CVE-2024-27431

In the Linux kernel, the following vulnerability has been resolved: cpumap: Zero-initialise xdp_rxq_info struct before running XDP program When running an XDP program that is attached to a cpumap entry, we don't initialise the xdp_rxq_info data structure being used in the xdp_buff that backs the XDP program invocation. Tobias noticed that this leads to random values being returned as the xdp_md->rx_queue_index value for XDP programs running in a cpumap. This means we're basically returning the contents of the uninitialised memory, which is bad. Fix this by zero-initialising the rxq data structure before running the XDP program.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()

memcpy() is called in a loop while 'operation->length' upper bound is not checked and 'data_idx' also increments.(CVE-2022-48632)

In the Linux kernel, the following vulnerability has been resolved:

mm/slub: fix to return errno if kmalloc() fails

In create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to out-of-memory, if it fails, return errno correctly rather than triggering panic via BUG_ON();

kernel BUG at mm/slub.c:5893! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP

Call trace: sysfs_slab_add+0x258/0x260 mm/slub.c:5973 __kmem_cache_create+0x60/0x118 mm/slub.c:4899 create_cache mm/slab_common.c:229 [inline] kmem_cache_create_usercopy+0x19c/0x31c mm/slab_common.c:335 kmem_cache_create+0x1c/0x28 mm/slab_common.c:390 f2fs_kmem_cache_create fs/f2fs/f2fs.h:2766 [inline] f2fs_init_xattr_caches+0x78/0xb4 fs/f2fs/xattr.c:808 f2fs_fill_super+0x1050/0x1e0c fs/f2fs/super.c:4149 mount_bdev+0x1b8/0x210 fs/super.c:1400 f2fs_mount+0x44/0x58 fs/f2fs/super.c:4512 legacy_get_tree+0x30/0x74 fs/fs_context.c:610 vfs_get_tree+0x40/0x140 fs/super.c:1530 do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040 path_mount+0x358/0x914 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __arm64_sys_mount+0x2f8/0x408 fs/namespace.c:3568(CVE-2022-48659)

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully

When running gpio test on nxp-ls1028 platform with below command gpiomon --num-events=3 --rising-edge gpiochip1 25 There will be a warning trace as below: Call trace: free_irq+0x204/0x360 lineevent_free+0x64/0x70 gpio_ioctl+0x598/0x6a0 __arm64_sys_ioctl+0xb4/0x100 invoke_syscall+0x5c/0x130 ...... el0t_64_sync+0x1a0/0x1a4 The reason of this issue is that calling request_threaded_irq() function failed, and then lineevent_free() is invoked to release the resource. Since the lineevent_state::irq was already set, so the subsequent invocation of free_irq() would trigger the above warning call trace. To fix this issue, set the lineevent_state::irq after the IRQ register successfully.(CVE-2022-48660)

In the Linux kernel, the following vulnerability has been resolved:

binder: fix race between mmput() and do_exit()

Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A.

Task A | Task B ------------------+------------------ mmget_not_zero() | | do_exit() | exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() |

In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead).

This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then.

In order to fix this use mmput_async() that will schedule the work in the corresponding mm->async_put_work WQ instead of Task A.(CVE-2023-52609)

In the Linux kernel, the following vulnerability has been resolved:

hwrng: core - Fix page fault dead lock on mmap-ed hwrng

There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

mm/slub: fix to return errno if kmalloc() fails

In create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to out-of-memory, if it fails, return errno correctly rather than triggering panic via BUG_ON();

kernel BUG at mm/slub.c:5893! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP

Call trace: sysfs_slab_add+0x258/0x260 mm/slub.c:5973 __kmem_cache_create+0x60/0x118 mm/slub.c:4899 create_cache mm/slab_common.c:229 [inline] kmem_cache_create_usercopy+0x19c/0x31c mm/slab_common.c:335 kmem_cache_create+0x1c/0x28 mm/slab_common.c:390 f2fs_kmem_cache_create fs/f2fs/f2fs.h:2766 [inline] f2fs_init_xattr_caches+0x78/0xb4 fs/f2fs/xattr.c:808 f2fs_fill_super+0x1050/0x1e0c fs/f2fs/super.c:4149 mount_bdev+0x1b8/0x210 fs/super.c:1400 f2fs_mount+0x44/0x58 fs/f2fs/super.c:4512 legacy_get_tree+0x30/0x74 fs/fs_context.c:610 vfs_get_tree+0x40/0x140 fs/super.c:1530 do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040 path_mount+0x358/0x914 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __arm64_sys_mount+0x2f8/0x408 fs/namespace.c:3568(CVE-2022-48659)

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully

When running gpio test on nxp-ls1028 platform with below command gpiomon --num-events=3 --rising-edge gpiochip1 25 There will be a warning trace as below: Call trace: free_irq+0x204/0x360 lineevent_free+0x64/0x70 gpio_ioctl+0x598/0x6a0 __arm64_sys_ioctl+0xb4/0x100 invoke_syscall+0x5c/0x130 ...... el0t_64_sync+0x1a0/0x1a4 The reason of this issue is that calling request_threaded_irq() function failed, and then lineevent_free() is invoked to release the resource. Since the lineevent_state::irq was already set, so the subsequent invocation of free_irq() would trigger the above warning call trace. To fix this issue, set the lineevent_state::irq after the IRQ register successfully.(CVE-2022-48660)

In the Linux kernel, the following vulnerability has been resolved:

binder: fix race between mmput() and do_exit()

Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A.

