CVE-2024-27413

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

mptcp: ensure tx skbs always have the MPTCP ext

Due to signed/unsigned comparison, the expression:

info->size_goal - skb->len > 0

evaluates to true when the size goal is smaller than the skb size. That results in lack of tx cache refill, so that the skb allocated by the core TCP code lacks the required MPTCP skb extensions.

Due to the above, syzbot is able to trigger the following WARN_ON():

WARNING: CPU: 1 PID: 810 at net/mptcp/protocol.c:1366 mptcp_sendmsg_frag+0x1362/0x1bc0 net/mptcp/protocol.c:1366 Modules linked in: CPU: 1 PID: 810 Comm: syz-executor.4 Not tainted 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:mptcp_sendmsg_frag+0x1362/0x1bc0 net/mptcp/protocol.c:1366 Code: ff 4c 8b 74 24 50 48 8b 5c 24 58 e9 0f fb ff ff e8 13 44 8b f8 4c 89 e7 45 31 ed e8 98 57 2e fe e9 81 f4 ff ff e8 fe 43 8b f8 <0f> 0b 41 bd ea ff ff ff e9 6f f4 ff ff 4c 89 e7 e8 b9 8e d2 f8 e9 RSP: 0018:ffffc9000531f6a0 EFLAGS: 00010216 RAX: 000000000000697f RBX: 0000000000000000 RCX: ffffc90012107000 RDX: 0000000000040000 RSI: ffffffff88eac9e2 RDI: 0000000000000003 RBP: ffff888078b15780 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff88eac017 R11: 0000000000000000 R12: ffff88801de0a280 R13: 0000000000006b58 R14: ffff888066278280 R15: ffff88803c2fe9c0 FS: 00007fd9f866e700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007faebcb2f718 CR3: 00000000267cb000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __mptcp_push_pending+0x1fb/0x6b0 net/mptcp/protocol.c:1547 mptcp_release_cb+0xfe/0x210 net/mptcp/protocol.c:3003 release_sock+0xb4/0x1b0 net/core/sock.c:3206 sk_stream_wait_memory+0x604/0xed0 net/core/stream.c:145 mptcp_sendmsg+0xc39/0x1bc0 net/mptcp/protocol.c:1749 inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:643 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 sock_write_iter+0x2a0/0x3e0 net/socket.c:1057 call_write_iter include/linux/fs.h:2163 [inline] new_sync_write+0x40b/0x640 fs/read_write.c:507 vfs_write+0x7cf/0xae0 fs/read_write.c:594 ksys_write+0x1ee/0x250 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4665f9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd9f866e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000056c038 RCX: 00000000004665f9 RDX: 00000000000e7b78 RSI: 0000000020000000 RDI: 0000000000000003 RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c038 R13: 0000000000a9fb1f R14: 00007fd9f866e300 R15: 0000000000022000

Fix the issue rewriting the relevant expression to avoid sign-related problems - note: size_goal is always >= 0.

Additionally, ensure that the skb in the tx cache always carries the relevant extension.(CVE-2021-47370)

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix even more out of bound writes from debugfs

CVE-2021-42327 was fixed by:

commit f23750b5b3d98653b31d4469592935ef6364ad67 Author: Thelford Williams <[email protected]> Date: Wed Oct 13 16:04:13 2021 -0400

drm/amdgpu: fix out of bounds write

but amdgpu_dm_debugfs.c contains more of the same issue so fix the remaining ones.

v2: * Add missing fix in dp_max_bpc_write (Harry…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

RDMA: Verify port when creating flow rule

Validate port value provided by the user and with that remove no longer needed validation by the driver. The missing check in the mlx5_ib driver could cause to the below oops.

Call trace: _create_flow_rule+0x2d4/0xf28 [mlx5_ib] mlx5_ib_create_flow+0x2d0/0x5b0 [mlx5_ib] ib_uverbs_ex_create_flow+0x4cc/0x624 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xd4/0x150 [ib_uverbs] ib_uverbs_cmd_verbs.isra.7+0xb28/0xc50 [ib_uverbs] ib_uverbs_ioctl+0x158/0x1d0 [ib_uverbs] do_vfs_ioctl+0xd0/0xaf0 ksys_ioctl+0x84/0xb4 __arm64_sys_ioctl+0x28/0xc4 el0_svc_common.constprop.3+0xa4/0x254 el0_svc_handler+0x84/0xa0 el0_svc+0x10/0x26c Code: b9401260 f9615681 51000400 8b001c20 (f9403c1a)(CVE-2021-47265)

In the Linux kernel, the following vulnerability has been resolved:

mISDN: fix possible use-after-free in HFC_cleanup()

This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself.(CVE-2021-47356)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: ensure tx skbs always have the MPTCP ext

Due to signed/unsigned comparison, the expression:

info->size_goal - skb->len > 0

evaluates to true when the size goal is smaller than the skb size. That results in lack of tx cache refill, so that the skb allocated by the core TCP code lacks the required MPTCP skb extensions.

Due to the above, syzbot is able to trigger the following WARN_ON():

WARNING: CPU: 1 PID: 810 at net/mptcp/protocol.c:1366 mptcp_sendmsg_frag+0x1362/0x1bc0 net/mptcp/protocol.c:1366 Modules linked in: CPU: 1 PID: 810 Comm: syz-executor.4 Not tainted 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:mptcp_sendmsg_frag+0x1362/0x1bc0 net/mptcp/protocol.c:1366 Code: ff 4c 8b 74 24 50 48 8b 5c 24 58 e9 0f fb ff ff e8 13 44 8b f8 4c 89 e7 45 31 ed e8 98 57 2e fe e9 81 f4 ff ff e8 fe 43 8b f8 <0f> 0b 41 bd ea ff ff ff e9 6f f4 ff ff 4c 89 e7 e8 b9 8e d2 f8 e9 RSP: 0018:ffffc9000531f6a0 EFLAGS: 00010216 RAX: 000000000000697f RBX: 0000000000000000 RCX: ffffc90012107000 RDX: 0000000000040000 RSI: ffffffff88eac9e2 RDI: 0000000000000003 RBP: ffff888078b15780 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff88eac017 R11: 0000000000000000 R12: ffff88801de0a280 R13: 0000000000006b58 R14: ffff888066278280 R15: ffff88803c2fe9c0 FS: 00007fd9f866e700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007faebcb2f718 CR3: 00000000267cb000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __mptcp_push_pending+0x1fb/0x6b0 net/mptcp/protocol.c:1547 mptcp_release_cb+0xfe/0x210 net/mptcp/protocol.c:3003 release_sock+0xb4/0x1b0 net/core/sock.c:3206 sk_stream_wait_memory+0x604/0xed0 net/core/stream.c:145 mptcp_sendmsg+0xc39/0x1bc0 net/mptcp/protocol.c:1749 inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:643 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 sock_write_iter+0x2a0/0x3e0 net/socket.c:1057 call_write_iter include/linux/fs.h:2163 [inline] new_sync_write+0x40b/0x640 fs/read_write.c:507 vfs_write+0x7cf/0xae0 fs/read_write.c:594 ksys_write+0x1ee/0x250 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: cdc_eem: fix tx fixup skb leak

when usbnet transmit a skb, eem fixup it in eem_tx_fixup(), if skb_copy_expand() failed, it return NULL, usbnet_start_xmit() will have no chance to free original skb.

