2: Fix glock shrinker (JIRA:Rocky Linux-32941)

• lan78xx: Microchip LAN7800 never comes up after unplug and replug (JIRA:Rocky Linux-33437)

• [Hyper-V][Rocky Linux-8.10.z] Update hv_netvsc driver to TOT (JIRA:Rocky Linux-39074)

• Use-after-free on proc inode-i_sb triggered by fsnotify (JIRA:Rocky Linux-40167)

• blk-cgroup: Properly propagate the iostat update up the hierarchy [rhel-8.10.z] (JIRA:Rocky Linux-40939)

• (JIRA:Rocky Linux-31798)

• (JIRA:Rocky Linux-10263)

• (JIRA:Rocky Linux-40901)

• (JIRA:Rocky Linux-43547)

• (JIRA:Rocky Linux-34876)

Enhancement(s):

• [RFE] Add module parameters 'soft_reboot_cmd' and 'soft_active_on_boot' for customizing softdog configuration (JIRA:Rocky Linux-19723)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463)

• kernel: tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)

• kernel: ext4: avoid online resizing failures due to oversized flex bg (CVE-2023-52622)

• kernel: net/sched: flower: Fix chain template offload (CVE-2024-26669)

• kernel: stmmac: Clear variable when destroying workqueue (CVE-2024-26802)

• kernel: efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843)

• kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878)

• kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886)

• kernel: SUNRPC: fix a memleak in gss_import_v2_context (CVE-2023-52653)

• kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application (CVE-2024-21823)

• kernel: ext4: fix corruption during on-line resize (CVE-2024-35807)

• kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (CVE-2024-35801)

• kernel: dyndbg: fix old BUG_ON in >control parser (CVE-2024-35947)

• kernel: net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893)

• kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (CVE-2024-35876)

• kernel: platform/x86: wmi: Fix opening of char device (CVE-2023-52864)

• kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (CVE-2023-52845)

• kernel: Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (CVE-2023-52658)

• kernel: crash due to a missing check for leb_size (CVE-2024-25739)

• kernel: tcp: make sure init the accept_queue's spinlocks once (CVE-2024-26614)

• kernel: tcp: add sanity checks to rx zerocopy (CVE-2024-26640)

• kernel: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (CVE-2024-26870)

• kernel: nfs: fix UAF in direct writes (CVE-2024-26958)

• kernel: SUNRPC: fix some memleaks in gssx_dec_option_array (CVE-2024-27388)

• kernel: wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (CVE-2024-27434)

• kernel: of: Fix double free in of_parse_phandle_with_args_map (CVE-2023-52679)

• kernel: scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (CVE-2024-35930)

• kernel: wifi: iwlwifi: mvm: rfi: fix potential response leaks (CVE-2024-35912)

• kernel: block: prevent division by zero in blk_rq_stat_sum() (CVE-2024-35925)

• kernel: wifi: ath11k: decrease MHI channel buffer length to 8KB (CVE-2024-35938)

• kernel: wifi: cfg80211: check A-MSDU format more carefully (CVE-2024-35937)

• kernel: wifi: rtw89: fix null pointer access when abort scan (CVE-2024-35946)

• kernel: netfilter: nf_tables: honor table dormant flag from netdev release event path (CVE-2024-36005)

• kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (CVE-2024-36000)

• kernel: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (CVE-2024-36006)

• kernel: net: ieee802154: fix null deref in parse dev addr (CVE-2021-47257)

• kernel: mmc: sdio: fix possible resource leaks in some error paths (CVE-2023-52730)

• kernel: wifi: ath11k: fix gtk offload status event locking (CVE-2023-52777)

• (CVE-2023-52832)

• (CVE-2023-52803)

• (CVE-2023-52756)

• (CVE-2023-52834)

• (CVE-2023-52791)

• (CVE-2023-52764)

• (CVE-2021-47468)

• (CVE-2021-47284)

• (CVE-2024-36025)

• (CVE-2024-36941)

• (CVE-2024-36940)

• (CVE-2024-36904)

• (CVE-2024-36896)

• (CVE-2024-36954)

• (CVE-2024-36950)

• (CVE-2024-38575)

• (CVE-2024-36917)

• (CVE-2024-36016)

• (CVE-2023-52762)

• (CVE-2024-27025)

• (CVE-2021-47548)

• (CVE-2023-52619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: powerpc: Fix access beyond end of drmem array (CVE-2023-52451)

• kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463)

• kernel: tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)

• kernel: ext4: avoid online resizing failures due to oversized flex bg (CVE-2023-52622)

• kernel: net/sched: flower: Fix chain template offload (CVE-2024-26669)

• kernel: stmmac: Clear variable when destroying workqueue (CVE-2024-26802)

• kernel: efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843)

• kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878)

• kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886)

• kernel: SUNRPC: fix a memleak in gss_import_v2_context (CVE-2023-52653)

• kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application (CVE-2024-21823)

• kernel: Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (CVE-2023-52658)

• kernel: ext4: fix corruption during on-line resize (CVE-2024-35807)

• kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (CVE-2024-35801)

• kernel: dyndbg: fix old BUG_ON in >control parser (CVE-2024-35947)

• kernel: net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893)

• kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (CVE-2024-35876)

• kernel: platform/x86: wmi: Fix opening of char device (CVE-2023-52864)

• kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (CVE-2023-52845)

• (CVE-2023-28746)

• (CVE-2023-52847)

• (CVE-2021-47548)

• (CVE-2024-36921)