Task A | Task B ------------------+------------------ mmget_not_zero() | | do_exit() | exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() |

In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead).

This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then.

In order to fix this use mmput_async() that will schedule the work in the corresponding mm->async_put_work WQ instead of Task A.(CVE-2023-52609)

In the Linux kernel, the following vulnerability has been resolved:

hwrng: core - Fix page fault dead lock on mmap-ed hwrng

There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks.

Fix this by using a stack buffer when calling copy_to_user.(CVE-2023-52615)

In the Linux kernel, the following vulnerability has been resolved:

crypto: lib/mpi - Fix unexpected…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

binder: fix race between mmput() and do_exit()

Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A.

Task A | Task B ------------------+------------------ mmget_not_zero() | | do_exit() | exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() |

In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead).

This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then.

In order to fix this use mmput_async() that will schedule the work in the corresponding mm->async_put_work WQ instead of Task A.(CVE-2023-52609)

In the Linux kernel, the following vulnerability has been resolved:

hwrng: core - Fix page fault dead lock on mmap-ed hwrng

There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks.

Fix this by using a stack buffer when calling copy_to_user.(CVE-2023-52615)

In the Linux kernel, the following vulnerability has been resolved:

crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init

When the mpi_ec_ctx structure is initialized, some fields are not cleared, causing a crash when referencing the field when the structure was released. Initially, this issue was ignored because memory for mpi_ec_ctx is allocated with the __GFP_ZERO flag. For example, this error will be triggered when calculating the Za value for SM2 separately.(CVE-2023-52616)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers

These three bpf_map_{lookup,update,delete}_elem() helpers are also available for sleepable bpf program, so add the corresponding lock assertion for sleepable bpf program, otherwise the following warning will be reported when a sleepable bpf program manipulates bpf map under interpreter mode (aka bpf_jit_enable=0):

WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ...... CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:bpf_map_lookup_elem+0x54/0x60 ...... Call Trace: <TASK> ? __warn+0xa5/0x240 ? bpf_map_lookup_elem+0x54/0x60 ? report_bug+0x1ba/0x1f0 ? handle_bug+0x40/0x80 ? exc_invalid_op+0x18/0x50 ? asm_exc_invalid_op+0x1b/0x20 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ? rcu_lockdep_current_cpu_online+0x65/0xb0 ? rcu_is_watching+0x23/0x50 ? bpf_map_lookup_elem+0x54/0x60 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ___bpf_prog_run+0x513/0x3b70 __bpf_prog_run32+0x9d/0xd0 ? __bpf_prog_enter_sleepable_recur+0xad/0x120 ? __bpf_prog_enter_sleepable_recur+0x3e/0x120 bpf_trampoline_6442580665+0x4d/0x1000 __x64_sys_getpgid+0x5/0x30 ? do_syscall_64+0x36/0xb0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK>(CVE-2023-52621)

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Fix a suspicious RCU usage warning

I received the following warning while running cthon against an ontap server running pNFS:

[ 57.202521] ============================= […

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

hwrng: core - Fix page fault dead lock on mmap-ed hwrng

There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks.

Fix this by using a stack buffer when calling copy_to_user.(CVE-2023-52615)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers

These three bpf_map_{lookup,update,delete}_elem() helpers are also available for sleepable bpf program, so add the corresponding lock assertion for sleepable bpf program, otherwise the following warning will be reported when a sleepable bpf program manipulates bpf map under interpreter mode (aka bpf_jit_enable=0):

WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ...... CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:bpf_map_lookup_elem+0x54/0x60 ...... Call Trace: <TASK> ? __warn+0xa5/0x240 ? bpf_map_lookup_elem+0x54/0x60 ? report_bug+0x1ba/0x1f0 ? handle_bug+0x40/0x80 ? exc_invalid_op+0x18/0x50 ? asm_exc_invalid_op+0x1b/0x20 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ? rcu_lockdep_current_cpu_online+0x65/0xb0 ? rcu_is_watching+0x23/0x50 ? bpf_map_lookup_elem+0x54/0x60 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ___bpf_prog_run+0x513/0x3b70 __bpf_prog_run32+0x9d/0xd0 ? __bpf_prog_enter_sleepable_recur+0xad/0x120 ? __bpf_prog_enter_sleepable_recur+0x3e/0x120 bpf_trampoline_6442580665+0x4d/0x1000 __x64_sys_getpgid+0x5/0x30 ? do_syscall_64+0x36/0xb0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK>(CVE-2023-52621)