fix it by free orginal skb in eem_tx_fixup() first, then check skb clone status, if failed, return NULL to usbnet.(CVE-2021-47236)

In the Linux kernel, the following vulnerability has been resolved:

gfs2: Fix use-after-free in gfs2_glock_shrink_scan

The GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to remove the glock from the lru list in __gfs2_glock_put().

On the shrink scan path, the same flag is cleared under lru_lock but because of cond_resched_lock(&lru_lock) in gfs2_dispose_glock_lru(), progress on the put side can be made without deleting the glock from the lru list.

Keep GLF_LRU across the race window opened by cond_resched_lock(&lru_lock) to ensure correct behavior on both sides - clear GLF_LRU after list_del under lru_lock.(CVE-2021-47254)

In the Linux kernel, the following vulnerability has been resolved:

netrom: Decrease sock refcount when sock timers expire

Commit 63346650c1a9 ("netrom: switch to sock timer API") switched to use sock timer API. It replaces mod_timer() by sk_reset_timer(), and del_timer() by sk_stop_timer().

Function sk_reset_timer() will increase the refcount of sock if it is called on an inactive timer, hence, in case the timer expires, we need to decrease the refcount ourselves in the handler, otherwise, the sock refcount will be unbalanced and the sock will never be freed.(CVE-2021-47294)

In the Linux kernel, the following vulnerability has been resolved:

memory: fsl_ifc: fix leak of IO mapping on probe failure

On probe error the driver should unmap the IO memory. Smatch reports:

drivers/memory/fsl_ifc.c:298 fsl_ifc_ctrl_probe() warn: 'fsl_ifc_ctrl_dev->gregs' not released on lines: 298.(CVE-2021-47315)

In the Linux kernel, the following vulnerability has been resolved:

watchdog: Fix possible use-after-free in wdt_startup()

This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself.(CVE-2021-47324)

In the Linux kernel, the following vulnerability has been resolved:

scsi: megaraid_sas: Fix resource leak in case of probe failure

The driver doesn't clean up all the allocated resources properly when scsi_add_host(), megasas_start_aen() function fails during the PCI device probe.

Clean up all those resources.(CVE-2021-47329)

In the Linux kernel, the following vulnerability has been resolved:

ipack: ipoctal: fix module reference leak

A reference to the carrier module was taken on every open but was only released once when the final reference to the tty struct was dropped.

Fix this by taking the module reference and initialising the tty driver data when installing the tty.(CVE-2021-47403)

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc2: check return value after calling platform_get_resource()

It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value.(CVE-2021-47409)

In the Linux kernel, the following vulnerability has been resolved:

i40e: Fix freeing of uninitialized misc IRQ vector

When VSI set up failed in i40e_probe() as part of PF switch set up driver was trying to free misc IRQ vectors in i40e_clear_interrupt_scheme and produced a kernel Oops:

Trying to free already-free IRQ 266 WARNING:…

In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect allocation size gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures is not enough for a 64-bit phys_addr_t: drivers/firmware/efi/capsule-loader.c: In function 'efi_capsule_open': drivers/firmware/efi/capsule-loader.c:295:24: error: allocation of insufficient size '4' for type 'phys_addr_t' {aka 'long long unsigned int'} with size '8' [-Werror=alloc-size] 295 | cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL); | ^ Use the correct type instead here.

• CVE-url: https://ubuntu.com/security/CVE-2024-26764
  • aio: remove an outdated BUG_ON and comment in aio_complete
  • aio: remove the extra get_file/fput pair in io_submit_one
  • aio: refactor read/write iocb setup
  • fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
• CVE-url: https://ubuntu.com/security/CVE-2024-36971
  • net: fix __dst_negative_advice() race
• CVE-url: https://ubuntu.com/security/CVE-2024-26840
  • cachefiles: fix memory leak in cachefiles_add_cache()
• CVE-url: https://ubuntu.com/security/CVE-2021-47543
  • perf report: Fix memory leaks around perf_tip()
• CVE-url: https://ubuntu.com/security/CVE-2024-27405
  • usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
  • usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
• CVE-url: https://ubuntu.com/security/CVE-2024-26779
  • wifi: mac80211: fix race condition on enabling fast-xmit
• CVE-url: https://ubuntu.com/security/CVE-2024-26772
  • ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
• CVE-url: https://ubuntu.com/security/CVE-2024-26845
  • scsi: target: core: Add TMF to tmr_list handling
• CVE-url: https://ubuntu.com/security/CVE-2021-47063
  • drm: bridge/panel: Cleanup connector on bridge detach
• CVE-url: https://ubuntu.com/security/CVE-2024-26804
  • net: ip_tunnel: prevent perpetual headroom growth
• CVE-url: https://ubuntu.com/security/CVE-2024-27410
  • wifi: nl80211: reject iftype change with mesh ID change
• CVE-url: https://ubuntu.com/security/CVE-2024-26793
  • gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
• CVE-url: https://ubuntu.com/security/CVE-2024-26754
  • gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
• CVE-url: https://ubuntu.com/security/CVE-2024-26839
  • IB/hfi1: Fix a memleak in init_credit_return
• CVE-url: https://ubuntu.com/security/CVE-2024-26773
  • ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
• CVE-url: https://ubuntu.com/security/CVE-2024-27413
  • efi/capsule-loader: fix incorrect allocation size
• CVE-url: https://ubuntu.com/security/CVE-2024-26736
  • afs: Increase buffer size in afs_update_volume_status()
• CVE-url: https://ubuntu.com/security/CVE-2024-26777
  • fbdev: sis: Error out if pixclock equals zero
• CVE-url: https://ubuntu.com/security/CVE-2024-26778
  • fbdev: savage: Error out if pixclock equals zero
• CVE-url: https://ubuntu.com/security/CVE-2024-26763
  • dm-crypt: don't modify the data when using authenticated encryption
• CVE-url: https://ubuntu.com/security/CVE-2024-26733
  • arp: Prevent overflow in arp_req_get().
• CVE-url: https://ubuntu.com/security/CVE-2024-26791
  • btrfs: dev-replace: properly validate device names

