CVE-2024-35939

In the Linux kernel, the following vulnerability has been resolved: dma-direct: Leak pages on dma_set_decrypted() failure On TDX it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. DMA could free decrypted/shared pages if dma_set_decrypted() fails. This should be a rare case. Just leak the pages in this case instead of freeing them.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

mptcp: ensure tx skbs always have the MPTCP ext

Due to signed/unsigned comparison, the expression:

info->size_goal - skb->len > 0

evaluates to true when the size goal is smaller than the skb size. That results in lack of tx cache refill, so that the skb allocated by the core TCP code lacks the required MPTCP skb extensions.

Due to the above, syzbot is able to trigger the following WARN_ON():

WARNING: CPU: 1 PID: 810 at net/mptcp/protocol.c:1366 mptcp_sendmsg_frag+0x1362/0x1bc0 net/mptcp/protocol.c:1366 Modules linked in: CPU: 1 PID: 810 Comm: syz-executor.4 Not tainted 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:mptcp_sendmsg_frag+0x1362/0x1bc0 net/mptcp/protocol.c:1366 Code: ff 4c 8b 74 24 50 48 8b 5c 24 58 e9 0f fb ff ff e8 13 44 8b f8 4c 89 e7 45 31 ed e8 98 57 2e fe e9 81 f4 ff ff e8 fe 43 8b f8 <0f> 0b 41 bd ea ff ff ff e9 6f f4 ff ff 4c 89 e7 e8 b9 8e d2 f8 e9 RSP: 0018:ffffc9000531f6a0 EFLAGS: 00010216 RAX: 000000000000697f RBX: 0000000000000000 RCX: ffffc90012107000 RDX: 0000000000040000 RSI: ffffffff88eac9e2 RDI: 0000000000000003 RBP: ffff888078b15780 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff88eac017 R11: 0000000000000000 R12: ffff88801de0a280 R13: 0000000000006b58 R14: ffff888066278280 R15: ffff88803c2fe9c0 FS: 00007fd9f866e700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007faebcb2f718 CR3: 00000000267cb000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __mptcp_push_pending+0x1fb/0x6b0 net/mptcp/protocol.c:1547 mptcp_release_cb+0xfe/0x210 net/mptcp/protocol.c:3003 release_sock+0xb4/0x1b0 net/core/sock.c:3206 sk_stream_wait_memory+0x604/0xed0 net/core/stream.c:145 mptcp_sendmsg+0xc39/0x1bc0 net/mptcp/protocol.c:1749 inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:643 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 sock_write_iter+0x2a0/0x3e0 net/socket.c:1057 call_write_iter include/linux/fs.h:2163 [inline] new_sync_write+0x40b/0x640 fs/read_write.c:507 vfs_write+0x7cf/0xae0 fs/read_write.c:594 ksys_write+0x1ee/0x250 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4665f9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd9f866e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000056c038 RCX: 00000000004665f9 RDX: 00000000000e7b78 RSI: 0000000020000000 RDI: 0000000000000003 RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c038 R13: 0000000000a9fb1f R14: 00007fd9f866e300 R15: 0000000000022000

Fix the issue rewriting the relevant expression to avoid sign-related problems - note: size_goal is always >= 0.

Additionally, ensure that the skb in the tx cache always carries the relevant extension.(CVE-2021-47370)

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix even more out of bound writes from debugfs

CVE-2021-42327 was fixed by:

commit f23750b5b3d98653b31d4469592935ef6364ad67 Author: Thelford Williams <[email protected]> Date: Wed Oct 13 16:04:13 2021 -0400

drm/amdgpu: fix out of bounds write

but amdgpu_dm_debugfs.c contains more of the same issue so fix the remaining ones.

v2: * Add missing fix in dp_max_bpc_write (Harry…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

RDMA: Verify port when creating flow rule

Validate port value provided by the user and with that remove no longer needed validation by the driver. The missing check in the mlx5_ib driver could cause to the below oops.

Call trace: _create_flow_rule+0x2d4/0xf28 [mlx5_ib] mlx5_ib_create_flow+0x2d0/0x5b0 [mlx5_ib] ib_uverbs_ex_create_flow+0x4cc/0x624 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xd4/0x150 [ib_uverbs] ib_uverbs_cmd_verbs.isra.7+0xb28/0xc50 [ib_uverbs] ib_uverbs_ioctl+0x158/0x1d0 [ib_uverbs] do_vfs_ioctl+0xd0/0xaf0 ksys_ioctl+0x84/0xb4 __arm64_sys_ioctl+0x28/0xc4 el0_svc_common.constprop.3+0xa4/0x254 el0_svc_handler+0x84/0xa0 el0_svc+0x10/0x26c Code: b9401260 f9615681 51000400 8b001c20 (f9403c1a)(CVE-2021-47265)

In the Linux kernel, the following vulnerability has been resolved:

mISDN: fix possible use-after-free in HFC_cleanup()

This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself.(CVE-2021-47356)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: ensure tx skbs always have the MPTCP ext

Due to signed/unsigned comparison, the expression:

info->size_goal - skb->len > 0

evaluates to true when the size goal is smaller than the skb size. That results in lack of tx cache refill, so that the skb allocated by the core TCP code lacks the required MPTCP skb extensions.

Due to the above, syzbot is able to trigger the following WARN_ON():

WARNING: CPU: 1 PID: 810 at net/mptcp/protocol.c:1366 mptcp_sendmsg_frag+0x1362/0x1bc0 net/mptcp/protocol.c:1366 Modules linked in: CPU: 1 PID: 810 Comm: syz-executor.4 Not tainted 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:mptcp_sendmsg_frag+0x1362/0x1bc0 net/mptcp/protocol.c:1366 Code: ff 4c 8b 74 24 50 48 8b 5c 24 58 e9 0f fb ff ff e8 13 44 8b f8 4c 89 e7 45 31 ed e8 98 57 2e fe e9 81 f4 ff ff e8 fe 43 8b f8 <0f> 0b 41 bd ea ff ff ff e9 6f f4 ff ff 4c 89 e7 e8 b9 8e d2 f8 e9 RSP: 0018:ffffc9000531f6a0 EFLAGS: 00010216 RAX: 000000000000697f RBX: 0000000000000000 RCX: ffffc90012107000 RDX: 0000000000040000 RSI: ffffffff88eac9e2 RDI: 0000000000000003 RBP: ffff888078b15780 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff88eac017 R11: 0000000000000000 R12: ffff88801de0a280 R13: 0000000000006b58 R14: ffff888066278280 R15: ffff88803c2fe9c0 FS: 00007fd9f866e700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007faebcb2f718 CR3: 00000000267cb000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __mptcp_push_pending+0x1fb/0x6b0 net/mptcp/protocol.c:1547 mptcp_release_cb+0xfe/0x210 net/mptcp/protocol.c:3003 release_sock+0xb4/0x1b0 net/core/sock.c:3206 sk_stream_wait_memory+0x604/0xed0 net/core/stream.c:145 mptcp_sendmsg+0xc39/0x1bc0 net/mptcp/protocol.c:1749 inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:643 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 sock_write_iter+0x2a0/0x3e0 net/socket.c:1057 call_write_iter include/linux/fs.h:2163 [inline] new_sync_write+0x40b/0x640 fs/read_write.c:507 vfs_write+0x7cf/0xae0 fs/read_write.c:594 ksys_write+0x1ee/0x250 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 …