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Fix a suspicious RCU usage warning

I received the following warning while running cthon against an ontap server running pNFS:

[ 57.202521] ============================= [ 57.202522] WARNING: suspicious RCU usage [ 57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted [ 57.202525] ----------------------------- [ 57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!! [ 57.202527] other info that might help us debug this:

[ 57.202528] rcu_scheduler_active = 2, debug_locks = 1 [ 57.202529] no locks held by test5/3567. [ 57.202530] stack backtrace: [ 57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e [ 57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022 [ 57.202536] Call Trace: [ 57.202537] <TASK> [ 57.202540] dump_stack_lvl+0x77/0xb0 [ 57.202551] lockdep_rcu_suspicious+0x154/0x1a0 [ 57.202556] rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202596] rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202621] ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202646] rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202671] ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202696] nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202728] ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202754] nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] [ 57.202760] filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files…

In the Linux kernel, the following vulnerability has been resolved: cpumap: Zero-initialise xdp_rxq_info struct before running XDP program When running an XDP program that is attached to a cpumap entry, we don't initialise the xdp_rxq_info data structure being used in the xdp_buff that backs the XDP program invocation. Tobias noticed that this leads to random values being returned as the xdp_md->rx_queue_index value for XDP programs running in a cpumap. This means we're basically returning the contents of the uninitialised memory, which is bad. Fix this by zero-initialising the rxq data structure before running the XDP program.