• (CVE-2024-26921)

• (CVE-2021-47579)

• (CVE-2024-36927)

• (CVE-2024-39276)

• (CVE-2024-33621)

• (CVE-2024-27010)

• (CVE-2024-26960)

• (CVE-2024-38596)

• (CVE-2022-48743)

• (CVE-2024-26733)

• (CVE-2024-26586)

• (CVE-2024-26698)

• (CVE-2023-52619)

Bug Fix(es):

• Rocky Linux SIG Cloud8.6 - Spinlock statistics may show negative elapsed time and incorrectly formatted output (JIRA:Rocky Linux SIG Cloud-17678)

• [AWS][8.9]There are call traces found when booting debug-kernel for Amazon EC2 r8g.metal-24xl instance (JIRA:Rocky Linux SIG Cloud-23841)

• [rhel8] gfs2: Fix glock shrinker (JIRA:Rocky Linux SIG Cloud-32941)

• lan78xx: Microchip LAN7800 never comes up after unplug and replug (JIRA:Rocky Linux SIG Cloud-33437)

• [Hyper-V][Rocky Linux SIG Cloud-8.10.z] Update hv_netvsc driver to TOT (JIRA:Rocky Linux SIG Cloud-39074)

• Use-after-free on proc inode-i_sb triggered by fsnotify (JIRA:Rocky Linux SIG Cloud-40167)

• blk-cgroup: Properly propagate the iostat update up the hierarchy [rhel-8.10.z] (JIRA:Rocky Linux SIG Cloud-40939)

• (JIRA:Rocky Linux SIG Cloud-31798)

• (JIRA:Rocky Linux SIG Cloud-10263)

• (JIRA:Rocky Linux SIG Cloud-40901)

• (JIRA:Rocky Linux SIG Cloud-43547)

• (JIRA:Rocky Linux SIG Cloud-34876)

Enhancement(s):

• [RFE] Add module parameters 'soft_reboot_cmd' and 'soft_active_on_boot' for customizing softdog configuration (JIRA:Rocky Linux SIG Cloud-19723)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948). Update blacklist.conf: remove entry
• CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2022-48697: Fix a use-after-free (bsc#1223922). Update blacklist.conf: drop entry from it
• CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).
• CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222 CVE-2023-52732).
• CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2024-36029: Pervent access to suspended controller (bsc#1225708 CVE-2024-36029)
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
• CVE-2021-47352: Add validation for used length (bsc#1225124).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).
• CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2021-47423: Fix file release memory leak (bsc#1225366).
• CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
• CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
• CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)
• CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
• CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960, CVE-2021-47277).
• CVE-2024-35791: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (bsc#1224725).
• CVE-2021-47401: Fix stack information leak (bsc#1225242).
• CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).
• CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).
• CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
• CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
• CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).
• CVE-2023-52864: Fix opening of char device (bsc#1225132).
• CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).
• CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).
• CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)
• CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).
• CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).
• CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)
• CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).
• CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931) -…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948).
• CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2022-48697: Fix a use-after-free (bsc#1223922).
• CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).
• CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222).
• CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
• CVE-2021-47548: Fixed a possible array out-of-bounds (bsc#1225506)
• CVE-2024-36029: Pervent access to suspended controller (bsc#1225708)
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
• CVE-2021-47352: Add validation for used length (bsc#1225124).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).
• CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2021-47423: Fix file release memory leak (bsc#1225366).
• CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
• CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
• CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)
• CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
• CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960).
• CVE-2024-35791: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (bsc#1224725).
• CVE-2021-47401: Fix stack information leak (bsc#1225242).
• CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).
• CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).
• CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
• CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
• CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).
• CVE-2023-52864: Fix opening of char device (bsc#1225132).
• CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).
• CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).
• CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)
• CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).
• CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).
• CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)
• CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).
• CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)
• CVE-2021-47249: Fix memory leak in rds_recvmsg (bsc#1224880)
• CVE-2021-47397: Break out if skb_header_pointer returns NULL in…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
• CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52660: Fiedx IRQ handling due to shared interrupts (bsc#1224443).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26715: Fixed NULL pointer dereference in dwc3_gadget_suspend (bsc#1222561).
• CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes bsc#1222608).
• CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
• CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
• CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
• CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
• CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
• CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
• CVE-2024-27042: Fixed potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (bsc#1223823).
• CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).
• CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181).
• CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr() (bsc#1224721)
• CVE-2024-27419: Fixed data-races around sysctl_net_busy_read (bsc#1224759)
• CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
• CVE-2024-35791: Flush pages under…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
• CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
• CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
• CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).

The following non-security bugs were fixed:

• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• cifs: add missing spinlock around tcon refcount (bsc#1213476).
• cifs: avoid dup prefix path in dfs_get_automount_devname() (bsc#1213476).
• cifs: avoid race conditions with parallel reconnects (bsc#1213476).
• cifs: avoid re-lookups in dfs_cache_find() (bsc#1213476).
• cifs: avoid use of global locks for high contention data (bsc#1213476).
• cifs: check only tcon status on tcon related functions (bsc#1213476).
• cifs: do all necessary checks for credits within or before locking (bsc#1213476).
• cifs: do not block in dfs_cache_noreq_update_tgthint() (bsc#1213476).
• cifs: do not refresh cached referrals from unactive mounts (bsc#1213476).
• cifs: do not take exclusive lock for updating target hints (bsc#1213476).
• cifs: fix confusing debug message (bsc#1213476).
• cifs: fix missing unload_nls() in smb2_reconnect() (bsc#1213476).
• cifs: fix potential deadlock in cache_refresh_path() (bsc#1213476).
• cifs: fix refresh of cached referrals (bsc#1213476).
• cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (bsc#1213476).
• cifs: fix source pathname comparison of dfs supers (bsc#1213476).
• cifs: fix status checks in cifs_tree_connect (bsc#1213476).
• cifs: fix use-after-free bug in refresh_cache_worker() (bsc#1213476).
• cifs: get rid of dns resolve worker (bsc#1213476).
• cifs: get rid of mount options string parsing (bsc#1213476).
• cifs: handle cache lookup errors different than -ENOENT (bsc#1213476).
• cifs: ignore ipc reconnect failures during dfs failover (bsc#1213476).
• cifs: match even the scope id for ipv6 addresses (bsc#1213476).
• cifs: optimize reconnect of nested links (bsc#1213476).
• cifs: prevent data race in smb2_reconnect() (bsc#1213476). -…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
• CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
• CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
• CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
• CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
• CVE-2024-35904: Fixed dereference of garbage after mount failure (bsc#1224494).
• CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
• CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).

The following non-security bugs were fixed:

• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• filemap: remove use of wait bookmarks (bsc#1224085).
• idpf: extend tx watchdog timeout (bsc#1224137).
• ipvs: Fix checksumming on GSO of SCTP packets (bsc#1221958)
• powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).
• powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).
• powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).
• powerpc/powernv: Add a null pointer check to scom_debug_init_one() (bsc#1194869).
• powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV (bsc#1220492 ltc#205270).
• powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).
• powerpc: Refactor verification of MSR_RI (bsc#1223191).
• supported.conf: support tcp_dctcp module (jsc#PED-8111)

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575).
• CVE-2024-36938: Fixed NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761).
• CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2024-35998: Fixed lock ordering potential deadlock in cifs_sync_mid_result (bsc#1224549).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
• CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
• CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break() (bsc#1224668).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
• CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
• CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
• CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key() (bsc#1224667).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-35869: Guarantee refcounted children from parent session (bsc#1224679).
• CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2024-35964: Fixed not validating setsockopt user input (bsc#1224581).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
• CVE-2024-35860: struct bpf_link and bpf_link_ops kABI workaround (bsc#1224531).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).
• CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).
• CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
• CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
• CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
• CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios (bsc#1224530).
• CVE-2024-35852: Fixed memory leak when canceling rehash work (bsc#1224502).
• CVE-2024-36006: Fixed incorrect list API usage (bsc#1224541).
• CVE-2024-36007: Fixed warning during rehash (bsc#1224543).
• CVE-2024-35885: Stop interface during shutdown (bsc#1224519).
• CVE-2024-35907: Call request_irq() after NAPI initialized (bsc#1224492).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
• CVE-2024-26764: Fixed IOCB_AIO_RW check in fs/aio before the struct aio_kiocb conversion (bsc#1222721).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).
• CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).
• CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).
• CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).
• CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).
• CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).
• CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
• CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
• CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).
• CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).
• CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).
• CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).
• CVE-2024-26772: Fixed ext4 to avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (bsc#1222613).
• CVE-2024-26906: Disallowed vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26816: Ignore relocations in .notes section when building with CONFIG_XEN_PV=y (bsc#1222624).
• CVE-2024-26783: Fixed mm/vmscan bug when calling wakeup_kswapd() with a wrong zone index (bsc#1222615).
• CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).
• CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).
• CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).
• CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).
• CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
• CVE-2024-26836: Fixed platform/x86/think-lmi password opcode ordering for workstations (bsc#1222968).
• CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
• CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found() (bsc#1222618).
• CVE-2024-26807: Fixed spi/cadence-qspi NULL pointer reference in runtime PM hooks (bsc#1222801).
• CVE-2024-26737: Fixed selftests/bpf racing between bpf_timer_cancel_and_free and bpf_timer_cancel (bsc#1222557).
• CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).
• CVE-2024-26684: Fixed net/stmmac/xgmac handling of DPP safety error for DMA channels (bsc#1222445).
• CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).
• CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).
• CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
• CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
• CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
• CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
• CVE-2023-6270: Fixed a use-after-free issue in…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).
• CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
• CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
• CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
• CVE-2021-47206: Check return value after calling platform_get_resource() (bsc#1222894).
• CVE-2021-47238: Fixed memory leak in ip_mc_add1_src (bsc#1224847)
• CVE-2021-47245: Fixed out of bounds when parsing TCP options (bsc#1224838)
• CVE-2021-47246: Fixed page reclaim for dead peer hairpin (CVE-2021-47246 bsc#1224831).
• CVE-2021-47249: Fixed memory leak in rds_recvmsg (bsc#1224880)
• CVE-2021-47250: Fixed memory leak in netlbl_cipsov4_add_std (bsc#1224827)
• CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
• CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960).
• CVE-2021-47281: Fixed race of snd_seq_timer_open() (bsc#1224983).
• CVE-2021-47334: Fixed two use after free in ibmasm_init_one (bsc#1225112).
• CVE-2021-47352: Add validation for used length (bsc#1225124).
• CVE-2021-47355: Fixed possible use-after-free in nicstar_cleanup() (bsc#1225141).
• CVE-2021-47357: Fixed possible use-after-free in ia_module_exit() (bsc#1225144).
• CVE-2021-47361: Fixed error handling in mcb_alloc_bus() (bsc#1225151).
• CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb (bsc#1225082)
• CVE-2021-47401: Fixed stack information leak (bsc#1225242).
• CVE-2021-47423: Fixed file release memory leak (bsc#1225366).
• CVE-2021-47431: Fixed gart.bo pin_count leak (bsc#1225390).
• CVE-2021-47469: Add SPI fix commit to be ignored (bsc#1225347)
• CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit() (bsc#1224907).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48672: Fixed off-by-one error in unflatten_dt_nodes() (CVE-2022-48672 bsc#1223931).
• CVE-2022-48686: Fixed UAF when detecting digest errors (bsc#1223948).
• CVE-2022-48697: Fixed a use-after-free (bsc#1223922).
• CVE-2022-48702: Fixed out of bounds access in snd_emu10k1_pcm_channel_alloc() (bsc#1223923).
• CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)
• CVE-2022-48708: Fixed potential NULL dereference (bsc#1224942).
• CVE-2022-48710: Fixed a possible null pointer dereference (bsc#1225230).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52691: Fixed a double-free in si_dpm_init (bsc#1224607).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2023-52730: Fixed possible resource leaks in some error paths (bsc#1224956).
• CVE-2023-52732: Blocklist the kclient when…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
• CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
• CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
• CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
• CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).