Root has patched CVE-2024-35939 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2024-35939 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: dma-direct: Leak pages on dma_set_decrypted() failure On TDX it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. DMA could free decrypted/shared pages if dma_set_decrypted() fails. This should be a rare case. Just leak the pages in this case instead of freeing them.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: net/bluetooth: race condition in conn_info_{min,max}_age_set() (CVE-2024-24857)
• kernel: dmaengine: fix NULL pointer in channel unregistration function (CVE-2023-52492)
• kernel: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (CVE-2024-26851)
• kernel: netfilter: nft_set_pipapo: do not free live element (CVE-2024-26924)
• kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump (CVE-2024-27017)
• kernel: KVM: Always flush async #PF workqueue when vCPU is being destroyed (CVE-2024-26976)
• kernel: nouveau: lock the client object tree. (CVE-2024-27062)
• kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info (CVE-2024-35839)
• kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (CVE-2024-35898)
• kernel: dma-direct: Leak pages on dma_set_decrypted() failure (CVE-2024-35939)
• kernel: net/mlx5e: Fix netif state handling (CVE-2024-38608)
• kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. (CVE-2024-38586)
• kernel: of: module: add buffer overflow check in of_modalias() (CVE-2024-38541)
• kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (CVE-2024-38540)
• kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (CVE-2024-39503)
• kernel: drm/i915/dpt: Make DPT object unshrinkable (CVE-2024-40924)
• kernel: ipv6: prevent possible NULL deref in fib6_nh_init() (CVE-2024-40961)
• kernel: tipc: force a dst refcount before doing decryption (CVE-2024-40983)
• kernel: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CVE-2024-40984)
• kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CVE-2022-48773)
• kernel: bpf: Fix overrunning reservations in ringbuf (CVE-2024-41009)
• kernel: netfilter: nf_tables: prefer nft_chain_validate (CVE-2024-41042)
• kernel: ibmvnic: Add tx check to prevent skb leak (CVE-2024-41066)
• kernel: drm/i915/gt: Fix potential UAF by revoke of fence registers (CVE-2024-41092)
• kernel: drm/amdgpu: avoid using null object of framebuffer (CVE-2024-41093)
• kernel: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (CVE-2024-42070)
• kernel: gfs2: Fix NULL pointer dereference in gfs2_log_flush (CVE-2024-42079)
• kernel: USB: serial: mos7840: fix crash on resume (CVE-2024-42244)
• kernel: tipc: Return non-zero value from tipc_udp_addr2str() on error (CVE-2024-42284)
• kernel: kobject_uevent: Fix OOB access within zap_modalias_env() (CVE-2024-42292)
• kernel: dev/parport: fix the array out-of-bounds risk (CVE-2024-42301)
• kernel: block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854)
• kernel: mlxsw: spectrum_acl_erp: Fix object nesting warning (CVE-2024-43880)
• kernel: gso: do not skip outer ip header in case of ipip and net_failover (CVE-2022-48936)
• kernel: padata: Fix possible divide-by-0 panic in padata_mt_helper() (CVE-2024-43889)
• kernel: memcg: protect concurrent access to mem_cgroup_idr (CVE-2024-43892)
• kernel: sctp: Fix null-ptr-deref in reuseport_add_sock(). (CVE-2024-44935)
• kernel: bonding: fix xfrm real_dev null pointer dereference (CVE-2024-44989)
• kernel: bonding: fix null pointer deref in bond_ipsec_offload_ok (CVE-2024-44990)
• kernel: netfilter: flowtable: initialise extack before use (CVE-2024-45018)
• kernel: ELF: fix kernel.randomize_va_space double read (CVE-2024-46826)
• kernel: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (CVE-2024-47668)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: net/bluetooth: race condition in conn_info_{min,max}_age_set() (CVE-2024-24857)
• kernel: dmaengine: fix NULL pointer in channel unregistration function (CVE-2023-52492)
• kernel: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (CVE-2024-26851)
• kernel: netfilter: nft_set_pipapo: do not free live element (CVE-2024-26924)
• kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump (CVE-2024-27017)
• kernel: KVM: Always flush async #PF workqueue when vCPU is being destroyed (CVE-2024-26976)
• kernel: nouveau: lock the client object tree. (CVE-2024-27062)
• kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info (CVE-2024-35839)
• kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (CVE-2024-35898)
• kernel: dma-direct: Leak pages on dma_set_decrypted() failure (CVE-2024-35939)
• kernel: net/mlx5e: Fix netif state handling (CVE-2024-38608)
• kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. (CVE-2024-38586)
• kernel: of: module: add buffer overflow check in of_modalias() (CVE-2024-38541)
• kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (CVE-2024-38540)
• kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (CVE-2024-39503)
• kernel: drm/i915/dpt: Make DPT object unshrinkable (CVE-2024-40924)
• kernel: ipv6: prevent possible NULL deref in fib6_nh_init() (CVE-2024-40961)
• kernel: tipc: force a dst refcount before doing decryption (CVE-2024-40983)
• kernel: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CVE-2024-40984)
• kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CVE-2022-48773)
• kernel: bpf: Fix overrunning reservations in ringbuf (CVE-2024-41009)
• kernel: netfilter: nf_tables: prefer nft_chain_validate (CVE-2024-41042)
• kernel: ibmvnic: Add tx check to prevent skb leak (CVE-2024-41066)
• kernel: drm/i915/gt: Fix potential UAF by revoke of fence registers (CVE-2024-41092)
• kernel: drm/amdgpu: avoid using null object of framebuffer (CVE-2024-41093)
• kernel: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (CVE-2024-42070)
• kernel: gfs2: Fix NULL pointer dereference in gfs2_log_flush (CVE-2024-42079)
• kernel: USB: serial: mos7840: fix crash on resume (CVE-2024-42244)
• kernel: tipc: Return non-zero value from tipc_udp_addr2str() on error (CVE-2024-42284)
• kernel: kobject_uevent: Fix OOB access within zap_modalias_env() (CVE-2024-42292)
• kernel: dev/parport: fix the array out-of-bounds risk (CVE-2024-42301)
• kernel: block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854)
• kernel: mlxsw: spectrum_acl_erp: Fix object nesting warning (CVE-2024-43880)
• kernel: gso: do not skip outer ip header in case of ipip and net_failover (CVE-2022-48936)
• kernel: padata: Fix possible divide-by-0 panic in padata_mt_helper() (CVE-2024-43889)
• kernel: memcg: protect concurrent access to mem_cgroup_idr (CVE-2024-43892)
• kernel: sctp: Fix null-ptr-deref in reuseport_add_sock(). (CVE-2024-44935)
• kernel: bonding: fix xfrm real_dev null pointer dereference (CVE-2024-44989)
• kernel: bonding: fix null pointer deref in bond_ipsec_offload_ok (CVE-2024-44990)
• kernel: netfilter: flowtable: initialise extack before use (CVE-2024-45018)
• kernel: ELF: fix kernel.randomize_va_space double read (CVE-2024-46826)
• kernel: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (CVE-2024-47668)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the…

In the Linux kernel, the following vulnerability has been resolved:

dma-direct: Leak pages on dma_set_decrypted() failure

On TDX it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues.