• CVE-url: https://ubuntu.com/security/CVE-2024-26764
  • aio: remove an outdated BUG_ON and comment in aio_complete
  • aio: remove the extra get_file/fput pair in io_submit_one
  • aio: refactor read/write iocb setup
  • fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
• CVE-url: https://ubuntu.com/security/CVE-2024-36971
  • net: fix __dst_negative_advice() race
• CVE-url: https://ubuntu.com/security/CVE-2024-26840
  • cachefiles: fix memory leak in cachefiles_add_cache()
• CVE-url: https://ubuntu.com/security/CVE-2021-47543
  • perf report: Fix memory leaks around perf_tip()
• CVE-url: https://ubuntu.com/security/CVE-2024-27405
  • usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
  • usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
• CVE-url: https://ubuntu.com/security/CVE-2024-26779
  • wifi: mac80211: fix race condition on enabling fast-xmit
• CVE-url: https://ubuntu.com/security/CVE-2024-26772
  • ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
• CVE-url: https://ubuntu.com/security/CVE-2024-26845
  • scsi: target: core: Add TMF to tmr_list handling
• CVE-url: https://ubuntu.com/security/CVE-2021-47063
  • drm: bridge/panel: Cleanup connector on bridge detach
• CVE-url: https://ubuntu.com/security/CVE-2024-26804
  • net: ip_tunnel: prevent perpetual headroom growth
• CVE-url: https://ubuntu.com/security/CVE-2024-27410
  • wifi: nl80211: reject iftype change with mesh ID change
• CVE-url: https://ubuntu.com/security/CVE-2024-26793
  • gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
• CVE-url: https://ubuntu.com/security/CVE-2024-26754
  • gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
• CVE-url: https://ubuntu.com/security/CVE-2024-26839
  • IB/hfi1: Fix a memleak in init_credit_return
• CVE-url: https://ubuntu.com/security/CVE-2024-26773
  • ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
• CVE-url: https://ubuntu.com/security/CVE-2024-27413
  • efi/capsule-loader: fix incorrect allocation size
• CVE-url: https://ubuntu.com/security/CVE-2024-26736
  • afs: Increase buffer size in afs_update_volume_status()
• CVE-url: https://ubuntu.com/security/CVE-2024-26777
  • fbdev: sis: Error out if pixclock equals zero
• CVE-url: https://ubuntu.com/security/CVE-2024-26778
  • fbdev: savage: Error out if pixclock equals zero
• CVE-url: https://ubuntu.com/security/CVE-2024-26763
  • dm-crypt: don't modify the data when using authenticated encryption
• CVE-url: https://ubuntu.com/security/CVE-2024-26733
  • arp: Prevent overflow in arp_req_get().
• CVE-url: https://ubuntu.com/security/CVE-2024-26791
  • btrfs: dev-replace: properly validate device names

In the Linux kernel, the following vulnerability has been resolved:

efi/capsule-loader: fix incorrect allocation size

gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures is not enough for a 64-bit phys_addr_t:

drivers/firmware/efi/capsule-loader.c: In function 'efi_capsule_open': drivers/firmware/efi/capsule-loader.c:295:24: error: allocation of insufficient size '4' for type 'phys_addr_t' {aka 'long long unsigned int'} with size '8' [-Werror=alloc-size] 295 | cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL); | ^

Use the correct type instead here.

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
• CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52660: Fiedx IRQ handling due to shared interrupts (bsc#1224443).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26715: Fixed NULL pointer dereference in dwc3_gadget_suspend (bsc#1222561).
• CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes bsc#1222608).
• CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
• CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
• CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
• CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
• CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
• CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
• CVE-2024-27042: Fixed potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (bsc#1223823).
• CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).
• CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181).
• CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr() (bsc#1224721)
• CVE-2024-27419: Fixed data-races around sysctl_net_busy_read (bsc#1224759)
• CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
• CVE-2024-35791: Flush pages under…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
• CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
• CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
• CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).

The following non-security bugs were fixed:

• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• cifs: add missing spinlock around tcon refcount (bsc#1213476).
• cifs: avoid dup prefix path in dfs_get_automount_devname() (bsc#1213476).
• cifs: avoid race conditions with parallel reconnects (bsc#1213476).
• cifs: avoid re-lookups in dfs_cache_find() (bsc#1213476).
• cifs: avoid use of global locks for high contention data (bsc#1213476).
• cifs: check only tcon status on tcon related functions (bsc#1213476).
• cifs: do all necessary checks for credits within or before locking (bsc#1213476).
• cifs: do not block in dfs_cache_noreq_update_tgthint() (bsc#1213476).
• cifs: do not refresh cached referrals from unactive mounts (bsc#1213476).
• cifs: do not take exclusive lock for updating target hints (bsc#1213476).
• cifs: fix confusing debug message (bsc#1213476).
• cifs: fix missing unload_nls() in smb2_reconnect() (bsc#1213476).
• cifs: fix potential deadlock in cache_refresh_path() (bsc#1213476).
• cifs: fix refresh of cached referrals (bsc#1213476).
• cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (bsc#1213476).
• cifs: fix source pathname comparison of dfs supers (bsc#1213476).
• cifs: fix status checks in cifs_tree_connect (bsc#1213476).
• cifs: fix use-after-free bug in refresh_cache_worker() (bsc#1213476).
• cifs: get rid of dns resolve worker (bsc#1213476).
• cifs: get rid of mount options string parsing (bsc#1213476).
• cifs: handle cache lookup errors different than -ENOENT (bsc#1213476).
• cifs: ignore ipc reconnect failures during dfs failover (bsc#1213476).
• cifs: match even the scope id for ipv6 addresses (bsc#1213476).
• cifs: optimize reconnect of nested links (bsc#1213476).
• cifs: prevent data race in smb2_reconnect() (bsc#1213476). -…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
• CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
• CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
• CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
• CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
• CVE-2024-35904: Fixed dereference of garbage after mount failure (bsc#1224494).
• CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
• CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).