• smb: client: reject userspace cifs.spnego descriptions
• mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash {CVE-2024-35854}
• cifs: Fix memory leak when build ntlmssp negotiate blob failed {CVE-2022-50372}
• scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() {CVE-2023-53038}
• drm/amd/display: Do not set DRR on pipe Commit {CVE-2023-53042}
• tcp: fix skb_copy_ubufs() vs BIG TCP {CVE-2023-53669}
• clk: Fix clk_core_get NULL dereference {CVE-2024-27038}
• drm/amd/display: Check null pointers before using dc->clk_mgr {CVE-2024-49907}
• bpf: reject unhashed sockets in bpf_sk_assign {CVE-2023-53585}
• driver core: fix resource leak in device_add() {CVE-2023-53594}
• wifi: ath9k: hif_usb: fix memory leak of remain_skbs {CVE-2023-53641}
• wifi: ath9k: verify the expected usb_endpoints are present {CVE-2022-50297}
• drm/amd/display: Fix potential null-deref in dm_resume {CVE-2022-50535}
• ext4: don't allow journal inode to have encrypt flag {CVE-2022-50277}
• tls: get psock ref after taking rxlock to avoid leak {CVE-2024-35908}
• cpumap: Zero-initialise xdp_rxq_info struct before running XDP program {CVE-2024-27431}
• bpf: Guard stack limits against 32bit overflow {CVE-2023-52676}
• can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible() {CVE-2021-47457}
• serial: core: fix transmit-buffer reset and memleak {CVE-2021-47527}
• cpufreq: exit() callback is optional {CVE-2024-38615}
• ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() {CVE-2024-39276}
• tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets {CVE-2024-36905}
• wifi: nl80211: reject iftype change with mesh ID change {CVE-2024-27410}
• tcp: do not accept ACK of bytes we never sent {CVE-2023-52881}
• crypto: pcrypt - Fix hungtask for PADATA_RESET {CVE-2023-52813}
• net/mlx5: Properly link new fs rules into the tree {CVE-2024-35960}
• usb: ulpi: fix memory leak on ulpi_register() error paths
• usb: ulpi: fix double free in ulpi_register_interface() error path {CVE-2026-31759}
• wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
• net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute {CVE-2025-21653}
• calipso: fix memory leak in netlbl_calipso_add_pass() {CVE-2023-52698}
• wifi: iwlwifi: mvm: avoid NULL pointer dereference {CVE-2024-49929}
• ext4: update orig_path in ext4_find_extent() {CVE-2024-49881}
• drm/vmwgfx: Fix a deadlock in dma buf fence polling {CVE-2024-43863}
• RDMA/restrack: Fix potential invalid address access {CVE-2024-42080}
• net: can: j1939: Initialize unused data in j1939_send_one() {CVE-2024-42076}
• nfsd: clear acl_access/acl_default after releasing them {CVE-2025-21796}
• rtc: pl031: fix rtc features null pointer dereference {CVE-2022-49273}
• net: veth: clear GRO when clearing XDP even when down {CVE-2024-26803}
• coresight: cti: Fix hang in cti_disable_hw() {CVE-2022-50491}
• scsi: qla2xxx: Fix deletion race condition {CVE-2023-53615}
• iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() {CVE-2023-53476}
• scsi: qla2xxx: Fix potential NULL pointer dereference {CVE-2023-53451}
• usb: ucsi_acpi: Increase the command completion timeout {CVE-2023-53168}
• drivers: base: dd: fix memory leak with using debugfs_lookup() {CVE-2023-53390}
• USB: fix memory leak with using debugfs_lookup() {CVE-2023-53359}
• PM: domains: fix memory leak with using debugfs_lookup() {CVE-2023-53202}
• drm/client: Fix memory leak in drm_client_modeset_probe {CVE-2023-53288}
• drivers: base: component: fix memory leak with using debugfs_lookup() {CVE-2023-53409}
• USB: uhci: fix memory leak with using debugfs_lookup() {CVE-2023-53197}
• media: uvcvideo: Handle cameras with invalid descriptors {CVE-2023-53437}
• arm64: csum: Fix OoB access in IP checksum code for negative lengths {CVE-2023-53726}
• bnxt: Do not read past the end of test names {CVE-2023-53010}
• dax: make sure inodes are flushed before destroy cache {CVE-2022-49220}
• cifs: Fix oops due to uncleared server->smbd_conn…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
• CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52660: Fiedx IRQ handling due to shared interrupts (bsc#1224443).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26715: Fixed NULL pointer dereference in dwc3_gadget_suspend (bsc#1222561).
• CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes bsc#1222608).
• CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
• CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
• CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
• CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
• CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
• CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
• CVE-2024-27042: Fixed potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (bsc#1223823).
• CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).
• CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181).
• CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr() (bsc#1224721)
• CVE-2024-27419: Fixed data-races around sysctl_net_busy_read (bsc#1224759)
• CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
• CVE-2024-35791: Flush pages under…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575).
• CVE-2024-36938: Fixed NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761).
• CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2024-35998: Fixed lock ordering potential deadlock in cifs_sync_mid_result (bsc#1224549).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
• CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
• CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break() (bsc#1224668).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
• CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
• CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
• CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key() (bsc#1224667).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-35869: Guarantee refcounted children from parent session (bsc#1224679).
• CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2024-35964: Fixed not validating setsockopt user input (bsc#1224581).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
• CVE-2024-35860: struct bpf_link and bpf_link_ops kABI workaround (bsc#1224531).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).
• CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).
• CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
• CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
• CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
• CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios (bsc#1224530).
• CVE-2024-35852: Fixed memory leak when canceling rehash work (bsc#1224502).
• CVE-2024-36006: Fixed incorrect list API usage (bsc#1224541).
• CVE-2024-36007: Fixed warning during rehash (bsc#1224543).
• CVE-2024-35885: Stop interface during shutdown (bsc#1224519).
• CVE-2024-35907: Call request_irq() after NAPI initialized (bsc#1224492).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
• CVE-2024-26764: Fixed IOCB_AIO_RW check in fs/aio before the struct aio_kiocb conversion (bsc#1222721).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).
• CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).
• CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).
• CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).
• CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).
• CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).
• CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
• CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
• CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).
• CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).
• CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).
• CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).
• CVE-2024-26772: Fixed ext4 to avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (bsc#1222613).
• CVE-2024-26906: Disallowed vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26816: Ignore relocations in .notes section when building with CONFIG_XEN_PV=y (bsc#1222624).
• CVE-2024-26783: Fixed mm/vmscan bug when calling wakeup_kswapd() with a wrong zone index (bsc#1222615).
• CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).
• CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).
• CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).
• CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).
• CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
• CVE-2024-26836: Fixed platform/x86/think-lmi password opcode ordering for workstations (bsc#1222968).
• CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
• CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found() (bsc#1222618).
• CVE-2024-26807: Fixed spi/cadence-qspi NULL pointer reference in runtime PM hooks (bsc#1222801).
• CVE-2024-26737: Fixed selftests/bpf racing between bpf_timer_cancel_and_free and bpf_timer_cancel (bsc#1222557).
• CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).
• CVE-2024-26684: Fixed net/stmmac/xgmac handling of DPP safety error for DMA channels (bsc#1222445).
• CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).
• CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).
• CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
• CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
• CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
• CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
• CVE-2023-6270: Fixed a use-after-free issue in…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
• CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52660: Fiedx IRQ handling due to shared interrupts (bsc#1224443).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26700: Fixed drm/amd/display: Fix MST Null Ptr for RV (bsc#1222870)
• CVE-2024-26715: Fixed NULL pointer dereference in dwc3_gadget_suspend (bsc#1222561).
• CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes bsc#1222608).
• CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
• CVE-2024-26777: Error out if pixclock equals zero in fbdev/sis (bsc#1222765)
• CVE-2024-26778: Error out if pixclock equals zero in fbdev/savage (bsc#1222770)
• CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26839: Fixed a memleak in init_credit_return() (bsc#1222975)
• CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
• CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
• CVE-2024-26907: Fixed a fortify source warning while accessing Eth segment in mlx5 (bsc#1223203).
• CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
• CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
• CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
• CVE-2024-27042: Fixed potential out-of-bounds access in…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-52434: Fixed potential OOBs in smb2_parse_contexts() (bsc#1220148).
• CVE-2023-52458: Fixed check that partition length needs to be aligned with block size (bsc#1220428).
• CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52631: Fixed an NULL dereference bug (bsc#1222264 CVE-2023-52631).
• CVE-2023-52635: Fixed PM/devfreq to synchronize devfreq_monitor_[start/stop] (bsc#1222294).
• CVE-2023-52640: Fixed out-of-bounds in ntfs_listxattr (bsc#1222301).
• CVE-2023-52641: Fixed NULL ptr dereference checking at the end of attr_allocate_frame() (bsc#1222303)
• CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
• CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
• CVE-2023-52659: Fixed to pfn_to_kaddr() not treated as a 64-bit type (bsc#1224442).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52771: Fixed delete_endpoint() vs parent unregistration race (bsc#1225007).
• CVE-2023-52772: Fixed use-after-free in unix_stream_read_actor() (bsc#1224989).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-6238: Fixed kcalloc() arguments order (bsc#1217384).
• CVE-2023-7042: Fixed a null-pointer-dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (bsc#1218336).
• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-21823: Fixed safety flag to struct ends (bsc#1223625).
• CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
• CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
• CVE-2024-24861: Fixed an overflow due to race condition in media/xc4000 device driver in xc4000 xc4000_get_frequency() function (bsc#1219623).
• CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
• CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
• CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
• CVE-2024-26632: Fixed iterating over an empty bio with bio_for_each_folio_all (bsc#1221635).
• CVE-2024-26638: Fixed uninitialize struct msghdr completely (bsc#1221649 CVE-2024-26638).
• CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26654: Fixed use after free in ALSA/sh/aica (bsc#1222304).
• CVE-2024-26656: Fixed drm/amdgpu use-after-free bug (bsc#1222307).
• CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).
• CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).
• CVE-2024-26674: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups (bsc#1222378).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26684: Fixed net/stmmac/xgmac handling of DPP safety error for DMA channels (bsc#1222445).
• CVE-2024-26685: Fixed nilfs2 potential bug in end_buffer_async_write (bsc#1222437).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26704: Fixed a…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-38417: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225600).
• CVE-2023-47210: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225601).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52458: Fixed check that partition length needs to be aligned with block size (bsc#1220428).
• CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52631: Fixed an NULL dereference bug (bsc#1222264 CVE-2023-52631).
• CVE-2023-52640: Fixed out-of-bounds in ntfs_listxattr (bsc#1222301).
• CVE-2023-52641: Fixed NULL ptr dereference checking at the end of attr_allocate_frame() (bsc#1222303)
• CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
• CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52659: Fixed to pfn_to_kaddr() not treated as a 64-bit type (bsc#1224442)
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52699: sysv: don't call sb_bread() with pointers_lock held (bsc#1224659).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52771: Fixed delete_endpoint() vs parent unregistration race (bsc#1225007).
• CVE-2023-52772: Fixed use-after-free in unix_stream_read_actor() (bsc#1224989).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52786: ext4: fix racy may inline data check in dio write (bsc#1224939).
• CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
• CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
• CVE-2023-52855: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (bsc#1225583).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2023-6238: Fixed kcalloc() arguments order (bsc#1217384).
• CVE-2024-21823: Fixed safety flag to struct ends (bsc#1223625).
• CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
• CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
• CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
• CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
• CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
• CVE-2024-26623: pds_core: Prevent race issues involving the adminq (bsc#1221057).
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086) -…