The following non-security bugs were fixed:

• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• cifs: add missing spinlock around tcon refcount (bsc#1213476).
• cifs: avoid dup prefix path in dfs_get_automount_devname() (bsc#1213476).
• cifs: avoid race conditions with parallel reconnects (bsc#1213476).
• cifs: avoid re-lookups in dfs_cache_find() (bsc#1213476).
• cifs: avoid use of global locks for high contention data (bsc#1213476).
• cifs: check only tcon status on tcon related functions (bsc#1213476).
• cifs: do all necessary checks for credits within or before locking (bsc#1213476).
• cifs: do not block in dfs_cache_noreq_update_tgthint() (bsc#1213476).
• cifs: do not refresh cached referrals from unactive mounts (bsc#1213476).
• cifs: do not take exclusive lock for updating target hints (bsc#1213476).
• cifs: fix confusing debug message (bsc#1213476).
• cifs: fix missing unload_nls() in smb2_reconnect() (bsc#1213476).
• cifs: fix potential deadlock in cache_refresh_path() (bsc#1213476).
• cifs: fix refresh of cached referrals (bsc#1213476).
• cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (bsc#1213476).
• cifs: fix source pathname comparison of dfs supers (bsc#1213476).
• cifs: fix status checks in cifs_tree_connect (bsc#1213476).
• cifs: fix use-after-free bug in refresh_cache_worker() (bsc#1213476).
• cifs: get rid of dns resolve worker (bsc#1213476).
• cifs: get rid of mount options string parsing (bsc#1213476).
• cifs: handle cache lookup errors different than -ENOENT (bsc#1213476).
• cifs: ignore ipc reconnect failures during dfs failover (bsc#1213476).
• cifs: match even the scope id for ipv6 addresses (bsc#1213476).
• cifs: optimize reconnect of nested links (bsc#1213476).
• cifs: prevent data race in smb2_reconnect() (bsc#1213476). -…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
• CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-35863: Fix potential UAF in is_valid_oplock_break() (bsc#1224763).
• CVE-2024-35867: Fix potential UAF in cifs_stats_proc_show() (bsc#1224664).
• CVE-2024-35868: Fix potential UAF in cifs_stats_proc_write() (bsc#1224678).
• CVE-2024-26928: Fix potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
• CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
• CVE-2024-35904: Avoid dereference of garbage after mount failure (bsc#1224494).
• CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
• CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).

The following non-security bugs were fixed:

• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• filemap: remove use of wait bookmarks (bsc#1224085).
• idpf: extend tx watchdog timeout (bsc#1224137).
• ipvs: Fix checksumming on GSO of SCTP packets (bsc#1221958)
• powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).
• powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).
• powerpc/powernv: Add a null pointer check to scom_debug_init_one() (bsc#1194869).
• powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV (bsc#1220492 ltc#205270).
• powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).
• powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).
• powerpc: Refactor verification of MSR_RI (bsc#1223191).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
• CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52660: Fiedx IRQ handling due to shared interrupts (bsc#1224443).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26700: Fixed drm/amd/display: Fix MST Null Ptr for RV (bsc#1222870)
• CVE-2024-26715: Fixed NULL pointer dereference in dwc3_gadget_suspend (bsc#1222561).
• CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes bsc#1222608).
• CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
• CVE-2024-26777: Error out if pixclock equals zero in fbdev/sis (bsc#1222765)
• CVE-2024-26778: Error out if pixclock equals zero in fbdev/savage (bsc#1222770)
• CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26839: Fixed a memleak in init_credit_return() (bsc#1222975)
• CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
• CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
• CVE-2024-26907: Fixed a fortify source warning while accessing Eth segment in mlx5 (bsc#1223203).
• CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
• CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
• CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
• CVE-2024-27042: Fixed potential out-of-bounds access in…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-52434: Fixed potential OOBs in smb2_parse_contexts() (bsc#1220148).
• CVE-2023-52458: Fixed check that partition length needs to be aligned with block size (bsc#1220428).
• CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52631: Fixed an NULL dereference bug (bsc#1222264 CVE-2023-52631).
• CVE-2023-52635: Fixed PM/devfreq to synchronize devfreq_monitor_[start/stop] (bsc#1222294).
• CVE-2023-52640: Fixed out-of-bounds in ntfs_listxattr (bsc#1222301).
• CVE-2023-52641: Fixed NULL ptr dereference checking at the end of attr_allocate_frame() (bsc#1222303)
• CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
• CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
• CVE-2023-52659: Fixed to pfn_to_kaddr() not treated as a 64-bit type (bsc#1224442).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52771: Fixed delete_endpoint() vs parent unregistration race (bsc#1225007).
• CVE-2023-52772: Fixed use-after-free in unix_stream_read_actor() (bsc#1224989).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-6238: Fixed kcalloc() arguments order (bsc#1217384).
• CVE-2023-7042: Fixed a null-pointer-dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (bsc#1218336).
• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-21823: Fixed safety flag to struct ends (bsc#1223625).
• CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
• CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
• CVE-2024-24861: Fixed an overflow due to race condition in media/xc4000 device driver in xc4000 xc4000_get_frequency() function (bsc#1219623).
• CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
• CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
• CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
• CVE-2024-26632: Fixed iterating over an empty bio with bio_for_each_folio_all (bsc#1221635).
• CVE-2024-26638: Fixed uninitialize struct msghdr completely (bsc#1221649 CVE-2024-26638).
• CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26654: Fixed use after free in ALSA/sh/aica (bsc#1222304).
• CVE-2024-26656: Fixed drm/amdgpu use-after-free bug (bsc#1222307).
• CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).
• CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).
• CVE-2024-26674: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups (bsc#1222378).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26684: Fixed net/stmmac/xgmac handling of DPP safety error for DMA channels (bsc#1222445).
• CVE-2024-26685: Fixed nilfs2 potential bug in end_buffer_async_write (bsc#1222437).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26704: Fixed a…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47247: net/mlx5e: Fix use-after-free of encap entry in neigh update handler (bsc#1224865).
• CVE-2021-47311: net: qcom/emac: fix UAF in emac_remove (bsc#1225010).
• CVE-2021-47368: enetc: Fix illegal access when reading affinity_hint (bsc#1225161).
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2022-2938: psi: Fix uaf issue when psi trigger is destroyed while being polled (bsc#1202623).
• CVE-2022-48760: USB: core: Fix hang in usb_kill_urb by adding memory barriers (bsc#1226712).
• CVE-2023-52707: sched/psi: Fix use-after-free in ep_remove_wait_queue() (bsc#1225109).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
• CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1224703).
• CVE-2024-36894: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (bsc#1225749).
• CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
• CVE-2024-36940: pinctrl: core: delete incorrect free in pinctrl_enable() (bsc#1225840).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
• CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595)
• CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226758).
• CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).

The following non-security bugs were fixed:

• ocfs2: adjust enabling place for la window (bsc#1219224).
• ocfs2: fix sparse warnings (bsc#1219224).
• ocfs2: improve write IO performance when fragmentation is high (bsc#1219224).
• ocfs2: speed up chain-list searching (bsc#1219224).
• x86/tsc: Trust initial offset in architectural TSC-adjust MSRs (bsc#1222015 bsc#1226962).
• x86/xen: Drop USERGS_SYSRET64 paravirt call (git-fixes).

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-38417: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225600).
• CVE-2023-47210: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225601).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52458: Fixed check that partition length needs to be aligned with block size (bsc#1220428).
• CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52631: Fixed an NULL dereference bug (bsc#1222264 CVE-2023-52631).
• CVE-2023-52640: Fixed out-of-bounds in ntfs_listxattr (bsc#1222301).
• CVE-2023-52641: Fixed NULL ptr dereference checking at the end of attr_allocate_frame() (bsc#1222303)
• CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
• CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52659: Fixed to pfn_to_kaddr() not treated as a 64-bit type (bsc#1224442)
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52699: sysv: don't call sb_bread() with pointers_lock held (bsc#1224659).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52771: Fixed delete_endpoint() vs parent unregistration race (bsc#1225007).
• CVE-2023-52772: Fixed use-after-free in unix_stream_read_actor() (bsc#1224989).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52786: ext4: fix racy may inline data check in dio write (bsc#1224939).
• CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
• CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
• CVE-2023-52855: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (bsc#1225583).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2023-6238: Fixed kcalloc() arguments order (bsc#1217384).
• CVE-2024-21823: Fixed safety flag to struct ends (bsc#1223625).
• CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
• CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
• CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
• CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
• CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
• CVE-2024-26623: pds_core: Prevent race issues involving the adminq (bsc#1221057).
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086) -…

The SUSE Linux Enterprise Micro 6.0 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
• CVE-2024-40948: mm/page_table_check: fix crash on ZONE_DEVICE (bsc#1227801).
• CVE-2024-35890:…

The SUSE Linux Enterprise Micro 6.0 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()…