DMA could free decrypted/shared pages if dma_set_decrypted() fails. This should be a rare case. Just leak the pages in this case instead of freeing them.

• mm: zswap: fix missing folio cleanup in writeback race path {CVE-2024-26832}
• mm: fix zswap writeback race condition {CVE-2023-53178}
• dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929}
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• gpio: davinci: Validate the obtained number of IRQs {CVE-2024-42092}
• ASoC: topology: Fix references to freed memory {CVE-2024-41069}
• Bluetooth: hci_sock: Fix not validating setsockopt user input {CVE-2024-35963}
• Bluetooth: ISO: Fix not validating setsockopt user input {CVE-2024-35964}
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
• dma-direct: Leak pages on dma_set_decrypted() failure {CVE-2024-35939}
• wifi: mwifiex: avoid possible NULL skb pointer dereference {CVE-2023-53384}
• md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request {CVE-2023-53380}
• icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
• thermal: core: prevent potential string overflow {CVE-2023-52868}
• drm/amdkfd: Fix shift out-of-bounds issue {CVE-2023-52816}
• drm/vkms: Fix null-ptr-deref in vkms_release() {CVE-2022-50369}
• nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
• net/mlx5: Fix tainted pointer delete is case of flow rules creation fail {CVE-2024-40940}
• ipvlan: add ipvlan_route_v6_outbound() helper {CVE-2023-52796}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
• platform/x86: wmi: remove unnecessary initializations
• perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
• net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• kobject_uevent: Fix OOB access within zap_modalias_env() {CVE-2024-42292}
• mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() {CVE-2023-53401}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
• drm/radeon: possible buffer overflow {CVE-2023-52867}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
• wifi: mac80211_hwsim: Fix possible NULL dereference {CVE-2023-53209}
• vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
• wifi: iwlwifi: fw: fix memory leak in debugfs {CVE-2023-53422}
• drm/amdgpu: fix memory leak in mes self test {CVE-2023-53370}
• skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
• md/raid10: fix leak of 'r10bio->remaining' for recovery {CVE-2023-53299}
• nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
• ppdev: Add an error check in register_device {CVE-2024-36015}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
• net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
• net: add atomic_long_t to net_device_stats fields {CVE-2024-26882}

• wifi: mwifiex: Fix OOB and integer underflow when rx packets {CVE-2023-53226} {CVE-2023-53226}
• wifi: mac80211: check S1G action frame size {CVE-2023-53257} {CVE-2023-53257}
• wifi: cfg80211: fix use-after-free in cmp_bss() {CVE-2025-39864} {CVE-2025-39864}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772} {CVE-2025-21772}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014} {CVE-2024-58014}
• wifi: at76c50x: fix use after free access in at76_disconnect {CVE-2025-37796} {CVE-2025-37796}
• dma-direct: Leak pages on dma_set_decrypted() failure {CVE-2024-35939} {CVE-2024-35939}
• Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386} {CVE-2022-50386}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817} {CVE-2025-39817}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937} {CVE-2024-35937}
• nfs: fix UAF in direct writes {CVE-2024-26958} {CVE-2024-26958}
• wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921} {CVE-2024-36921}
• net/smc: avoid data corruption caused by decline {CVE-2023-52775} {CVE-2023-52775}
• bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() {CVE-2024-39487} {CVE-2024-39487}
• scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978} {CVE-2024-40978}
• mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961} {CVE-2024-26961}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864} {CVE-2023-52864}
• net/sched: act_mirred: don't override retval if we already lost the skb {CVE-2024-26739} {CVE-2024-26739}
• drm/dp_mst: Fix resetting msg rx state after topology removal {CVE-2024-57876} {CVE-2024-57876}
• net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556} {CVE-2024-38556}
• of: Fix double free in of_parse_phandle_with_args_map {CVE-2023-52679} {CVE-2023-52679}
• xhci: Handle TD clearing for multiple streams case {CVE-2024-40927} {CVE-2024-40927}
• wifi: mac80211: fix potential key use-after-free {CVE-2023-52530} {CVE-2023-52530}
• net: openvswitch: Fix Use-After-Free in ovs_ct_exit {CVE-2024-27395} {CVE-2024-27395}
• r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586} {CVE-2024-38586}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764} {CVE-2023-52764}
• media: bttv: fix use after free error due to btv->timeout timer {CVE-2023-52847} {CVE-2023-52847}
• vsock: Fix transport_* TOCTOU {CVE-2025-38461} {CVE-2025-38461}
• ppdev: Add an error check in register_device {CVE-2024-36015} {CVE-2024-36015}
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556} {CVE-2025-38556}
• iio: adc: at91: call input_free_device() on allocated iio_dev {CVE-2024-57904} {CVE-2024-57904}
• perf/aux: Fix AUX buffer serialization {CVE-2024-46713} {CVE-2024-46713}
• net_sched: hfsc: Fix a UAF vulnerability in class handling {CVE-2025-37797} {CVE-2025-37797}
• wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072} {CVE-2024-58072}
• wifi: rtlwifi: remove unused dualmac control leftovers {CVE-2024-58072} {CVE-2024-58072}
• wifi: rtlwifi: remove unused timer and related code {CVE-2024-58072} {CVE-2024-58072}
• ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() {CVE-2025-22121} {CVE-2025-22121}
• ext4: move where set the MAY_INLINE_DATA flag is set {CVE-2025-22121} {CVE-2025-22121}
• ext4: introduce ITAIL helper {CVE-2025-22121} {CVE-2025-22121}
• ext4: improve xattr consistency checking and error reporting {CVE-2025-22121} {CVE-2025-22121}
• mm: fix zswap writeback race condition {CVE-2023-53178} {CVE-2023-53178}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-50367} {CVE-2022-50367}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757} {CVE-2025-39757}
• smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527} {CVE-2025-38527} -…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: net/bluetooth: race condition in conn_info_{min,max}_age_set() (CVE-2024-24857)

• kernel: dmaengine: fix NULL pointer in channel unregistration function (CVE-2023-52492)

• kernel: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (CVE-2024-26851)

• kernel: netfilter: nft_set_pipapo: do not free live element (CVE-2024-26924)

• kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump (CVE-2024-27017)

• kernel: KVM: Always flush async #PF workqueue when vCPU is being destroyed (CVE-2024-26976)

• kernel: nouveau: lock the client object tree. (CVE-2024-27062)

• kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info (CVE-2024-35839)

• kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (CVE-2024-35898)

• kernel: dma-direct: Leak pages on dma_set_decrypted() failure (CVE-2024-35939)

• kernel: net/mlx5e: Fix netif state handling (CVE-2024-38608)

• kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. (CVE-2024-38586)

• kernel: of: module: add buffer overflow check in of_modalias() (CVE-2024-38541)

• kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (CVE-2024-38540)

• kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (CVE-2024-39503)

• kernel: drm/i915/dpt: Make DPT object unshrinkable (CVE-2024-40924)

• kernel: ipv6: prevent possible NULL deref in fib6_nh_init() (CVE-2024-40961)

• kernel: tipc: force a dst refcount before doing decryption (CVE-2024-40983)

• kernel: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CVE-2024-40984)

• kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CVE-2022-48773)

• kernel: bpf: Fix overrunning reservations in ringbuf (CVE-2024-41009)

