CVE-2024-35949

btrfs: make sure that WRITTEN is set on all metadata blocks

7.8 HighFix available

CVE-2024-35949 is a high vulnerability (CVSS 7.8) in Linux, published May 20, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in linux-lts 6.12.41-r0.

In the Linux kernel, the following vulnerability has been resolved:

btrfs: make sure that WRITTEN is set on all metadata blocks

We previously would call btrfs_check_leaf() if we had the check integrity code enabled, which meant that we could only run the extended leaf checks if we had WRITTEN set on the header flags.

This leaves a gap in our checking, because we could end up with corruption on disk where WRITTEN isn't set on the leaf, and then the extended leaf checks don't get run which we rely on to validate all of the item pointers to make sure we don't access memory outside of the extent buffer.

However, since 732fab95abe2 ("btrfs: check-integrity: remove CONFIG_BTRFS_FS_CHECK_INTEGRITY option") we no longer call btrfs_check_leaf() from btrfs_mark_buffer_dirty(), which means we only ever call it on blocks that are being written out, and thus have WRITTEN set, or that are being read in, which should have WRITTEN set.

Add checks to make sure we have WRITTEN set appropriately, and then make sure __btrfs_check_leaf() always does the item checking. This will protect us from file systems that have been corrupted and no longer have WRITTEN set on some of the blocks.

This was hit on a crafted image tweaking the WRITTEN bit and reported by KASAN as out-of-bound access in the eb accessors. The example is a dir item at the end of an eb.

[2.042] BTRFS warning (device loop1): bad eb member start: ptr 0x3fff start 30572544 member offset 16410 size 2 [2.040] general protection fault, probably for non-canonical address 0xe0009d1000000003: 0000 [#1] PREEMPT SMP KASAN NOPTI [2.537] KASAN: maybe wild-memory-access in range [0x0005088000000018-0x000508800000001f] [2.729] CPU: 0 PID: 2587 Comm: mount Not tainted 6.8.2 #1 [2.729] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [2.621] RIP: 0010:btrfs_get_16+0x34b/0x6d0 [2.621] RSP: 0018:ffff88810871fab8 EFLAGS: 00000206 [2.621] RAX: 0000a11000000003 RBX: ffff888104ff8720 RCX: ffff88811b2288c0 [2.621] RDX: dffffc0000000000 RSI: ffffffff81dd8aca RDI: ffff88810871f748 [2.621] RBP: 000000000000401a R08: 0000000000000001 R09: ffffed10210e3ee9 [2.621] R10: ffff88810871f74f R11: 205d323430333737 R12: 000000000000001a [2.621] R13: 000508800000001a R14: 1ffff110210e3f5d R15: ffffffff850011e8 [2.621] FS: 00007f56ea275840(0000) GS:ffff88811b200000(0000) knlGS:0000000000000000 [2.621] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [2.621] CR2: 00007febd13b75c0 CR3: 000000010bb50000 CR4: 00000000000006f0 [2.621] Call Trace: [2.621] <TASK> [2.621] ? show_regs+0x74/0x80 [2.621] ? die_addr+0x46/0xc0 [2.621] ? exc_general_protection+0x161/0x2a0 [2.621] ? asm_exc_general_protection+0x26/0x30 [2.621] ? btrfs_get_16+0x33a/0x6d0 [2.621] ? btrfs_get_16+0x34b/0x6d0 [2.621] ? btrfs_get_16+0x33a/0x6d0 [2.621] ? __pfx_btrfs_get_16+0x10/0x10 [2.621] ? __pfx_mutex_unlock+0x10/0x10 [2.621] btrfs_match_dir_item_name+0x101/0x1a0 [2.621] btrfs_lookup_dir_item+0x1f3/0x280 [2.621] ? __pfx_btrfs_lookup_dir_item+0x10/0x10 [2.621] btrfs_get_tree+0xd25/0x1910

[ copy more details from report ]

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.24%Up 0.2 points since May 21, 2024

What each source reports

CVE List Score used 7.8

btrfs: make sure that WRITTEN is set on all metadata blocks

In the Linux kernel, the following vulnerability has been resolved:

btrfs: make sure that WRITTEN is set on all metadata blocks

We previously would call btrfs_check_leaf() if we had the check integrity code enabled, which meant that we could only run the extended leaf checks if we had WRITTEN set on the header flags.