The following non-security bugs were fixed:

• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• filemap: remove use of wait bookmarks (bsc#1224085).
• idpf: extend tx watchdog timeout (bsc#1224137).
• ipvs: Fix checksumming on GSO of SCTP packets (bsc#1221958)
• powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).
• powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).
• powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).
• powerpc/powernv: Add a null pointer check to scom_debug_init_one() (bsc#1194869).
• powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV (bsc#1220492 ltc#205270).
• powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).
• powerpc: Refactor verification of MSR_RI (bsc#1223191).
• supported.conf: support tcp_dctcp module (jsc#PED-8111)

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575).
• CVE-2024-36938: Fixed NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761).
• CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2024-35998: Fixed lock ordering potential deadlock in cifs_sync_mid_result (bsc#1224549).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
• CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
• CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break() (bsc#1224668).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
• CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
• CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
• CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key() (bsc#1224667).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-35869: Guarantee refcounted children from parent session (bsc#1224679).
• CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2024-35964: Fixed not validating setsockopt user input (bsc#1224581).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
• CVE-2024-35860: struct bpf_link and bpf_link_ops kABI workaround (bsc#1224531).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).
• CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).
• CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
• CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
• CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
• CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios (bsc#1224530).
• CVE-2024-35852: Fixed memory leak when canceling rehash work (bsc#1224502).
• CVE-2024-36006: Fixed incorrect list API usage (bsc#1224541).
• CVE-2024-36007: Fixed warning during rehash (bsc#1224543).
• CVE-2024-35885: Stop interface during shutdown (bsc#1224519).
• CVE-2024-35907: Call request_irq() after NAPI initialized (bsc#1224492).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
• CVE-2024-26764: Fixed IOCB_AIO_RW check in fs/aio before the struct aio_kiocb conversion (bsc#1222721).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).
• CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).
• CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).
• CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).
• CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).
• CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).
• CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
• CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
• CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).
• CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).
• CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).
• CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).
• CVE-2024-26772: Fixed ext4 to avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (bsc#1222613).
• CVE-2024-26906: Disallowed vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26816: Ignore relocations in .notes section when building with CONFIG_XEN_PV=y (bsc#1222624).
• CVE-2024-26783: Fixed mm/vmscan bug when calling wakeup_kswapd() with a wrong zone index (bsc#1222615).
• CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).
• CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).
• CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).
• CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).
• CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
• CVE-2024-26836: Fixed platform/x86/think-lmi password opcode ordering for workstations (bsc#1222968).
• CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
• CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found() (bsc#1222618).
• CVE-2024-26807: Fixed spi/cadence-qspi NULL pointer reference in runtime PM hooks (bsc#1222801).
• CVE-2024-26737: Fixed selftests/bpf racing between bpf_timer_cancel_and_free and bpf_timer_cancel (bsc#1222557).
• CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).
• CVE-2024-26684: Fixed net/stmmac/xgmac handling of DPP safety error for DMA channels (bsc#1222445).
• CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).
• CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).
• CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
• CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
• CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
• CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
• CVE-2023-6270: Fixed a use-after-free issue in…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
• CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
• CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
• CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
• CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
• CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).

The following non-security bugs were fixed:

• NFC: nxp: add NXP1002 (bsc#1185589).
• PCI: rpaphp: Add MODULE_DESCRIPTION (bsc#1176869 ltc#188243).
• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• md: Replace snprintf with scnprintf (git-fixes).
• netfilter: nf_tables: GC transaction race with abort path (git-fixes).
• netfilter: nf_tables: GC transaction race with netns dismantle (git-fixes).
• netfilter: nf_tables: defer gc run if previous batch is still pending (git-fixes).
• netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path (git-fixes).
• netfilter: nf_tables: fix kdoc warnings after gc rework (git-fixes).
• netfilter: nf_tables: fix memleak when more than 255 elements expired (git-fixes).
• netfilter: nf_tables: mark newset as dead on transaction abort (git-fixes).
• netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (git-fixes).
• netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure (git-fixes).
• netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (git-fixes).
• netfilter: nf_tables: skip dead set elements in netlink dump (git-fixes).
• netfilter: nf_tables: use correct lock to protect gc_list (git-fixes).
• netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration (git-fixes).
• netfilter: nft_set_rbtree: Add missing expired checks (git-fixes).
• netfilter: nft_set_rbtree: Detect partial overlap with start endpoint match (git-fixes).
• netfilter: nft_set_rbtree: Detect partial overlaps on insertion (git-fixes).
• netfilter: nft_set_rbtree: Do not account for expired elements on insertion (git-fixes).
• netfilter: nft_set_rbtree: Drop spurious condition for overlap detection on insertion (git-fixes).
• netfilter: nft_set_rbtree: Handle outcomes of tree rotations in overlap detection (git-fixes).
• netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start() (git-fixes). -…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
• CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
• CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
• CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
• CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).

The following non-security bugs were fixed:

• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• cifs: add missing spinlock around tcon refcount (bsc#1213476).
• cifs: avoid dup prefix path in dfs_get_automount_devname() (bsc#1213476).
• cifs: avoid race conditions with parallel reconnects (bsc#1213476).
• cifs: avoid re-lookups in dfs_cache_find() (bsc#1213476).
• cifs: avoid use of global locks for high contention data (bsc#1213476).
• cifs: check only tcon status on tcon related functions (bsc#1213476).
• cifs: do all necessary checks for credits within or before locking (bsc#1213476).
• cifs: do not block in dfs_cache_noreq_update_tgthint() (bsc#1213476).
• cifs: do not refresh cached referrals from unactive mounts (bsc#1213476).
• cifs: do not take exclusive lock for updating target hints (bsc#1213476).
• cifs: fix confusing debug message (bsc#1213476).
• cifs: fix missing unload_nls() in smb2_reconnect() (bsc#1213476).
• cifs: fix potential deadlock in cache_refresh_path() (bsc#1213476).
• cifs: fix refresh of cached referrals (bsc#1213476).
• cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (bsc#1213476).
• cifs: fix source pathname comparison of dfs supers (bsc#1213476).
• cifs: fix status checks in cifs_tree_connect (bsc#1213476).
• cifs: fix use-after-free bug in refresh_cache_worker() (bsc#1213476).
• cifs: get rid of dns resolve worker (bsc#1213476).
• cifs: get rid of mount options string parsing (bsc#1213476).
• cifs: handle cache lookup errors different than -ENOENT (bsc#1213476).
• cifs: ignore ipc reconnect failures during dfs failover (bsc#1213476).
• cifs: match even the scope id for ipv6 addresses (bsc#1213476).
• cifs: optimize reconnect of nested links (bsc#1213476).
• cifs: prevent data race in smb2_reconnect() (bsc#1213476). -…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
• CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-35863: Fix potential UAF in is_valid_oplock_break() (bsc#1224763).
• CVE-2024-35867: Fix potential UAF in cifs_stats_proc_show() (bsc#1224664).
• CVE-2024-35868: Fix potential UAF in cifs_stats_proc_write() (bsc#1224678).
• CVE-2024-26928: Fix potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
• CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
• CVE-2024-35904: Avoid dereference of garbage after mount failure (bsc#1224494).
• CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
• CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).