• kernel: netfilter: nf_tables: prefer nft_chain_validate (CVE-2024-41042)

• kernel: ibmvnic: Add tx check to prevent skb leak (CVE-2024-41066)

• kernel: drm/i915/gt: Fix potential UAF by revoke of fence registers (CVE-2024-41092)

• kernel: drm/amdgpu: avoid using null object of framebuffer (CVE-2024-41093)

• kernel: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (CVE-2024-42070)

• kernel: gfs2: Fix NULL pointer dereference in gfs2_log_flush (CVE-2024-42079)

• kernel: USB: serial: mos7840: fix crash on resume (CVE-2024-42244)

• kernel: tipc: Return non-zero value from tipc_udp_addr2str() on error (CVE-2024-42284)

• kernel: kobject_uevent: Fix OOB access within zap_modalias_env() (CVE-2024-42292)

• kernel: dev/parport: fix the array out-of-bounds risk (CVE-2024-42301)

• kernel: block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854)

• kernel: mlxsw: spectrum_acl_erp: Fix object nesting warning (CVE-2024-43880)

• kernel: gso: do not skip outer ip header in case of ipip and net_failover (CVE-2022-48936)

• kernel: padata: Fix possible divide-by-0 panic in padata_mt_helper() (CVE-2024-43889)

• kernel: memcg: protect concurrent access to mem_cgroup_idr (CVE-2024-43892)

• kernel: sctp: Fix null-ptr-deref in reuseport_add_sock(). (CVE-2024-44935)

• kernel: bonding: fix xfrm real_dev null pointer dereference (CVE-2024-44989)

• kernel: bonding: fix null pointer deref in bond_ipsec_offload_ok (CVE-2024-44990)

• kernel: netfilter: flowtable: initialise extack before use (CVE-2024-45018)

• kernel: ELF: fix kernel.randomize_va_space double read (CVE-2024-46826)

• kernel: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (CVE-2024-47668)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: net/bluetooth: race condition in conn_info_{min,max}_age_set() (CVE-2024-24857)

• kernel: dmaengine: fix NULL pointer in channel unregistration function (CVE-2023-52492)

• kernel: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (CVE-2024-26851)

• kernel: netfilter: nft_set_pipapo: do not free live element (CVE-2024-26924)

• kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump (CVE-2024-27017)

• kernel: KVM: Always flush async #PF workqueue when vCPU is being destroyed (CVE-2024-26976)

• kernel: nouveau: lock the client object tree. (CVE-2024-27062)

• kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info (CVE-2024-35839)

• kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (CVE-2024-35898)

• kernel: dma-direct: Leak pages on dma_set_decrypted() failure (CVE-2024-35939)

• kernel: net/mlx5e: Fix netif state handling (CVE-2024-38608)

• kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. (CVE-2024-38586)

• kernel: of: module: add buffer overflow check in of_modalias() (CVE-2024-38541)

• kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (CVE-2024-38540)

• kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (CVE-2024-39503)

• kernel: drm/i915/dpt: Make DPT object unshrinkable (CVE-2024-40924)

• kernel: ipv6: prevent possible NULL deref in fib6_nh_init() (CVE-2024-40961)

• kernel: tipc: force a dst refcount before doing decryption (CVE-2024-40983)

• kernel: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CVE-2024-40984)

• kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CVE-2022-48773)

• kernel: bpf: Fix overrunning reservations in ringbuf (CVE-2024-41009)

• kernel: netfilter: nf_tables: prefer nft_chain_validate (CVE-2024-41042)

• kernel: ibmvnic: Add tx check to prevent skb leak (CVE-2024-41066)

• kernel: drm/i915/gt: Fix potential UAF by revoke of fence registers (CVE-2024-41092)

• kernel: drm/amdgpu: avoid using null object of framebuffer (CVE-2024-41093)

• kernel: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (CVE-2024-42070)

• kernel: gfs2: Fix NULL pointer dereference in gfs2_log_flush (CVE-2024-42079)

• kernel: USB: serial: mos7840: fix crash on resume (CVE-2024-42244)

• kernel: tipc: Return non-zero value from tipc_udp_addr2str() on error (CVE-2024-42284)

• kernel: kobject_uevent: Fix OOB access within zap_modalias_env() (CVE-2024-42292)

• kernel: dev/parport: fix the array out-of-bounds risk (CVE-2024-42301)

• kernel: block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854)

• kernel: mlxsw: spectrum_acl_erp: Fix object nesting warning (CVE-2024-43880)

• kernel: gso: do not skip outer ip header in case of ipip and net_failover (CVE-2022-48936)

• kernel: padata: Fix possible divide-by-0 panic in padata_mt_helper() (CVE-2024-43889)

• kernel: memcg: protect concurrent access to mem_cgroup_idr (CVE-2024-43892)

• kernel: sctp: Fix null-ptr-deref in reuseport_add_sock(). (CVE-2024-44935)

• kernel: bonding: fix xfrm real_dev null pointer dereference (CVE-2024-44989)

• kernel: bonding: fix null pointer deref in bond_ipsec_offload_ok (CVE-2024-44990)

• kernel: netfilter: flowtable: initialise extack before use (CVE-2024-45018)

• kernel: ELF: fix kernel.randomize_va_space double read (CVE-2024-46826)