The SUSE Linux Enterprise Micro 6.0 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
• CVE-2024-40948: mm/page_table_check: fix crash on ZONE_DEVICE (bsc#1227801).
• CVE-2024-35890:…

The SUSE Linux Enterprise Micro 6.0 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26776, CVE-2024-26802, CVE-2024-26790, CVE-2024-27388, CVE-2024-27077, CVE-2024-26884, CVE-2024-26779, CVE-2024-26897, CVE-2024-27045, CVE-2024-26851, CVE-2024-27065, CVE-2024-26843, CVE-2024-26743, CVE-2024-27052, CVE-2024-26855, CVE-2024-27436, CVE-2024-27078, CVE-2024-26898, CVE-2024-27405, CVE-2024-26894, CVE-2024-26584, CVE-2024-26915, CVE-2024-26763, CVE-2024-27047, CVE-2024-26809, CVE-2024-26883, CVE-2024-26901, CVE-2024-27412, CVE-2024-26803, CVE-2024-26751, CVE-2024-35829, CVE-2024-27432, CVE-2023-52447, CVE-2024-26748, CVE-2024-27051, CVE-2023-52434, CVE-2024-26749, CVE-2024-27034, CVE-2024-27390, CVE-2024-26879, CVE-2024-26859, CVE-2024-26835, CVE-2024-26861, CVE-2024-27030, CVE-2024-27415, CVE-2023-52656, CVE-2024-26773, CVE-2024-27043, CVE-2024-26601, CVE-2024-27073, CVE-2024-26782, CVE-2024-27413, CVE-2024-26880, CVE-2024-26793, CVE-2024-26766, CVE-2024-26750, CVE-2024-26852, CVE-2024-26805, CVE-2024-35830, CVE-2024-26798, CVE-2023-52644, CVE-2024-26787, CVE-2024-26846,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26776, CVE-2024-26802, CVE-2024-26790, CVE-2024-27388, CVE-2024-27077, CVE-2024-26884, CVE-2024-26779, CVE-2024-26897, CVE-2024-27045, CVE-2024-26851, CVE-2024-27065, CVE-2024-26843, CVE-2024-26743, CVE-2024-27052, CVE-2024-26855, CVE-2024-27436, CVE-2024-27078, CVE-2024-26898, CVE-2024-27405, CVE-2024-26894, CVE-2024-26584, CVE-2024-26915, CVE-2024-26763, CVE-2024-27047, CVE-2024-26809, CVE-2024-26883, CVE-2024-26901, CVE-2024-27412, CVE-2024-26803, CVE-2024-26751, CVE-2024-35829, CVE-2024-27432, CVE-2023-52447, CVE-2024-26748, CVE-2024-27051, CVE-2023-52434, CVE-2024-26749, CVE-2024-27034, CVE-2024-27390, CVE-2024-26879, CVE-2024-26859, CVE-2024-26835, CVE-2024-26861, CVE-2024-27030, CVE-2024-27415, CVE-2023-52656, CVE-2024-26773, CVE-2024-27043, CVE-2024-26601, CVE-2024-27073, CVE-2024-26782, CVE-2024-27413, CVE-2024-26880, CVE-2024-26793, CVE-2024-26766, CVE-2024-26750, CVE-2024-26852, CVE-2024-26805, CVE-2024-35830, CVE-2024-26798, CVE-2023-52644, CVE-2024-26787, CVE-2024-26846,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26877, CVE-2024-35829, CVE-2024-26737, CVE-2024-27075, CVE-2024-27414, CVE-2024-27053, CVE-2024-26889, CVE-2024-26792, CVE-2024-26882, CVE-2024-26906, CVE-2024-26851, CVE-2024-27037, CVE-2024-26782, CVE-2024-27388, CVE-2024-26748, CVE-2024-27419, CVE-2024-27034, CVE-2023-52662, CVE-2024-27047, CVE-2024-26874, CVE-2024-26779, CVE-2024-26872, CVE-2024-26820, CVE-2024-35811, CVE-2024-26771, CVE-2024-26733, CVE-2024-26903, CVE-2024-26736, CVE-2024-26870, CVE-2024-26883, CVE-2024-27403, CVE-2024-26878, CVE-2024-26857, CVE-2023-52645, CVE-2024-26601, CVE-2024-26891, CVE-2024-27028, CVE-2024-27054, CVE-2024-26804, CVE-2024-27405, CVE-2024-35830, CVE-2024-26898, CVE-2024-26754, CVE-2024-26793, CVE-2024-26747, CVE-2024-26901, CVE-2023-52652, CVE-2023-52650, CVE-2024-26651, CVE-2024-26816, CVE-2024-35845, CVE-2024-26862, CVE-2024-26884, CVE-2024-26752, CVE-2024-26852, CVE-2023-52656, CVE-2024-26790, CVE-2024-26603, CVE-2024-27078, CVE-2024-26802, CVE-2024-27045, CVE-2024-27024, CVE-2024-27073, CVE-2024-26585, CVE-2024-26894, CVE-2024-26583, CVE-2024-27416, CVE-2024-27431, CVE-2024-35844, CVE-2024-26838, CVE-2024-27410, CVE-2024-26915, CVE-2024-26772, CVE-2024-26897, CVE-2024-26798, CVE-2024-27415, CVE-2024-26855, CVE-2024-26833, CVE-2024-26764, CVE-2024-26659,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26877, CVE-2024-35829, CVE-2024-26737, CVE-2024-27075, CVE-2024-27414, CVE-2024-27053, CVE-2024-26889, CVE-2024-26792, CVE-2024-26882, CVE-2024-26906, CVE-2024-26851, CVE-2024-27037, CVE-2024-26782, CVE-2024-27388, CVE-2024-26748