This was hit on a crafted image tweaking the WRITTEN bit and reported by KASAN as out-of-bound access in the eb accessors. The example is a dir item at the end of an eb.

[ copy more details from report ]

Record: CVE-2024-35949
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2024-35667 7.8

In the Linux kernel, the following vulnerability has been resolved:

btrfs: make sure that WRITTEN is set on all metadata blocks

We previously would call btrfs_check_leaf() if we had the check integrity code enabled, which meant that we could only run the extended leaf checks if we had WRITTEN set on the header flags.

This was hit on a crafted image tweaking the WRITTEN bit and reported by KASAN as out-of-bound access in the eb accessors. The example is a dir item at the end of an eb.

[ copy more details from report ]

Record: EUVD-2024-35667
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-3cw9-m9j6-m7jf 7.8

In the Linux kernel, the following vulnerability has been resolved: btrfs: make sure that...

In the Linux kernel, the following vulnerability has been resolved:

btrfs: make sure that WRITTEN is set on all metadata blocks

We previously would call btrfs_check_leaf() if we had the check integrity code enabled, which meant that we could only run the extended leaf checks if we had WRITTEN set on the header flags.

This was hit on a crafted image tweaking the WRITTEN bit and reported by KASAN as out-of-bound access in the eb accessors. The example is a dir item at the end of an eb.

[ copy more details from report ]

Record: GHSA-3cw9-m9j6-m7jf
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

btrfs: make sure that WRITTEN is set on all metadata blocks

We previously would call btrfs_check_leaf() if we had the check integrity code enabled, which meant that we could only run the extended leaf checks if we had WRITTEN set on the header flags.

This was hit on a crafted image tweaking the WRITTEN bit and reported by KASAN as out-of-bound access in the eb accessors. The example is a dir item at the end of an eb.

[ copy more details from report ]

Record: CVE-2024-35949
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSVBELL-CVE-2024-35949 7.8

Record: BELL-CVE-2024-35949
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.8

btrfs: make sure that WRITTEN is set on all metadata blocks

In the Linux kernel, the following vulnerability has been resolved:

btrfs: make sure that WRITTEN is set on all metadata blocks

We previously would call btrfs_check_leaf() if we had the check integrity code enabled, which meant that we could only run the extended leaf checks if we had WRITTEN set on the header flags.

This was hit on a crafted image tweaking the WRITTEN bit and reported by KASAN as out-of-bound access in the eb accessors. The example is a dir item at the end of an eb.

[ copy more details from report ]

Record: CVE-2024-35949
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 48 moreShow less