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Accessibility subsystem;
• Android drivers;
• Drivers core;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• Buffer Sharing and Synchronization framework;
• GPU drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• Device tree and open firmware driver;
• Chrome hardware platform drivers;
• i.MX PM domains;
• TI SCI PM domains driver;
• S/390 drivers;
• SCSI drivers;
• SPI subsystem;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• Framebuffer layer;
• BTRFS file system;
• Network file system server daemon;
• NILFS2 file system;
• File systems infrastructure;
• Pstore file system;
• SMB network file system;
• BPF subsystem;
• Bluetooth subsystem;
• Netfilter;
• io_uring subsystem;
• Core kernel;
• Extra boot config (XBC);
• Memory management;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• eXpress Data Path;
• SELinux security module; (CVE-2024-35967, CVE-2024-35886, CVE-2024-26999, CVE-2024-27008, CVE-2024-26988, CVE-2024-35980, CVE-2024-26982, CVE-2024-35946, CVE-2024-35918, CVE-2024-27015, CVE-2024-35900, CVE-2024-35942, CVE-2024-35879, CVE-2024-35961, CVE-2024-35944, CVE-2024-35934, CVE-2024-35978, CVE-2024-35938, CVE-2024-27003, CVE-2024-35976, CVE-2024-36019, CVE-2024-35880, CVE-2024-35866, CVE-2024-35929, CVE-2024-35917, CVE-2024-35912, CVE-2024-35896, CVE-2024-26986, CVE-2024-35951, CVE-2024-35958, CVE-2024-26997, CVE-2024-35965, CVE-2024-35953, CVE-2024-26993, CVE-2024-26991, CVE-2024-35892, CVE-2024-36026, CVE-2024-35882, CVE-2024-35964, CVE-2024-35865, CVE-2024-35897, CVE-2024-26981, CVE-2024-35872, CVE-2024-36027, CVE-2024-26983, CVE-2024-35909, CVE-2024-35985, CVE-2024-35875, CVE-2024-35890, CVE-2024-26922, CVE-2024-26994, CVE-2024-35903, CVE-2024-35936, CVE-2024-35904, CVE-2024-27013, CVE-2024-36025, CVE-2024-26980, CVE-2024-27006, CVE-2024-35861, CVE-2024-35864, CVE-2024-27018, CVE-2024-36022, CVE-2024-26990, CVE-2024-35968, CVE-2024-35860, CVE-2024-36024, CVE-2024-35933, CVE-2024-27019, CVE-2024-35925, CVE-2024-35950, CVE-2024-35915, CVE-2024-35916, CVE-2024-35956, CVE-2024-36020, CVE-2024-35873, CVE-2024-27002, CVE-2024-35963, CVE-2024-35959, CVE-2024-35937, CVE-2024-27011, CVE-2024-27020, CVE-2024-35883, CVE-2024-35913, CVE-2024-35910, CVE-2024-27021, CVE-2024-35921, CVE-2024-35905, CVE-2024-27010, CVE-2024-35981, CVE-2024-35885, CVE-2024-35955, CVE-2024-35894, CVE-2024-35969, CVE-2024-36018, CVE-2024-35867, CVE-2024-27007, CVE-2024-35908, CVE-2024-26985, CVE-2024-27016, CVE-2024-35960, CVE-2024-35935, CVE-2024-35932, CVE-2024-35957, CVE-2024-27001, CVE-2024-35871, CVE-2024-35907, CVE-2024-35878, CVE-2024-35979, CVE-2024-35972, CVE-2024-35975, CVE-2024-35877, CVE-2024-35926, CVE-2024-26817, CVE-2024-35899, CVE-2024-27004, CVE-2024-35920, CVE-2024-35924, CVE-2024-35977, CVE-2024-35930, CVE-2024-35911, CVE-2024-26996,…

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Accessibility subsystem;
• Android drivers;
• Drivers core;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• Buffer Sharing and Synchronization framework;
• GPU drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• Device tree and open firmware driver;
• Chrome hardware platform drivers;
• i.MX PM domains;
• TI SCI PM domains driver;
• S/390 drivers;
• SCSI drivers;
• SPI subsystem;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• Framebuffer layer;
• BTRFS file system;
• Network file system server daemon;
• NILFS2 file system;
• File systems infrastructure;
• Pstore file system;
• SMB network file system;
• BPF subsystem;
• Bluetooth subsystem;
• Netfilter;
• io_uring subsystem;
• Core kernel;
• Extra boot config (XBC);
• Memory management;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• eXpress Data Path;
• SELinux security module; (CVE-2024-35976, CVE-2024-35873, CVE-2024-35959, CVE-2024-27012, CVE-2024-36025, CVE-2024-35868, CVE-2024-26995, CVE-2024-35916, CVE-2024-36023, CVE-2024-35964, CVE-2024-35890, CVE-2024-26980, CVE-2024-35950, CVE-2024-27006, CVE-2024-35955, CVE-2024-35885, CVE-2024-35960, CVE-2024-35932, CVE-2024-26986, CVE-2024-35884, CVE-2024-35860, CVE-2024-36020, CVE-2024-35930, CVE-2024-35919, CVE-2024-27020, CVE-2024-26928, CVE-2024-35903, CVE-2024-35907, CVE-2024-35904, CVE-2024-35972, CVE-2024-35892, CVE-2024-26921, CVE-2024-35869, CVE-2024-35957, CVE-2024-35967, CVE-2024-35927, CVE-2024-35946, CVE-2024-27000, CVE-2024-35943, CVE-2024-35902, CVE-2024-27013, CVE-2024-35968, CVE-2024-35970, CVE-2024-35865, CVE-2024-36022, CVE-2024-26993, CVE-2024-36027, CVE-2024-35895, CVE-2024-35908, CVE-2024-35901, CVE-2024-35872, CVE-2024-26925, CVE-2024-35917, CVE-2024-35898, CVE-2024-35861, CVE-2024-35900, CVE-2024-26984, CVE-2024-35891, CVE-2023-52699, CVE-2024-35961, CVE-2024-35951, CVE-2024-36019, CVE-2024-27021, CVE-2024-35939, CVE-2024-26997, CVE-2024-26999, CVE-2024-35897, CVE-2024-35896, CVE-2024-26817, CVE-2024-35875, CVE-2024-35935, CVE-2024-27015, CVE-2024-26982, CVE-2024-35958, CVE-2024-26989, CVE-2024-26922, CVE-2024-26811, CVE-2024-27003, CVE-2024-35920, CVE-2024-27007, CVE-2024-35879, CVE-2024-35979, CVE-2024-35978, CVE-2024-35914, CVE-2024-35938, CVE-2024-35913, CVE-2024-26985, CVE-2024-35915, CVE-2024-35974, CVE-2024-27001, CVE-2024-35940, CVE-2024-35867, CVE-2024-26994, CVE-2024-35886, CVE-2024-35899, CVE-2024-27022, CVE-2024-35910, CVE-2024-35893, CVE-2024-27010, CVE-2024-36024, CVE-2024-26926, CVE-2024-26923, CVE-2024-26990, CVE-2024-35912, CVE-2024-26987, CVE-2024-35966, CVE-2024-35977, CVE-2024-35866, CVE-2024-35975, CVE-2024-35965, CVE-2024-35933, CVE-2024-26936, CVE-2024-35889, CVE-2024-35863, CVE-2024-27002, CVE-2024-27018, CVE-2024-36021, CVE-2024-27019, CVE-2024-35921, CVE-2024-35870,…