• kernel: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (CVE-2024-47668)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
• CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52660: Fiedx IRQ handling due to shared interrupts (bsc#1224443).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26715: Fixed NULL pointer dereference in dwc3_gadget_suspend (bsc#1222561).
• CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes bsc#1222608).
• CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
• CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
• CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
• CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
• CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
• CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
• CVE-2024-27042: Fixed potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (bsc#1223823).
• CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).
• CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181).
• CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr() (bsc#1224721)
• CVE-2024-27419: Fixed data-races around sysctl_net_busy_read (bsc#1224759)
• CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
• CVE-2024-35791: Flush pages under…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575).
• CVE-2024-36938: Fixed NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761).
• CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2024-35998: Fixed lock ordering potential deadlock in cifs_sync_mid_result (bsc#1224549).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
• CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
• CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break() (bsc#1224668).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
• CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
• CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
• CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key() (bsc#1224667).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-35869: Guarantee refcounted children from parent session (bsc#1224679).
• CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2024-35964: Fixed not validating setsockopt user input (bsc#1224581).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
• CVE-2024-35860: struct bpf_link and bpf_link_ops kABI workaround (bsc#1224531).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).
• CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).
• CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
• CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
• CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
• CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios (bsc#1224530).
• CVE-2024-35852: Fixed memory leak when canceling rehash work (bsc#1224502).
• CVE-2024-36006: Fixed incorrect list API usage (bsc#1224541).
• CVE-2024-36007: Fixed warning during rehash (bsc#1224543).
• CVE-2024-35885: Stop interface during shutdown (bsc#1224519).
• CVE-2024-35907: Call request_irq() after NAPI initialized (bsc#1224492).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
• CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52660: Fiedx IRQ handling due to shared interrupts (bsc#1224443).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26700: Fixed drm/amd/display: Fix MST Null Ptr for RV (bsc#1222870)
• CVE-2024-26715: Fixed NULL pointer dereference in dwc3_gadget_suspend (bsc#1222561).
• CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes bsc#1222608).
• CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
• CVE-2024-26777: Error out if pixclock equals zero in fbdev/sis (bsc#1222765)
• CVE-2024-26778: Error out if pixclock equals zero in fbdev/savage (bsc#1222770)
• CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26839: Fixed a memleak in init_credit_return() (bsc#1222975)
• CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
• CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
• CVE-2024-26907: Fixed a fortify source warning while accessing Eth segment in mlx5 (bsc#1223203).
• CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
• CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
• CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
• CVE-2024-27042: Fixed potential out-of-bounds access in…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
• CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
• CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
• CVE-2024-43911: Fix NULL dereference at band check in starting tx ba session (bsc#1229827).
• CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
• CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
• CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
• CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
• CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
• CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
• CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
• CVE-2024-36270: Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (bsc#1226798)
• CVE-2024-36881: Reset ptes when close() for wr-protected ones (bsc#1225718).
• CVE-2024-42316: Fix div-by-zero in vmpressure_calc_level() (bsc#1229353).
• CVE-2024-43855: Fix deadlock between mddev_suspend and flush bio (bsc#1229342,).
• CVE-2024-43864: Fix CT entry update leaks of modify header context (bsc#1229496)
• CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
• CVE-2024-42109: Unconditionally flush pending work before notifier (bsc#1228505)
• CVE-2024-41084: Avoid null pointer dereference in region lookup (bsc#1228472)
• CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
• CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
• CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
• CVE-2024-27079: Add kABI workaround patch (bsc#1223742).
• CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
• CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
• CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
• CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
• CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
• CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
• CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
• CVE-2024-26809: Release elements in clone only from destroy path (bsc#1222633).
• CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).
• CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).
• CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
• CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).
• CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).
• CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)
• CVE-2024-27433: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
• CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
• CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
• CVE-2024-40920: Fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
• CVE-2024-40921: Pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
• CVE-2024-36979: Fix vlan use-after-free (bsc#1226604).
• CVE-2024-26590: Fix inconsistent per-file compression format (bsc#1220252,).
• CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).
• CVE-2024-42270: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404)
• CVE-2024-42269: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402)
• CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
• CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383) -…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
• CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
• CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
• CVE-2024-43911: Fix NULL dereference at band check in starting tx ba session (bsc#1229827).
• CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
• CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
• CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
• CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
• CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
• CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
• CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
• CVE-2024-36881: Fix reset ptes when close() for wr-protected (bsc#1225718).
• CVE-2024-42316: Fix div-by-zero in vmpressure_calc_level() (bsc#1229353).
• CVE-2024-43855: Fix deadlock between mddev_suspend and flush bio (bsc#1229342).
• CVE-2024-43864: Fix CT entry update leaks of modify header context (bsc#1229496).
• CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
• CVE-2024-42109: Unconditionally flush pending work before notifier (bsc#1228505).
• CVE-2024-41084: Avoid null pointer dereference in region lookup (bsc#1228472).
• CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
• CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
• CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
• CVE-2024-27079: Fix NULL domain on device release (bsc#1223742).
• CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
• CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
• CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
• CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
• CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
• CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
• CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
• CVE-2024-26809: Release elements in clone only from destroy path (bsc#1222633).
• CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).
• CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).
• CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
• CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).
• CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).
• CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)
• CVE-2024-27433: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
• CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
• CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
• CVE-2024-40920: Fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
• CVE-2024-40921: Pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
• CVE-2024-36979: Fix vlan use-after-free (bsc#1226604).
• CVE-2024-26590: Fix inconsistent per-file compression format (bsc#1220252).
• CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).
• CVE-2024-42270: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404).
• CVE-2024-42269: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402).
• CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
• CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383)
• CVE-2024-42312: Always initialize i_uid/i_gid (bsc#1229357)
• CVE-2024-43854: Initialize integrity buffer to zero…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-43911: wifi: mac80211: fix NULL dereference at band check in starting tx ba session (bsc#1229827).
• CVE-2024-43899: drm/amd/display: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
• CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
• CVE-2024-43880: kabi: lib: objagg: Put back removed metod in struct objagg_ops (bsc#1229481).
• CVE-2024-43866: net/mlx5: Always drain health in shutdown callback (bsc#1229495).
• CVE-2024-43864: net/mlx5e: Fix CT entry update leaks of modify header context (bsc#1229496).
• CVE-2024-43855: md: fix deadlock between mddev_suspend and flush bio (bsc#1229342).
• CVE-2024-43854: block: initialize integrity buffer to zero before writing it to media (bsc#1229345)
• CVE-2024-43850: soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove (bsc#1229316).
• CVE-2024-43839: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).
• CVE-2024-43837: bpf: Fix updating attached freplace prog in prog_array map (bsc#1229297).
• CVE-2024-43834: xdp: fix invalid wait context of page_pool_destroy() (bsc#1229314)
• CVE-2024-43831: media: mediatek: vcodec: Handle invalid decoder vsi (bsc#1229309).
• CVE-2024-43821: scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315).
• CVE-2024-42322: ipvs: properly dereference pe in ip_vs_add_service (bsc#1229347)
• CVE-2024-42318: landlock: Do not lose track of restrictions on cred_transfer (bsc#1229351).
• CVE-2024-42316: mm/mglru: fix div-by-zero in vmpressure_calc_level() (bsc#1229353).
• CVE-2024-42312: sysctl: always initialize i_uid/i_gid (bsc#1229357)
• CVE-2024-42308: Update DRM patch reference (bsc#1229411)
• CVE-2024-42301: dev/parport: fix the array out-of-bounds risk (bsc#1229407).
• CVE-2024-42295: nilfs2: handle inconsistent state in nilfs_btnode_create_block() (bsc#1229370).
• CVE-2024-42291: ice: Add a per-VF limit on number of FDIR filters (bsc#1229374).
• CVE-2024-42290: irqchip/imx-irqsteer: Handle runtime power management correctly (bsc#1229379).
• CVE-2024-42284: tipc: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
• CVE-2024-42283: net: nexthop: Initialize all fields in dumped nexthops (bsc#1229383)
• CVE-2024-42281: bpf: Fix a segment issue when downgrading gso_size (bsc#1229386).
• CVE-2024-42277: iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
• CVE-2024-42270: netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404).
• CVE-2024-42269: netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402).
• CVE-2024-42268: net/mlx5: Fix missing lock on sync reset reload (bsc#1229391).
• CVE-2024-42247: wireguard: allowedips: avoid unaligned 64-bit memory accesses (bsc#1228988).
• CVE-2024-42246: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).
• CVE-2024-42245: Revert 'sched/fair: Make sure to try to detach at least one movable task' (bsc#1228978).
• CVE-2024-42241: mm/shmem: disable PMD-sized page cache if needed (bsc#1228986).
• CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list (bsc#1228723).
• CVE-2024-42162: gve: Account for stopped queues when reading NIC stats (bsc#1228706).
• CVE-2024-42161: bpf: avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756).
• CVE-2024-42159: scsi: mpi3mr: fix sanitise num_phys (bsc#1228754).
• CVE-2024-42158: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
• CVE-2024-42157: s390/pkey: Wipe sensitive data on failure (bsc#1228727).
• CVE-2024-42156: s390/pkey: Wipe copies of clear-key structures on failure (bsc#1228722).
• CVE-2024-42155: s390/pkey: Wipe copies of protected- and secure-keys (bsc#1228733).
• CVE-2024-42148: bnx2x: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).
• CVE-2024-42145:…

The SUSE Linux Enterprise Micro 6.0 kernel was updated to receive various security bugfixes.