The following non-security bugs were fixed:

• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• filemap: remove use of wait bookmarks (bsc#1224085).
• idpf: extend tx watchdog timeout (bsc#1224137).
• ipvs: Fix checksumming on GSO of SCTP packets (bsc#1221958)
• powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).
• powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).
• powerpc/powernv: Add a null pointer check to scom_debug_init_one() (bsc#1194869).
• powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV (bsc#1220492 ltc#205270).
• powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).
• powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).
• powerpc: Refactor verification of MSR_RI (bsc#1223191).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
• CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52660: Fiedx IRQ handling due to shared interrupts (bsc#1224443).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26700: Fixed drm/amd/display: Fix MST Null Ptr for RV (bsc#1222870)
• CVE-2024-26715: Fixed NULL pointer dereference in dwc3_gadget_suspend (bsc#1222561).
• CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes bsc#1222608).
• CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
• CVE-2024-26777: Error out if pixclock equals zero in fbdev/sis (bsc#1222765)
• CVE-2024-26778: Error out if pixclock equals zero in fbdev/savage (bsc#1222770)
• CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26839: Fixed a memleak in init_credit_return() (bsc#1222975)
• CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
• CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
• CVE-2024-26907: Fixed a fortify source warning while accessing Eth segment in mlx5 (bsc#1223203).
• CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
• CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
• CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
• CVE-2024-27042: Fixed potential out-of-bounds access in…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-52434: Fixed potential OOBs in smb2_parse_contexts() (bsc#1220148).
• CVE-2023-52458: Fixed check that partition length needs to be aligned with block size (bsc#1220428).
• CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52631: Fixed an NULL dereference bug (bsc#1222264 CVE-2023-52631).
• CVE-2023-52635: Fixed PM/devfreq to synchronize devfreq_monitor_[start/stop] (bsc#1222294).
• CVE-2023-52640: Fixed out-of-bounds in ntfs_listxattr (bsc#1222301).
• CVE-2023-52641: Fixed NULL ptr dereference checking at the end of attr_allocate_frame() (bsc#1222303)
• CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
• CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
• CVE-2023-52659: Fixed to pfn_to_kaddr() not treated as a 64-bit type (bsc#1224442).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52771: Fixed delete_endpoint() vs parent unregistration race (bsc#1225007).
• CVE-2023-52772: Fixed use-after-free in unix_stream_read_actor() (bsc#1224989).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-6238: Fixed kcalloc() arguments order (bsc#1217384).
• CVE-2023-7042: Fixed a null-pointer-dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (bsc#1218336).
• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-21823: Fixed safety flag to struct ends (bsc#1223625).
• CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
• CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
• CVE-2024-24861: Fixed an overflow due to race condition in media/xc4000 device driver in xc4000 xc4000_get_frequency() function (bsc#1219623).
• CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
• CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
• CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
• CVE-2024-26632: Fixed iterating over an empty bio with bio_for_each_folio_all (bsc#1221635).
• CVE-2024-26638: Fixed uninitialize struct msghdr completely (bsc#1221649 CVE-2024-26638).
• CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26654: Fixed use after free in ALSA/sh/aica (bsc#1222304).
• CVE-2024-26656: Fixed drm/amdgpu use-after-free bug (bsc#1222307).
• CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).
• CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).
• CVE-2024-26674: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups (bsc#1222378).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26684: Fixed net/stmmac/xgmac handling of DPP safety error for DMA channels (bsc#1222445).
• CVE-2024-26685: Fixed nilfs2 potential bug in end_buffer_async_write (bsc#1222437).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26704: Fixed a…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-38417: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225600).
• CVE-2023-47210: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225601).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52458: Fixed check that partition length needs to be aligned with block size (bsc#1220428).
• CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52631: Fixed an NULL dereference bug (bsc#1222264 CVE-2023-52631).
• CVE-2023-52640: Fixed out-of-bounds in ntfs_listxattr (bsc#1222301).
• CVE-2023-52641: Fixed NULL ptr dereference checking at the end of attr_allocate_frame() (bsc#1222303)
• CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
• CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52659: Fixed to pfn_to_kaddr() not treated as a 64-bit type (bsc#1224442)
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52699: sysv: don't call sb_bread() with pointers_lock held (bsc#1224659).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52771: Fixed delete_endpoint() vs parent unregistration race (bsc#1225007).
• CVE-2023-52772: Fixed use-after-free in unix_stream_read_actor() (bsc#1224989).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52786: ext4: fix racy may inline data check in dio write (bsc#1224939).
• CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
• CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
• CVE-2023-52855: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (bsc#1225583).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2023-6238: Fixed kcalloc() arguments order (bsc#1217384).
• CVE-2024-21823: Fixed safety flag to struct ends (bsc#1223625).
• CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
• CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
• CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
• CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
• CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
• CVE-2024-26623: pds_core: Prevent race issues involving the adminq (bsc#1221057).
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086) -…

The SUSE Linux Enterprise Micro 6.0 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
• CVE-2024-40948: mm/page_table_check: fix crash on ZONE_DEVICE (bsc#1227801).
• CVE-2024-35890:…