, CVE-2024-27419, CVE-2024-27034, CVE-2023-52662, CVE-2024-27047, CVE-2024-26874, CVE-2024-26779, CVE-2024-26872, CVE-2024-26820, CVE-2024-35811, CVE-2024-26771, CVE-2024-26733, CVE-2024-26903, CVE-2024-26736, CVE-2024-26870, CVE-2024-26883, CVE-2024-27403, CVE-2024-26878, CVE-2024-26857, CVE-2023-52645, CVE-2024-26601, CVE-2024-26891, CVE-2024-27028, CVE-2024-27054, CVE-2024-26804, CVE-2024-27405, CVE-2024-35830, CVE-2024-26898, CVE-2024-26754, CVE-2024-26793, CVE-2024-26747, CVE-2024-26901, CVE-2023-52652, CVE-2023-52650, CVE-2024-26651, CVE-2024-26816, CVE-2024-35845, CVE-2024-26862, CVE-2024-26884, CVE-2024-26752, CVE-2024-26852, CVE-2023-52656, CVE-2024-26790, CVE-2024-26603, CVE-2024-27078, CVE-2024-26802, CVE-2024-27045, CVE-2024-27024, CVE-2024-27073, CVE-2024-26585, CVE-2024-26894, CVE-2024-26583, CVE-2024-27416, CVE-2024-27431, CVE-2024-35844, CVE-2024-26838, CVE-2024-27410, CVE-2024-26915, CVE-2024-26772, CVE-2024-26897, CVE-2024-26798, CVE-2024-27415, CVE-2024-26855, CVE-2024-26833, CVE-2024-26764, CVE-2024-26659,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26877, CVE-2024-35829, CVE-2024-26737, CVE-2024-27075, CVE-2024-27414, CVE-2024-27053, CVE-2024-26889, CVE-2024-26792, CVE-2024-26882, CVE-2024-26906, CVE-2024-26851, CVE-2024-27037, CVE-2024-26782, CVE-2024-27388, CVE-2024-26748, CVE-2024-27419, CVE-2024-27034, CVE-2023-52662, CVE-2024-27047, CVE-2024-26874, CVE-2024-26779, CVE-2024-26872, CVE-2024-26820, CVE-2024-35811, CVE-2024-26771, CVE-2024-26733, CVE-2024-26903, CVE-2024-26736, CVE-2024-26870, CVE-2024-26883, CVE-2024-27403, CVE-2024-26878, CVE-2024-26857, CVE-2023-52645, CVE-2024-26601, CVE-2024-26891, CVE-2024-27028, CVE-2024-27054, CVE-2024-26804, CVE-2024-27405, CVE-2024-35830, CVE-2024-26898, CVE-2024-26754, CVE-2024-26793, CVE-2024-26747, CVE-2024-26901, CVE-2023-52652, CVE-2023-52650, CVE-2024-26651, CVE-2024-26816, CVE-2024-35845, CVE-2024-26862, CVE-2024-26884, CVE-2024-26752, CVE-2024-26852, CVE-2023-52656, CVE-2024-26790, CVE-2024-26603, CVE-2024-27078, CVE-2024-26802, CVE-2024-27045, CVE-2024-27024, CVE-2024-27073, CVE-2024-26585, CVE-2024-26894, CVE-2024-26583, CVE-2024-27416, CVE-2024-27431, CVE-2024-35844, CVE-2024-26838, CVE-2024-27410, CVE-2024-26915, CVE-2024-26772, CVE-2024-26897, CVE-2024-26798, CVE-2024-27415, CVE-2024-26855, CVE-2024-26833, CVE-2024-26764, CVE-2024-26659,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-35830, CVE-2024-27052, CVE-2023-52620, CVE-2024-26903, CVE-2024-27413, CVE-2024-26766, CVE-2024-27077, CVE-2024-27044, CVE-2024-27076, CVE-2024-26833, CVE-2024-26874, CVE-2024-26863, CVE-2023-52650, CVE-2024-26820, CVE-2024-26787, CVE-2023-52656, CVE-2024-26651, CVE-2024-27065, CVE-2024-27053, CVE-2024-26583, CVE-2024-26774, CVE-2024-26782, CVE-2023-52640, CVE-2024-26838, CVE-2024-27410, CVE-2024-26870, CVE-2024-27024, CVE-2024-26891, CVE-2024-26889, CVE-2024-26897, CVE-2024-26857, CVE-2023-52434, CVE-2023-52645, CVE-2024-26901, CVE-2024-26872, CVE-2024-27051, CVE-2024-27388, CVE-2024-26584, CVE-2024-26802, CVE-2024-26733, CVE-2024-27419, CVE-2023-52447, CVE-2024-27054, CVE-2024-26840, CVE-2024-27038, CVE-2024-27028, CVE-2024-26883, CVE-2024-27074, CVE-2024-26735, CVE-2024-26852, CVE-2024-27034, CVE-2024-26744, CVE-2024-26907, CVE-2024-26777, CVE-2024-26835, CVE-2024-35845, CVE-2024-35828, CVE-2024-27037, CVE-2024-26764, CVE-2024-26798, CVE-2024-27414, CVE-2024-26878, CVE-2024-27390, CVE-2024-26856, CVE-2024-26884, CVE-2024-26779, CVE-2024-26895, CVE-2024-27436, CVE-2023-52641, CVE-2024-27039, CVE-2024-26776, CVE-2024-26749, CVE-2024-27047, CVE-2024-26882, CVE-2023-52652, CVE-2023-52662, CVE-2024-26763, CVE-2024-27030, CVE-2024-26772, CVE-2024-26859, CVE-2024-26791, CVE-2024-26788, CVE-2024-27046, CVE-2024-26736, CVE-2024-26750, CVE-2024-26801, CVE-2024-35811, CVE-2024-26737, CVE-2024-27416, CVE-2024-26769, CVE-2024-26906, CVE-2024-26795, CVE-2024-27417, CVE-2024-27078, CVE-2024-26790,…