This release includes the first live patch.

The following security bugs were fixed:

• CVE-2023-52489: mm/sparsemem: fix race in accessing memory_section->usage (bsc#1221326).
• CVE-2023-52581: netfilter: nf_tables: fix memleak when more than 255 elements expired (bsc#1220877).
• CVE-2023-52859: perf: hisi: Fix use-after-free when register pmu fails (bsc#1225582).
• CVE-2023-52889: apparmor: Fix null pointer deref when receiving skb during sock creation (bsc#1229287,).
• CVE-2024-26590: erofs: fix inconsistent per-file compression format (bsc#1220252).
• CVE-2024-26631: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
• CVE-2024-26668: netfilter: nft_limit: reject configurations that cause integer overflow (bsc#1222335).
• CVE-2024-26669: kABI fix for net/sched: flower: Fix chain template offload (bsc#1222350).
• CVE-2024-26677: blacklist.conf: Add e7870cf13d20 ("rxrpc: Fix delayed ACKs to not set the reference serial number") (bsc#1222387)
• CVE-2024-26735: ipv6: sr: fix possible use-after-free and null-ptr-deref (bsc#1222372).
• CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
• CVE-2024-26809: netfilter: nft_set_pipapo: release elements in clone only from destroy path (bsc#1222633).
• CVE-2024-26812: kABI: vfio: struct virqfd kABI workaround (bsc#1222808).
• CVE-2024-26835: netfilter: nf_tables: set dormant flag on hook register failure (bsc#1222967).
• CVE-2024-26837: net: bridge: switchdev: Skip MDB replays of deferred events on offload (bsc#1222973).
• CVE-2024-26851: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (bsc#1223074)
• CVE-2024-27010: net/sched: Fix mirred deadlock on device recursion (bsc#1223720).
• CVE-2024-27011: netfilter: nf_tables: fix memleak in map from abort path (bsc#1223803).
• CVE-2024-27024: net/rds: fix WARNING in rds_conn_connect_if_down (bsc#1223777).
• CVE-2024-27079: iommu/vt-d: Fix NULL domain on device release (bsc#1223742).
• CVE-2024-27403: kabi: restore const specifier in flow_offload_route_init() (bsc#1224415).
• CVE-2024-27433: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
• CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
• CVE-2024-35897: netfilter: nf_tables: discard table flag update with pending basechain deletion (bsc#1224510).
• CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
• CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
• CVE-2024-36286: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
• CVE-2024-36489: tls: fix missing memory barrier in tls_init (bsc#1226874)
• CVE-2024-36881: mm/userfaultfd: reset ptes when close() for wr-protected ones (bsc#1225718).
• CVE-2024-36929: net: core: reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).
• CVE-2024-36933: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).
• CVE-2024-36979: net: bridge: mst: fix vlan use-after-free syzbot reported a suspicious rcu usage[1] in bridge's mst code. (bsc#1226604).
• CVE-2024-38662: selftests/bpf: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
• CVE-2024-39489: ipv6: sr: fix memleak in seg6_hmac_init_algo (bsc#1227623)
• CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).
• CVE-2024-40905: ipv6: fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
• CVE-2024-40909: bpf: Fix a potential use-after-free in bpf_link_free() (bsc#1227798).
• CVE-2024-40920: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
• CVE-2024-40921: net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
• CVE-2024-40938: landlock: fix d_parent…

The SUSE Linux Enterprise Micro 6.0 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52489: mm/sparsemem: fix race in accessing memory_section->usage (bsc#1221326).
• CVE-2023-52581: netfilter: nf_tables: fix memleak when more than 255 elements expired (bsc#1220877).
• CVE-2023-52859: perf: hisi: Fix use-after-free when register pmu fails (bsc#1225582).
• CVE-2023-52889: apparmor: Fix null pointer deref when receiving skb during sock creation (bsc#1229287).
• CVE-2024-26590: erofs: fix inconsistent per-file compression format (bsc#1220252).
• CVE-2024-26631: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
• CVE-2024-26668: netfilter: nft_limit: reject configurations that cause integer overflow (bsc#1222335).
• CVE-2024-26669: kABI fix for net/sched: flower: Fix chain template offload (bsc#1222350).
• CVE-2024-26677: Blacklist e7870cf13d20 (" Fix delayed ACKs to not set the reference serial number") (bsc#1222387)
• CVE-2024-26735: ipv6: sr: fix possible use-after-free and null-ptr-deref (bsc#1222372).
• CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
• CVE-2024-26809: netfilter: nft_set_pipapo: release elements in clone only from destroy path (bsc#1222633).
• CVE-2024-26812: kABI: vfio: struct virqfd kABI workaround (bsc#1222808).
• CVE-2024-26835: netfilter: nf_tables: set dormant flag on hook register failure (bsc#1222967).
• CVE-2024-26837: net: bridge: switchdev: race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).
• CVE-2024-26851: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (bsc#1223074)
• CVE-2024-27010: net/sched: Fix mirred deadlock on device recursion (bsc#1223720).
• CVE-2024-27011: netfilter: nf_tables: fix memleak in map from abort path (bsc#1223803).
• CVE-2024-27024: net/rds: fix WARNING in rds_conn_connect_if_down (bsc#1223777).
• CVE-2024-27079: iommu/vt-d: Fix NULL domain on device release (bsc#1223742).
• CVE-2024-27403: kabi: restore const specifier in flow_offload_route_init() (bsc#1224415).
• CVE-2024-27433: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
• CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
• CVE-2024-35897: netfilter: nf_tables: discard table flag update with pending basechain deletion (bsc#1224510).
• CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
• CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
• CVE-2024-36286: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
• CVE-2024-36489: tls: fix missing memory barrier in tls_init (bsc#1226874)
• CVE-2024-36881: mm/userfaultfd: Fix reset ptes when close() for wr-protected (bsc#1225718).
• CVE-2024-36929: net: core: reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).
• CVE-2024-36933: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).
• CVE-2024-36979: net: bridge: mst: fix vlan use-after-free (bsc#1226604).
• CVE-2024-38662: selftests/bpf: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
• CVE-2024-39489: ipv6: sr: fix memleak in seg6_hmac_init_algo (bsc#1227623)
• CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).
• CVE-2024-40905: ipv6: fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
• CVE-2024-40909: bpf: Fix a potential use-after-free in bpf_link_free() (bsc#1227798).
• CVE-2024-40920: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
• CVE-2024-40921: net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
• CVE-2024-40938: landlock: fix d_parent walk (bsc#1227840).
• CVE-2024-40939: net: wwan: iosm: Fix tainted…