The SUSE Linux Enterprise Micro 6.0 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).
• CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).
• CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
• CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).
• CVE-2024-44996: vsock: fix recursive ->recvmsg calls (bsc#1230205).
• CVE-2024-45828: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request (bsc#1235705).
• CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).
• CVE-2024-48881: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again (bsc#1235727).
• CVE-2024-49948: net: add more sanity checks to qdisc_pkt_len_init() (bsc#1232161).
• CVE-2024-49951: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (bsc#1232158).
• CVE-2024-49978: gso: fix udp gso fraglist segmentation after pull from frag_list (bsc#1232101).
• CVE-2024-49998: net: dsa: improve shutdown sequence (bsc#1232087).
• CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).
• CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).
• CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).
• CVE-2024-50151: smb: client: fix OOBs when building SMB2_IOCTL request (bsc#1233055).
• CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unuse_vma (bsc#1233112).
• CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).
• CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).
• CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).
• CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).
• CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).
• CVE-2024-50299: sctp: properly validate chunk size in sctp_sf_ootb() (bsc#1233488).
• CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
• CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).
• CVE-2024-53091: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (bsc#1233638).
• CVE-2024-53099: bpf: Check validity of link->type in bpf_link_show_fdinfo() (bsc#1233772).
• CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).
• CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).
• CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).
• CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).
• CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).
• CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).
• CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).
• CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).
• CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)
• CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).
• CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
• CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).
• CVE-2024-53161:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).
• CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).
• CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
• CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).
• CVE-2024-44996: vsock: fix recursive ->recvmsg calls (bsc#1230205).
• CVE-2024-45828: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request (bsc#1235705).
• CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).
• CVE-2024-48881: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again (bsc#1235727).
• CVE-2024-49948: net: add more sanity checks to qdisc_pkt_len_init() (bsc#1232161).
• CVE-2024-49951: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (bsc#1232158).
• CVE-2024-49978: gso: fix udp gso fraglist segmentation after pull from frag_list (bsc#1232101).
• CVE-2024-49998: net: dsa: improve shutdown sequence (bsc#1232087).
• CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).
• CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).
• CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).
• CVE-2024-50151: smb: client: fix OOBs when building SMB2_IOCTL request (bsc#1233055).
• CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unuse_vma (bsc#1233112).
• CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).
• CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).
• CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).
• CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).
• CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).
• CVE-2024-50299: sctp: properly validate chunk size in sctp_sf_ootb() (bsc#1233488).
• CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
• CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).
• CVE-2024-53091: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (bsc#1233638).
• CVE-2024-53099: bpf: Check validity of link->type in bpf_link_show_fdinfo() (bsc#1233772).
• CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).
• CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).
• CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).
• CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).
• CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).
• CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).
• CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).
• CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).
• CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)
• CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).
• CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
• CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).
• CVE-2024-53161:…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26776, CVE-2024-26802, CVE-2024-26790, CVE-2024-27388, CVE-2024-27077, CVE-2024-26884, CVE-2024-26779, CVE-2024-26897, CVE-2024-27045, CVE-2024-26851, CVE-2024-27065, CVE-2024-26843, CVE-2024-26743, CVE-2024-27052, CVE-2024-26855, CVE-2024-27436, CVE-2024-27078, CVE-2024-26898, CVE-2024-27405, CVE-2024-26894, CVE-2024-26584, CVE-2024-26915, CVE-2024-26763, CVE-2024-27047, CVE-2024-26809, CVE-2024-26883, CVE-2024-26901, CVE-2024-27412, CVE-2024-26803, CVE-2024-26751, CVE-2024-35829, CVE-2024-27432, CVE-2023-52447, CVE-2024-26748, CVE-2024-27051, CVE-2023-52434, CVE-2024-26749, CVE-2024-27034, CVE-2024-27390, CVE-2024-26879, CVE-2024-26859, CVE-2024-26835, CVE-2024-26861, CVE-2024-27030, CVE-2024-27415, CVE-2023-52656, CVE-2024-26773, CVE-2024-27043, CVE-2024-26601, CVE-2024-27073, CVE-2024-26782, CVE-2024-27413, CVE-2024-26880, CVE-2024-26793, CVE-2024-26766, CVE-2024-26750, CVE-2024-26852, CVE-2024-26805, CVE-2024-35830, CVE-2024-26798, CVE-2023-52644, CVE-2024-26787, CVE-2024-26846,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26776, CVE-2024-26802, CVE-2024-26790, CVE-2024-27388, CVE-2024-27077, CVE-2024-26884, CVE-2024-26779, CVE-2024-26897, CVE-2024-27045, CVE-2024-26851, CVE-2024-27065, CVE-2024-26843, CVE-2024-26743, CVE-2024-27052, CVE-2024-26855, CVE-2024-27436, CVE-2024-27078, CVE-2024-26898, CVE-2024-27405, CVE-2024-26894, CVE-2024-26584, CVE-2024-26915, CVE-2024-26763, CVE-2024-27047, CVE-2024-26809, CVE-2024-26883, CVE-2024-26901, CVE-2024-27412, CVE-2024-26803, CVE-2024-26751, CVE-2024-35829, CVE-2024-27432, CVE-2023-52447, CVE-2024-26748, CVE-2024-27051, CVE-2023-52434, CVE-2024-26749, CVE-2024-27034, CVE-2024-27390, CVE-2024-26879, CVE-2024-26859, CVE-2024-26835, CVE-2024-26861, CVE-2024-27030, CVE-2024-27415, CVE-2023-52656, CVE-2024-26773, CVE-2024-27043, CVE-2024-26601, CVE-2024-27073, CVE-2024-26782, CVE-2024-27413, CVE-2024-26880, CVE-2024-26793, CVE-2024-26766, CVE-2024-26750, CVE-2024-26852, CVE-2024-26805, CVE-2024-35830, CVE-2024-26798, CVE-2023-52644, CVE-2024-26787, CVE-2024-26846,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26877, CVE-2024-35829, CVE-2024-26737, CVE-2024-27075, CVE-2024-27414, CVE-2024-27053, CVE-2024-26889, CVE-2024-26792, CVE-2024-26882, CVE-2024-26906, CVE-2024-26851, CVE-2024-27037, CVE-2024-26782, CVE-2024-27388, CVE-2024-26748, CVE-2024-27419, CVE-2024-27034, CVE-2023-52662, CVE-2024-27047, CVE-2024-26874, CVE-2024-26779, CVE-2024-26872, CVE-2024-26820, CVE-2024-35811, CVE-2024-26771, CVE-2024-26733, CVE-2024-26903, CVE-2024-26736, CVE-2024-26870, CVE-2024-26883, CVE-2024-27403, CVE-2024-26878, CVE-2024-26857, CVE-2023-52645, CVE-2024-26601, CVE-2024-26891, CVE-2024-27028, CVE-2024-27054, CVE-2024-26804, CVE-2024-27405, CVE-2024-35830, CVE-2024-26898, CVE-2024-26754, CVE-2024-26793, CVE-2024-26747, CVE-2024-26901, CVE-2023-52652, CVE-2023-52650, CVE-2024-26651, CVE-2024-26816, CVE-2024-35845, CVE-2024-26862, CVE-2024-26884, CVE-2024-26752, CVE-2024-26852, CVE-2023-52656, CVE-2024-26790, CVE-2024-26603, CVE-2024-27078, CVE-2024-26802, CVE-2024-27045, CVE-2024-27024, CVE-2024-27073, CVE-2024-26585, CVE-2024-26894, CVE-2024-26583, CVE-2024-27416, CVE-2024-27431, CVE-2024-35844, CVE-2024-26838, CVE-2024-27410, CVE-2024-26915, CVE-2024-26772, CVE-2024-26897, CVE-2024-26798, CVE-2024-27415, CVE-2024-26855, CVE-2024-26833, CVE-2024-26764, CVE-2024-26659,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26877, CVE-2024-35829, CVE-2024-26737, CVE-2024-27075, CVE-2024-27414, CVE-2024-27053, CVE-2024-26889, CVE-2024-26792, CVE-2024-26882, CVE-2024-26906, CVE-2024-26851, CVE-2024-27037, CVE-2024-26782, CVE-2024-27388, CVE-2024-26748, CVE-2024-27419, CVE-2024-27034, CVE-2023-52662, CVE-2024-27047, CVE-2024-26874, CVE-2024-26779, CVE-2024-26872, CVE-2024-26820, CVE-2024-35811, CVE-2024-26771, CVE-2024-26733, CVE-2024-26903, CVE-2024-26736, CVE-2024-26870, CVE-2024-26883, CVE-2024-27403, CVE-2024-26878, CVE-2024-26857, CVE-2023-52645, CVE-2024-26601, CVE-2024-26891, CVE-2024-27028, CVE-2024-27054, CVE-2024-26804, CVE-2024-27405, CVE-2024-35830, CVE-2024-26898, CVE-2024-26754, CVE-2024-26793, CVE-2024-26747, CVE-2024-26901, CVE-2023-52652, CVE-2023-52650, CVE-2024-26651, CVE-2024-26816, CVE-2024-35845, CVE-2024-26862, CVE-2024-26884, CVE-2024-26752, CVE-2024-26852, CVE-2023-52656, CVE-2024-26790, CVE-2024-26603, CVE-2024-27078, CVE-2024-26802, CVE-2024-27045, CVE-2024-27024, CVE-2024-27073, CVE-2024-26585, CVE-2024-26894, CVE-2024-26583, CVE-2024-27416, CVE-2024-27431, CVE-2024-35844, CVE-2024-26838, CVE-2024-27410, CVE-2024-26915, CVE-2024-26772, CVE-2024-26897, CVE-2024-26798, CVE-2024-27415, CVE-2024-26855, CVE-2024-26833, CVE-2024-26764, CVE-2024-26659,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26877, CVE-2024-35829, CVE-2024-26737, CVE-2024-27075, CVE-2024-27414, CVE-2024-27053, CVE-2024-26889, CVE-2024-26792, CVE-2024-26882, CVE-2024-26906, CVE-2024-26851, CVE-2024-27037, CVE-2024-26782, CVE-2024-27388, CVE-2024-26748, CVE-2024-27419, CVE-2024-27034, CVE-2023-52662, CVE-2024-27047, CVE-2024-26874, CVE-2024-26779, CVE-2024-26872, CVE-2024-26820, CVE-2024-35811, CVE-2024-26771, CVE-2024-26733, CVE-2024-26903, CVE-2024-26736, CVE-2024-26870, CVE-2024-26883, CVE-2024-27403, CVE-2024-26878, CVE-2024-26857, CVE-2023-52645, CVE-2024-26601, CVE-2024-26891, CVE-2024-27028, CVE-2024-27054, CVE-2024-26804, CVE-2024-27405, CVE-2024-35830, CVE-2024-26898, CVE-2024-26754, CVE-2024-26793, CVE-2024-26747, CVE-2024-26901, CVE-2023-52652, CVE-2023-52650, CVE-2024-26651, CVE-2024-26816, CVE-2024-35845, CVE-2024-26862, CVE-2024-26884, CVE-2024-26752, CVE-2024-26852, CVE-2023-52656, CVE-2024-26790, CVE-2024-26603, CVE-2024-27078, CVE-2024-26802, CVE-2024-27045, CVE-2024-27024, CVE-2024-27073, CVE-2024-26585, CVE-2024-26894, CVE-2024-26583, CVE-2024-27416, CVE-2024-27431, CVE-2024-35844, CVE-2024-26838, CVE-2024-27410, CVE-2024-26915, CVE-2024-26772, CVE-2024-26897, CVE-2024-26798, CVE-2024-27415, CVE-2024-26855, CVE-2024-26833, CVE-2024-26764, CVE-2024-26659,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-35830, CVE-2024-27052, CVE-2023-52620, CVE-2024-26903, CVE-2024-27413, CVE-2024-26766, CVE-2024-27077, CVE-2024-27044, CVE-2024-27076, CVE-2024-26833, CVE-2024-26874, CVE-2024-26863, CVE-2023-52650, CVE-2024-26820, CVE-2024-26787, CVE-2023-52656, CVE-2024-26651, CVE-2024-27065, CVE-2024-27053, CVE-2024-26583, CVE-2024-26774, CVE-2024-26782, CVE-2023-52640, CVE-2024-26838, CVE-2024-27410, CVE-2024-26870, CVE-2024-27024, CVE-2024-26891, CVE-2024-26889, CVE-2024-26897, CVE-2024-26857, CVE-2023-52434, CVE-2023-52645, CVE-2024-26901, CVE-2024-26872, CVE-2024-27051, CVE-2024-27388, CVE-2024-26584, CVE-2024-26802, CVE-2024-26733, CVE-2024-27419, CVE-2023-52447, CVE-2024-27054, CVE-2024-26840, CVE-2024-27038, CVE-2024-27028, CVE-2024-26883, CVE-2024-27074, CVE-2024-26735, CVE-2024-26852, CVE-2024-27034, CVE-2024-26744, CVE-2024-26907, CVE-2024-26777, CVE-2024-26835, CVE-2024-35845, CVE-2024-35828, CVE-2024-27037, CVE-2024-26764, CVE-2024-26798, CVE-2024-27414, CVE-2024-26878, CVE-2024-27390, CVE-2024-26856, CVE-2024-26884, CVE-2024-26779, CVE-2024-26895, CVE-2024-27436, CVE-2023-52641, CVE-2024-27039, CVE-2024-26776, CVE-2024-26749, CVE-2024-27047, CVE-2024-26882, CVE-2023-52652, CVE-2023-52662, CVE-2024-26763, CVE-2024-27030, CVE-2024-26772, CVE-2024-26859, CVE-2024-26791, CVE-2024-26788, CVE-2024-27046, CVE-2024-26736, CVE-2024-26750, CVE-2024-26801, CVE-2024-35811, CVE-2024-26737, CVE-2024-27416, CVE-2024-26769, CVE-2024-26906, CVE-2024-26795, CVE-2024-27417, CVE-2024-27078, CVE-2024-26790,…