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151)

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Android drivers;
• Power management core;
• Bus devices;
• Hardware random number generator core;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• MediaTek PM domains;
• Power supply drivers;
• SCSI drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• DesignWare USB3 driver;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• Network file system client;
• NILFS2 file system;
• NTFS3 file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Ethernet bridge;
• CAN network layer;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• Logical Link…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26901, CVE-2024-35844, CVE-2024-27024, CVE-2024-26835, CVE-2024-26879, CVE-2024-26846, CVE-2024-35829, CVE-2024-26804, CVE-2024-26802, CVE-2024-27039, CVE-2024-27075, CVE-2024-27076, CVE-2024-26863, CVE-2024-27046, CVE-2024-26776, CVE-2024-26875, CVE-2024-26885, CVE-2024-26583, CVE-2024-26777, CVE-2024-26803, CVE-2024-27047, CVE-2024-26748, CVE-2024-27044, CVE-2024-27416, CVE-2024-26906, CVE-2024-27405, CVE-2024-26749, CVE-2024-27436, CVE-2024-26895, CVE-2023-52662, CVE-2024-26772, CVE-2023-52645, CVE-2024-26787, CVE-2024-26788, CVE-2023-52497, CVE-2024-26795, CVE-2024-26763, CVE-2024-27414, CVE-2024-26870, CVE-2024-27412, CVE-2024-27078, CVE-2024-27388, CVE-2024-26894, CVE-2023-52641, CVE-2024-27053, CVE-2024-26584, CVE-2024-26752, CVE-2024-35845, CVE-2024-26884, CVE-2024-26782, CVE-2024-26859, CVE-2024-26809, CVE-2024-27038, CVE-2024-26897, CVE-2024-26750, CVE-2023-52644, CVE-2024-26848, CVE-2024-26833, CVE-2024-26801, CVE-2024-26872, CVE-2023-52620, CVE-2023-52652, CVE-2024-26839, CVE-2024-26851, CVE-2024-26805, CVE-2024-26659, CVE-2024-26791, CVE-2023-52640, CVE-2024-26883, CVE-2024-26737, CVE-2024-27028, CVE-2024-26603, CVE-2024-27073, CVE-2024-26792, CVE-2024-35830, CVE-2024-26585, CVE-2024-27045, CVE-2024-26880,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26643, CVE-2024-26735, CVE-2024-27024, CVE-2024-26838, CVE-2024-27045, CVE-2024-26747, CVE-2024-26774, CVE-2024-26889, CVE-2024-26766, CVE-2024-26878, CVE-2024-35845, CVE-2024-27034, CVE-2024-26857, CVE-2024-26863, CVE-2024-27030, CVE-2024-27043, CVE-2023-52662, CVE-2024-26787, CVE-2024-26782, CVE-2023-52434, CVE-2024-26802, CVE-2024-26776, CVE-2024-26584, CVE-2024-26875, CVE-2023-52650, CVE-2024-26879, CVE-2024-26820, CVE-2024-27410, CVE-2024-26859, CVE-2024-26744, CVE-2024-26743, CVE-2024-27075, CVE-2024-35830, CVE-2024-26779, CVE-2024-26843, CVE-2024-26778, CVE-2024-27046, CVE-2024-27412, CVE-2024-26839, CVE-2024-26773, CVE-2024-26748, CVE-2023-52620, CVE-2024-26805, CVE-2024-26915, CVE-2024-26848, CVE-2024-26688, CVE-2024-26840, CVE-2024-26856, CVE-2024-27414, CVE-2023-52645, CVE-2024-26880, CVE-2023-52656, CVE-2024-27053, CVE-2024-26752, CVE-2024-27047, CVE-2024-27416, CVE-2024-26882, CVE-2024-26803, CVE-2024-27073, CVE-2024-26884, CVE-2024-26769, CVE-2024-26737, CVE-2024-27054, CVE-2024-27044, CVE-2024-26777, CVE-2024-26749, CVE-2024-27436, CVE-2024-26788, CVE-2024-26751, CVE-2024-35828, CVE-2024-26891, CVE-2024-26771, CVE-2024-26877, CVE-2024-26733, CVE-2024-26793, CVE-2024-26659, CVE-2024-27419, CVE-2024-26870,…

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096)

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• ACPI drivers;
• Android drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• S/390 drivers;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• Network file system client; -…