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Accessibility subsystem;
• Android drivers;
• Drivers core;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• Buffer Sharing and Synchronization framework;
• GPU drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• Device tree and open firmware driver;
• Chrome hardware platform drivers;
• i.MX PM domains;
• TI SCI PM domains driver;
• S/390 drivers;
• SCSI drivers;
• SPI subsystem;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• Framebuffer layer;
• BTRFS file system;
• Network file system server daemon;
• NILFS2 file system;
• File systems infrastructure;
• Pstore file system;
• SMB network file system;
• BPF subsystem;
• Bluetooth subsystem;
• Netfilter;
• io_uring subsystem;
• Core kernel;
• Extra boot config (XBC);
• Memory management;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• eXpress Data Path;
• SELinux security module; (CVE-2024-35955, CVE-2024-35921, CVE-2024-35946, CVE-2024-35934, CVE-2024-26993, CVE-2024-35899, CVE-2024-35952, CVE-2024-35894, CVE-2024-35886, CVE-2024-35872, CVE-2024-35970, CVE-2024-35936, CVE-2024-35907, CVE-2024-27013, CVE-2024-35910, CVE-2024-27009, CVE-2024-35875, CVE-2024-36021, CVE-2024-26923, CVE-2024-26997, CVE-2024-35978, CVE-2024-35981, CVE-2024-27015, CVE-2024-26928, CVE-2024-35963, CVE-2024-35897, CVE-2024-27020, CVE-2024-35922, CVE-2024-27001, CVE-2024-27011, CVE-2024-35940, CVE-2024-35871, CVE-2024-35900, CVE-2024-35869, CVE-2024-35905, CVE-2024-35974, CVE-2024-35873, CVE-2024-35882, CVE-2024-35914, CVE-2024-35956, CVE-2024-35887, CVE-2024-35920, CVE-2024-27018, CVE-2024-35880, CVE-2024-35943, CVE-2024-35912, CVE-2024-35979, CVE-2024-35862, CVE-2024-36019, CVE-2024-35950, CVE-2024-35977, CVE-2024-35918, CVE-2024-26992, CVE-2024-35884, CVE-2024-35916, CVE-2024-26817, CVE-2024-35959, CVE-2024-35909, CVE-2024-35933, CVE-2024-35982, CVE-2024-26996, CVE-2024-35980, CVE-2024-36018, CVE-2024-26925, CVE-2024-35929, CVE-2024-35971, CVE-2024-26990, CVE-2024-35885, CVE-2024-36025, CVE-2024-26998, CVE-2024-35930, CVE-2024-26982, CVE-2024-36022, CVE-2024-35895, CVE-2024-35902, CVE-2024-35911, CVE-2024-27002, CVE-2024-35968, CVE-2024-35861, CVE-2024-35903, CVE-2024-36026, CVE-2024-35896, CVE-2024-35945, CVE-2024-26936, CVE-2024-35954, CVE-2024-26985, CVE-2024-35908, CVE-2024-35924, CVE-2024-35938, CVE-2024-26991, CVE-2024-27017, CVE-2024-26922, CVE-2024-35919, CVE-2024-35915, CVE-2024-35985, CVE-2024-26995, CVE-2024-35870, CVE-2024-27010, CVE-2024-35904, CVE-2024-26999, CVE-2024-26983, CVE-2024-35939, CVE-2024-35865, CVE-2024-35860, CVE-2024-35944, CVE-2024-27021, CVE-2024-27016, CVE-2024-27004, CVE-2024-27019, CVE-2024-36027, CVE-2024-35890, CVE-2024-35975, CVE-2024-35901, CVE-2024-35967, CVE-2024-26986, CVE-2024-35957, CVE-2024-35937, CVE-2024-26988, CVE-2024-35972, CVE-2024-35926, CVE-2024-26926,…

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service.