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151)

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Android drivers;
• Power management core;
• Bus devices;
• Hardware random number generator core;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• MediaTek PM domains;
• Power supply drivers;
• SCSI drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• DesignWare USB3 driver;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• Network file system client;
• NILFS2 file system;
• NTFS3 file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Ethernet bridge;
• CAN network layer;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• Logical Link…

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• PowerPC architecture;
• x86 architecture;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• Multiple devices driver;
• Network drivers;
• Power supply drivers;
• TCM subsystem;
• Userspace I/O drivers;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Netfilter;
• Netlink;
• Wireless networking; (CVE-2024-26748, CVE-2024-27417, CVE-2024-26840, CVE-2023-52504, CVE-2024-26790, CVE-2024-26763, CVE-2024-26805, CVE-2024-26773, CVE-2021-47063, CVE-2024-26791, CVE-2024-27413, CVE-2024-26788, CVE-2024-27405, CVE-2024-26845, CVE-2024-26766, CVE-2021-47070, CVE-2024-26839, CVE-2024-26712, CVE-2024-27412, CVE-2024-26752, CVE-2024-26778, CVE-2024-26735, CVE-2024-26736, CVE-2024-27410, CVE-2024-26779, CVE-2024-26804, CVE-2024-26749, CVE-2024-26793, CVE-2024-26764, CVE-2024-26751, CVE-2024-35811, CVE-2024-26835, CVE-2024-26772, CVE-2024-26777, CVE-2024-26688, CVE-2024-27416, CVE-2024-26801, CVE-2024-26733, CVE-2024-27414, CVE-2024-26754, CVE-2024-26848)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• PowerPC architecture;
• x86 architecture;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• Multiple devices driver;
• Network drivers;
• Power supply drivers;
• TCM subsystem;
• Userspace I/O drivers;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Netfilter;
• Netlink;
• Wireless networking; (CVE-2021-47063, CVE-2024-26751, CVE-2024-26848, CVE-2024-26748, CVE-2024-26733, CVE-2024-26735, CVE-2024-26805, CVE-2024-26804, CVE-2024-26793, CVE-2023-52504, CVE-2024-27417, CVE-2024-27405, CVE-2024-26778, CVE-2024-27414, CVE-2024-26801, CVE-2024-26835, CVE-2024-27413, CVE-2024-26766, CVE-2024-27410, CVE-2024-27412, CVE-2024-26773, CVE-2024-26777, CVE-2024-26839, CVE-2024-26764, CVE-2024-26712, CVE-2024-26788, CVE-2024-26688, CVE-2024-26754, CVE-2021-47070, CVE-2024-26752, CVE-2024-26845, CVE-2024-26791, CVE-2024-26763, CVE-2024-27416, CVE-2024-26779, CVE-2024-26749, CVE-2024-26736, CVE-2024-26840, CVE-2024-26772, CVE-2024-26790)

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26901, CVE-2024-35844, CVE-2024-27024, CVE-2024-26835, CVE-2024-26879, CVE-2024-26846, CVE-2024-35829, CVE-2024-26804, CVE-2024-26802, CVE-2024-27039, CVE-2024-27075, CVE-2024-27076, CVE-2024-26863, CVE-2024-27046, CVE-2024-26776, CVE-2024-26875, CVE-2024-26885, CVE-2024-26583, CVE-2024-26777, CVE-2024-26803, CVE-2024-27047, CVE-2024-26748, CVE-2024-27044, CVE-2024-27416, CVE-2024-26906, CVE-2024-27405, CVE-2024-26749, CVE-2024-27436, CVE-2024-26895, CVE-2023-52662, CVE-2024-26772, CVE-2023-52645, CVE-2024-26787, CVE-2024-26788, CVE-2023-52497, CVE-2024-26795, CVE-2024-26763, CVE-2024-27414, CVE-2024-26870, CVE-2024-27412, CVE-2024-27078, CVE-2024-27388, CVE-2024-26894, CVE-2023-52641, CVE-2024-27053, CVE-2024-26584, CVE-2024-26752, CVE-2024-35845, CVE-2024-26884, CVE-2024-26782, CVE-2024-26859, CVE-2024-26809, CVE-2024-27038, CVE-2024-26897, CVE-2024-26750, CVE-2023-52644, CVE-2024-26848, CVE-2024-26833, CVE-2024-26801, CVE-2024-26872, CVE-2023-52620, CVE-2023-52652, CVE-2024-26839, CVE-2024-26851, CVE-2024-26805, CVE-2024-26659, CVE-2024-26791, CVE-2023-52640, CVE-2024-26883, CVE-2024-26737, CVE-2024-27028, CVE-2024-26603, CVE-2024-27073, CVE-2024-26792, CVE-2024-35830, CVE-2024-26585, CVE-2024-27045, CVE-2024-26880,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26643, CVE-2024-26735, CVE-2024-27024, CVE-2024-26838, CVE-2024-27045, CVE-2024-26747, CVE-2024-26774, CVE-2024-26889, CVE-2024-26766, CVE-2024-26878, CVE-2024-35845, CVE-2024-27034, CVE-2024-26857, CVE-2024-26863, CVE-2024-27030, CVE-2024-27043, CVE-2023-52662, CVE-2024-26787, CVE-2024-26782, CVE-2023-52434, CVE-2024-26802, CVE-2024-26776, CVE-2024-26584, CVE-2024-26875, CVE-2023-52650, CVE-2024-26879, CVE-2024-26820, CVE-2024-27410, CVE-2024-26859, CVE-2024-26744, CVE-2024-26743, CVE-2024-27075, CVE-2024-35830, CVE-2024-26779, CVE-2024-26843, CVE-2024-26778, CVE-2024-27046, CVE-2024-27412, CVE-2024-26839, CVE-2024-26773, CVE-2024-26748, CVE-2023-52620, CVE-2024-26805, CVE-2024-26915, CVE-2024-26848, CVE-2024-26688, CVE-2024-26840, CVE-2024-26856, CVE-2024-27414, CVE-2023-52645, CVE-2024-26880, CVE-2023-52656, CVE-2024-27053, CVE-2024-26752, CVE-2024-27047, CVE-2024-27416, CVE-2024-26882, CVE-2024-26803, CVE-2024-27073, CVE-2024-26884, CVE-2024-26769, CVE-2024-26737, CVE-2024-27054, CVE-2024-27044, CVE-2024-26777, CVE-2024-26749, CVE-2024-27436, CVE-2024-26788, CVE-2024-26751, CVE-2024-35828, CVE-2024-26891, CVE-2024-26771, CVE-2024-26877, CVE-2024-26733, CVE-2024-26793, CVE-2024-26659, CVE-2024-27419, CVE-2024-26870,…

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096)

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• ACPI drivers;
• Android drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• S/390 drivers;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• Network file system client; -…