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Accessibility subsystem;
• Android drivers;
• Drivers core;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• Buffer Sharing and Synchronization framework;
• GPU drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• Device tree and open firmware driver;
• Chrome hardware platform drivers;
• i.MX PM domains;
• TI SCI PM domains driver;
• S/390 drivers;
• SCSI drivers;
• SPI subsystem;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• Framebuffer layer;
• BTRFS file system;
• Network file system server daemon;
• NILFS2 file system;
• File systems infrastructure;
• Pstore file system;
• SMB network file system;
• BPF subsystem;
• Bluetooth subsystem;
• Netfilter;
• io_uring subsystem;
• Core kernel;
• Extra boot config (XBC);
• Memory management;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• eXpress Data Path;
• SELinux security module; (CVE-2024-35967, CVE-2024-35886, CVE-2024-26999, CVE-2024-27008, CVE-2024-26988, CVE-2024-35980, CVE-2024-26982, CVE-2024-35946, CVE-2024-35918, CVE-2024-27015, CVE-2024-35900, CVE-2024-35942, CVE-2024-35879, CVE-2024-35961, CVE-2024-35944, CVE-2024-35934, CVE-2024-35978, CVE-2024-35938, CVE-2024-27003, CVE-2024-35976, CVE-2024-36019, CVE-2024-35880, CVE-2024-35866, CVE-2024-35929, CVE-2024-35917, CVE-2024-35912, CVE-2024-35896, CVE-2024-26986, CVE-2024-35951, CVE-2024-35958, CVE-2024-26997, CVE-2024-35965, CVE-2024-35953, CVE-2024-26993, CVE-2024-26991, CVE-2024-35892, CVE-2024-36026, CVE-2024-35882, CVE-2024-35964, CVE-2024-35865, CVE-2024-35897, CVE-2024-26981, CVE-2024-35872, CVE-2024-36027, CVE-2024-26983, CVE-2024-35909, CVE-2024-35985, CVE-2024-35875, CVE-2024-35890, CVE-2024-26922, CVE-2024-26994, CVE-2024-35903, CVE-2024-35936, CVE-2024-35904, CVE-2024-27013, CVE-2024-36025, CVE-2024-26980, CVE-2024-27006, CVE-2024-35861, CVE-2024-35864, CVE-2024-27018, CVE-2024-36022, CVE-2024-26990, CVE-2024-35968, CVE-2024-35860, CVE-2024-36024, CVE-2024-35933, CVE-2024-27019, CVE-2024-35925, CVE-2024-35950, CVE-2024-35915, CVE-2024-35916, CVE-2024-35956, CVE-2024-36020, CVE-2024-35873, CVE-2024-27002, CVE-2024-35963, CVE-2024-35959, CVE-2024-35937, CVE-2024-27011, CVE-2024-27020, CVE-2024-35883, CVE-2024-35913, CVE-2024-35910, CVE-2024-27021, CVE-2024-35921, CVE-2024-35905, CVE-2024-27010, CVE-2024-35981, CVE-2024-35885, CVE-2024-35955, CVE-2024-35894, CVE-2024-35969, CVE-2024-36018, CVE-2024-35867, CVE-2024-27007, CVE-2024-35908, CVE-2024-26985, CVE-2024-27016, CVE-2024-35960, CVE-2024-35935, CVE-2024-35932, CVE-2024-35957, CVE-2024-27001, CVE-2024-35871, CVE-2024-35907, CVE-2024-35878, CVE-2024-35979, CVE-2024-35972, CVE-2024-35975, CVE-2024-35877, CVE-2024-35926, CVE-2024-26817, CVE-2024-35899, CVE-2024-27004, CVE-2024-35920, CVE-2024-35924, CVE-2024-35977, CVE-2024-35930, CVE-2024-35911, CVE-2024-26996,…

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Accessibility subsystem;
• Android drivers;
• Drivers core;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• Buffer Sharing and Synchronization framework;
• GPU drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• Device tree and open firmware driver;
• Chrome hardware platform drivers;
• i.MX PM domains;
• TI SCI PM domains driver;
• S/390 drivers;
• SCSI drivers;
• SPI subsystem;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• Framebuffer layer;
• BTRFS file system;
• Network file system server daemon;
• NILFS2 file system;
• File systems infrastructure;
• Pstore file system;
• SMB network file system;
• BPF subsystem;
• Bluetooth subsystem;
• Netfilter;
• io_uring subsystem;
• Core kernel;
• Extra boot config (XBC);
• Memory management;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• eXpress Data Path;
• SELinux security module; (CVE-2024-35976, CVE-2024-35873, CVE-2024-35959, CVE-2024-27012, CVE-2024-36025, CVE-2024-35868, CVE-2024-26995, CVE-2024-35916, CVE-2024-36023, CVE-2024-35964, CVE-2024-35890, CVE-2024-26980, CVE-2024-35950, CVE-2024-27006, CVE-2024-35955, CVE-2024-35885, CVE-2024-35960, CVE-2024-35932, CVE-2024-26986, CVE-2024-35884, CVE-2024-35860, CVE-2024-36020, CVE-2024-35930, CVE-2024-35919, CVE-2024-27020, CVE-2024-26928, CVE-2024-35903, CVE-2024-35907, CVE-2024-35904, CVE-2024-35972, CVE-2024-35892, CVE-2024-26921, CVE-2024-35869, CVE-2024-35957, CVE-2024-35967, CVE-2024-35927, CVE-2024-35946, CVE-2024-27000, CVE-2024-35943, CVE-2024-35902, CVE-2024-27013, CVE-2024-35968, CVE-2024-35970, CVE-2024-35865, CVE-2024-36022, CVE-2024-26993, CVE-2024-36027, CVE-2024-35895, CVE-2024-35908, CVE-2024-35901, CVE-2024-35872, CVE-2024-26925, CVE-2024-35917, CVE-2024-35898, CVE-2024-35861, CVE-2024-35900, CVE-2024-26984, CVE-2024-35891, CVE-2023-52699, CVE-2024-35961, CVE-2024-35951, CVE-2024-36019, CVE-2024-27021, CVE-2024-35939, CVE-2024-26997, CVE-2024-26999, CVE-2024-35897, CVE-2024-35896, CVE-2024-26817, CVE-2024-35875, CVE-2024-35935, CVE-2024-27015, CVE-2024-26982, CVE-2024-35958, CVE-2024-26989, CVE-2024-26922, CVE-2024-26811, CVE-2024-27003, CVE-2024-35920, CVE-2024-27007, CVE-2024-35879, CVE-2024-35979, CVE-2024-35978, CVE-2024-35914, CVE-2024-35938, CVE-2024-35913, CVE-2024-26985, CVE-2024-35915, CVE-2024-35974, CVE-2024-27001, CVE-2024-35940, CVE-2024-35867, CVE-2024-26994, CVE-2024-35886, CVE-2024-35899, CVE-2024-27022, CVE-2024-35910, CVE-2024-35893, CVE-2024-27010, CVE-2024-36024, CVE-2024-26926, CVE-2024-26923, CVE-2024-26990, CVE-2024-35912, CVE-2024-26987, CVE-2024-35966, CVE-2024-35977, CVE-2024-35866, CVE-2024-35975, CVE-2024-35965, CVE-2024-35933, CVE-2024-26936, CVE-2024-35889, CVE-2024-35863, CVE-2024-27002, CVE-2024-27018, CVE-2024-36021, CVE-2024-27019, CVE-2024-35921, CVE-2024-35870,…