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Accessibility subsystem;
• Android drivers;
• Drivers core;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• Buffer Sharing and Synchronization framework;
• GPU drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• Device tree and open firmware driver;
• Chrome hardware platform drivers;
• i.MX PM domains;
• TI SCI PM domains driver;
• S/390 drivers;
• SCSI drivers;
• SPI subsystem;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• Framebuffer layer;
• BTRFS file system;
• Network file system server daemon;
• NILFS2 file system;
• File systems infrastructure;
• Pstore file system;
• SMB network file system;
• BPF subsystem;
• Bluetooth subsystem;
• Netfilter;
• io_uring subsystem;
• Core kernel;
• Extra boot config (XBC);
• Memory management;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• eXpress Data Path;
• SELinux security module; (CVE-2024-26988, CVE-2024-36023, CVE-2024-35869, CVE-2024-35938, CVE-2024-27000, CVE-2024-35880, CVE-2024-35915, CVE-2024-35959, CVE-2024-35883, CVE-2024-35886, CVE-2024-35976, CVE-2024-35903, CVE-2024-35980, CVE-2024-27020, CVE-2024-35955, CVE-2024-35964, CVE-2024-26980, CVE-2024-35882, CVE-2024-35927, CVE-2024-35884, CVE-2024-35914, CVE-2024-35905, CVE-2024-26925, CVE-2024-35885, CVE-2024-26990, CVE-2024-27012, CVE-2024-35969, CVE-2024-35862, CVE-2024-35956, CVE-2024-35971, CVE-2024-27022, CVE-2024-35935, CVE-2024-26992, CVE-2024-27010, CVE-2024-35892, CVE-2024-26999, CVE-2024-26989, CVE-2024-35963, CVE-2024-35981, CVE-2024-26997, CVE-2024-35920, CVE-2024-35918, CVE-2024-35933, CVE-2024-35867, CVE-2024-35904, CVE-2024-35890, CVE-2024-35968, CVE-2024-35917, CVE-2024-35897, CVE-2024-26922, CVE-2024-36026, CVE-2024-27013, CVE-2024-26991, CVE-2024-26996, CVE-2024-35873, CVE-2024-26987, CVE-2024-35895, CVE-2024-36027, CVE-2024-35896, CVE-2024-35894, CVE-2024-26983, CVE-2024-35966, CVE-2024-35967, CVE-2024-35945, CVE-2024-27003, CVE-2024-35939, CVE-2024-35861, CVE-2024-26985, CVE-2024-27015, CVE-2024-35982, CVE-2024-35912, CVE-2024-35979, CVE-2024-35879, CVE-2024-26982, CVE-2024-35891, CVE-2024-35925, CVE-2024-35870, CVE-2024-27021, CVE-2024-35866, CVE-2024-27014, CVE-2024-27001, CVE-2024-27004, CVE-2024-35953, CVE-2024-36021, CVE-2024-35931, CVE-2024-27007, CVE-2024-35922, CVE-2024-35872, CVE-2024-35926, CVE-2024-27016, CVE-2024-26984, CVE-2024-35919, CVE-2024-35911, CVE-2024-26923, CVE-2024-35929, CVE-2024-35887, CVE-2024-35893, CVE-2024-35898, CVE-2024-35930, CVE-2024-35934, CVE-2024-35916, CVE-2024-35877, CVE-2024-26926, CVE-2024-35974, CVE-2024-36018, CVE-2024-27002, CVE-2024-35975, CVE-2024-35864, CVE-2024-35958, CVE-2024-35944, CVE-2024-35985, CVE-2024-35940, CVE-2024-35900, CVE-2024-27018, CVE-2024-26936, CVE-2024-36024, CVE-2024-26998, CVE-2024-35954, CVE-2024-35878, CVE-2024-26928, CVE-2024-35952, CVE-2024-36020, CVE-2024-26986, CVE-2024-35950,…

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• SuperH RISC architecture;
• MMC subsystem;
• Network drivers;
• SCSI drivers;
• GFS2 file system;
• IPv4 networking;
• IPv6 networking;
• HD-audio driver; (CVE-2024-26830, CVE-2024-39484, CVE-2024-36901, CVE-2024-26929, CVE-2024-26921, CVE-2021-46926, CVE-2023-52629, CVE-2023-52760)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• SuperH RISC architecture;
• MMC subsystem;
• Network drivers;
• SCSI drivers;
• GFS2 file system;
• IPv4 networking;
• IPv6 networking;
• HD-audio driver; (CVE-2024-26830, CVE-2024-39484, CVE-2024-36901, CVE-2024-26929, CVE-2024-26921, CVE-2021-46926, CVE-2023-52629, CVE-2023-52760)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• SuperH RISC architecture;
• MMC subsystem;
• Network drivers;
• SCSI drivers;
• GFS2 file system;
• IPv4 networking;
• IPv6 networking;
• HD-audio driver; (CVE-2024-26830, CVE-2024-39484, CVE-2024-36901, CVE-2024-26929, CVE-2024-26921, CVE-2021-46926, CVE-2023-52629, CVE-2023-52760)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• SuperH RISC architecture;
• MMC subsystem;
• Network drivers;
• SCSI drivers;
• GFS2 file system;
• IPv4 networking;
• IPv6 networking;
• HD-audio driver; (CVE-2024-26830, CVE-2024-39484, CVE-2024-36901, CVE-2024-26929, CVE-2024-26921, CVE-2021-46926, CVE-2023-52629, CVE-2023-52760)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• SuperH RISC architecture;
• User-Mode Linux (UML);
• MMC subsystem;
• Network drivers;
• GFS2 file system;
• IPv4 networking;
• IPv6 networking; (CVE-2024-26921, CVE-2023-52629, CVE-2024-26680, CVE-2024-26830, CVE-2024-39484, CVE-2024-39292, CVE-2024-36901, CVE-2023-52760)