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Accessibility subsystem;
• Android drivers;
• Drivers core;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• Buffer Sharing and Synchronization framework;
• GPU drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• Device tree and open firmware driver;
• Chrome hardware platform drivers;
• i.MX PM domains;
• TI SCI PM domains driver;
• S/390 drivers;
• SCSI drivers;
• SPI subsystem;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• Framebuffer layer;
• BTRFS file system;
• Network file system server daemon;
• NILFS2 file system;
• File systems infrastructure;
• Pstore file system;
• SMB network file system;
• BPF subsystem;
• Bluetooth subsystem;
• Netfilter;
• io_uring subsystem;
• Core kernel;
• Extra boot config (XBC);
• Memory management;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• eXpress Data Path;
• SELinux security module; (CVE-2024-35955, CVE-2024-35921, CVE-2024-35946, CVE-2024-35934, CVE-2024-26993, CVE-2024-35899, CVE-2024-35952, CVE-2024-35894, CVE-2024-35886, CVE-2024-35872, CVE-2024-35970, CVE-2024-35936, CVE-2024-35907, CVE-2024-27013, CVE-2024-35910, CVE-2024-27009, CVE-2024-35875, CVE-2024-36021, CVE-2024-26923, CVE-2024-26997, CVE-2024-35978, CVE-2024-35981, CVE-2024-27015, CVE-2024-26928, CVE-2024-35963, CVE-2024-35897, CVE-2024-27020, CVE-2024-35922, CVE-2024-27001, CVE-2024-27011, CVE-2024-35940, CVE-2024-35871, CVE-2024-35900, CVE-2024-35869, CVE-2024-35905, CVE-2024-35974, CVE-2024-35873, CVE-2024-35882, CVE-2024-35914, CVE-2024-35956, CVE-2024-35887, CVE-2024-35920, CVE-2024-27018, CVE-2024-35880, CVE-2024-35943, CVE-2024-35912, CVE-2024-35979, CVE-2024-35862, CVE-2024-36019, CVE-2024-35950, CVE-2024-35977, CVE-2024-35918, CVE-2024-26992, CVE-2024-35884, CVE-2024-35916, CVE-2024-26817, CVE-2024-35959, CVE-2024-35909, CVE-2024-35933, CVE-2024-35982, CVE-2024-26996, CVE-2024-35980, CVE-2024-36018, CVE-2024-26925, CVE-2024-35929, CVE-2024-35971, CVE-2024-26990, CVE-2024-35885, CVE-2024-36025, CVE-2024-26998, CVE-2024-35930, CVE-2024-26982, CVE-2024-36022, CVE-2024-35895, CVE-2024-35902, CVE-2024-35911, CVE-2024-27002, CVE-2024-35968, CVE-2024-35861, CVE-2024-35903, CVE-2024-36026, CVE-2024-35896, CVE-2024-35945, CVE-2024-26936, CVE-2024-35954, CVE-2024-26985, CVE-2024-35908, CVE-2024-35924, CVE-2024-35938, CVE-2024-26991, CVE-2024-27017, CVE-2024-26922, CVE-2024-35919, CVE-2024-35915, CVE-2024-35985, CVE-2024-26995, CVE-2024-35870, CVE-2024-27010, CVE-2024-35904, CVE-2024-26999, CVE-2024-26983, CVE-2024-35939, CVE-2024-35865, CVE-2024-35860, CVE-2024-35944, CVE-2024-27021, CVE-2024-27016, CVE-2024-27004, CVE-2024-27019, CVE-2024-36027, CVE-2024-35890, CVE-2024-35975, CVE-2024-35901, CVE-2024-35967, CVE-2024-26986, CVE-2024-35957, CVE-2024-35937, CVE-2024-26988, CVE-2024-35972, CVE-2024-35926, CVE-2024-26926,…

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service.

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Accessibility subsystem;
• Android drivers;
• Drivers core;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• Buffer Sharing and Synchronization framework;
• GPU drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• Device tree and open firmware driver;
• Chrome hardware platform drivers;
• i.MX PM domains;
• TI SCI PM domains driver;
• S/390 drivers;
• SCSI drivers;
• SPI subsystem;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• Framebuffer layer;
• BTRFS file system;
• Network file system server daemon;
• NILFS2 file system;
• File systems infrastructure;
• Pstore file system;
• SMB network file system;
• BPF subsystem;
• Bluetooth subsystem;
• Netfilter;
• io_uring subsystem;
• Core kernel;
• Extra boot config (XBC);
• Memory management;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• eXpress Data Path;
• SELinux security module; (CVE-2024-26988, CVE-2024-36023, CVE-2024-35869, CVE-2024-35938, CVE-2024-27000, CVE-2024-35880, CVE-2024-35915, CVE-2024-35959, CVE-2024-35883, CVE-2024-35886, CVE-2024-35976, CVE-2024-35903, CVE-2024-35980, CVE-2024-27020, CVE-2024-35955, CVE-2024-35964, CVE-2024-26980, CVE-2024-35882, CVE-2024-35927, CVE-2024-35884, CVE-2024-35914, CVE-2024-35905, CVE-2024-26925, CVE-2024-35885, CVE-2024-26990, CVE-2024-27012, CVE-2024-35969, CVE-2024-35862, CVE-2024-35956, CVE-2024-35971, CVE-2024-27022, CVE-2024-35935, CVE-2024-26992, CVE-2024-27010, CVE-2024-35892, CVE-2024-26999, CVE-2024-26989, CVE-2024-35963, CVE-2024-35981, CVE-2024-26997, CVE-2024-35920, CVE-2024-35918, CVE-2024-35933, CVE-2024-35867, CVE-2024-35904, CVE-2024-35890, CVE-2024-35968, CVE-2024-35917, CVE-2024-35897, CVE-2024-26922, CVE-2024-36026, CVE-2024-27013, CVE-2024-26991, CVE-2024-26996, CVE-2024-35873, CVE-2024-26987, CVE-2024-35895, CVE-2024-36027, CVE-2024-35896, CVE-2024-35894, CVE-2024-26983, CVE-2024-35966, CVE-2024-35967, CVE-2024-35945, CVE-2024-27003, CVE-2024-35939, CVE-2024-35861, CVE-2024-26985, CVE-2024-27015, CVE-2024-35982, CVE-2024-35912, CVE-2024-35979, CVE-2024-35879, CVE-2024-26982, CVE-2024-35891, CVE-2024-35925, CVE-2024-35870, CVE-2024-27021, CVE-2024-35866, CVE-2024-27014, CVE-2024-27001, CVE-2024-27004, CVE-2024-35953, CVE-2024-36021, CVE-2024-35931, CVE-2024-27007, CVE-2024-35922, CVE-2024-35872, CVE-2024-35926, CVE-2024-27016, CVE-2024-26984, CVE-2024-35919, CVE-2024-35911, CVE-2024-26923, CVE-2024-35929, CVE-2024-35887, CVE-2024-35893, CVE-2024-35898, CVE-2024-35930, CVE-2024-35934, CVE-2024-35916, CVE-2024-35877, CVE-2024-26926, CVE-2024-35974, CVE-2024-36018, CVE-2024-27002, CVE-2024-35975, CVE-2024-35864, CVE-2024-35958, CVE-2024-35944, CVE-2024-35985, CVE-2024-35940, CVE-2024-35900, CVE-2024-27018, CVE-2024-26936, CVE-2024-36024, CVE-2024-26998, CVE-2024-35954, CVE-2024-35878, CVE-2024-26928, CVE-2024-35952, CVE-2024-36020, CVE-2024-26986, CVE-2024-35950,…