OSVDEBIAN-CVE-2024-35949 7.8

In the Linux kernel, the following vulnerability has been resolved: btrfs: make sure that WRITTEN is set on all metadata blocks We previously would call btrfs_check_leaf() if we had the check integrity code enabled, which meant that we could only run the extended leaf checks if we had WRITTEN set on the header flags. This leaves a gap in our checking, because we could end up with corruption on disk where WRITTEN isn't set on the leaf, and then the extended leaf checks don't get run which we rely on to validate all of the item pointers to make sure we don't access memory outside of the extent buffer. However, since 732fab95abe2 ("btrfs: check-integrity: remove CONFIG_BTRFS_FS_CHECK_INTEGRITY option") we no longer call btrfs_check_leaf() from btrfs_mark_buffer_dirty(), which means we only ever call it on blocks that are being written out, and thus have WRITTEN set, or that are being read in, which should have WRITTEN set. Add checks to make sure we have WRITTEN set appropriately, and then make sure __btrfs_check_leaf() always does the item checking. This will protect us from file systems that have been corrupted and no longer have WRITTEN set on some of the blocks. This was hit on a crafted image tweaking the WRITTEN bit and reported by KASAN as out-of-bound access in the eb accessors. The example is a dir item at the end of an eb. [2.042] BTRFS warning (device loop1): bad eb member start: ptr 0x3fff start 30572544 member offset 16410 size 2 [2.040] general protection fault, probably for non-canonical address 0xe0009d1000000003: 0000 [#1] PREEMPT SMP KASAN NOPTI [2.537] KASAN: maybe wild-memory-access in range [0x0005088000000018-0x000508800000001f] [2.729] CPU: 0 PID: 2587 Comm: mount Not tainted 6.8.2 #1 [2.729] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [2.621] RIP: 0010:btrfs_get_16+0x34b/0x6d0 [2.621] RSP: 0018:ffff88810871fab8 EFLAGS: 00000206 [2.621] RAX: 0000a11000000003 RBX: ffff888104ff8720 RCX: ffff88811b2288c0 [2.621] RDX: dffffc0000000000 RSI: ffffffff81dd8aca RDI: ffff88810871f748 [2.621] RBP: 000000000000401a R08: 0000000000000001 R09: ffffed10210e3ee9 [2.621] R10: ffff88810871f74f R11: 205d323430333737 R12: 000000000000001a [2.621] R13: 000508800000001a R14: 1ffff110210e3f5d R15: ffffffff850011e8 [2.621] FS: 00007f56ea275840(0000) GS:ffff88811b200000(0000) knlGS:0000000000000000 [2.621] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [2.621] CR2: 00007febd13b75c0 CR3: 000000010bb50000 CR4: 00000000000006f0 [2.621] Call Trace: [2.621] <TASK> [2.621] ? show_regs+0x74/0x80 [2.621] ? die_addr+0x46/0xc0 [2.621] ? exc_general_protection+0x161/0x2a0 [2.621] ? asm_exc_general_protection+0x26/0x30 [2.621] ? btrfs_get_16+0x33a/0x6d0 [2.621] ? btrfs_get_16+0x34b/0x6d0 [2.621] ? btrfs_get_16+0x33a/0x6d0 [2.621] ? __pfx_btrfs_get_16+0x10/0x10 [2.621] ? __pfx_mutex_unlock+0x10/0x10 [2.621] btrfs_match_dir_item_name+0x101/0x1a0 [2.621] btrfs_lookup_dir_item+0x1f3/0x280 [2.621] ? __pfx_btrfs_lookup_dir_item+0x10/0x10 [2.621] btrfs_get_tree+0xd25/0x1910 [ copy more details from report ]

Record: DEBIAN-CVE-2024-35949
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2024-2325 9.1

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() The debugfs_create_dir() function returns error pointers. It never returns NULL. So use IS_ERR() to check it.(CVE-2023-52917)

In the Linux kernel, the following vulnerability has been resolved: media: pci: cx23885: check cx23885_vdev_init() return cx23885_vdev_init() can return a NULL pointer, but that pointer is used in the next line without a check. Add a NULL pointer check and go to the error unwind if it is NULL.(CVE-2023-52918)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: make sure that WRITTEN is set on all metadata blocks

We previously would call btrfs_check_leaf() if we had the check integrity code enabled, which meant that we could only run the extended leaf checks if we had WRITTEN set on the header flags.

This was hit on a crafted image tweaking the WRITTEN bit and reported by KASAN as out-of-bound access in the eb accessors. The example is a dir item at the end of an eb.

copy more details from report

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Fix not validating…

Record: OESA-2024-2325
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-35949 7.1

Record: UBUNTU-CVE-2024-35949
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVAZL-73004 No score

CVE-2024-35949 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved:

btrfs: make sure that WRITTEN is set on all metadata blocks

We previously would call btrfs_check_leaf() if we had the check integrity code enabled, which meant that we could only run the extended leaf checks if we had WRITTEN set on the header flags.

This was hit on a crafted image tweaking the WRITTEN bit and reported by KASAN as out-of-bound access in the eb accessors. The example is a dir item at the end of an eb.

[ copy more details from report ]

Record: AZL-73004
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-11-CVE-2024-35949 No score

CVE-2024-35949 in linux - Patched by Root

Root has patched CVE-2024-35949 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2024-35949
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2024-35949 No score

CVE-2024-35949 in linux - Patched by Root

Root has patched CVE-2024-35949 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2024-35949
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2024-35949 No score

CVE-2024-35949 in linux - Patched by Root

Root has patched CVE-2024-35949 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2024-35949
Updated: 2026-11-02

OSVSUSE-SU-2024:2892-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
CVE-2024-42096: x86: stop playing stack games in profile_pc() (bsc#1228633).
CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).
CVE-2021-47619: i40e: Fix queues reservation for XDP (bsc#1226645).
CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743).
CVE-2024-42124: scsi: qedf: Make qedf_execute_tmf() non-preemptible (bsc#1228705).
CVE-2024-42223: media: dvb-frontends: tda10048: Fix integer overflow (bsc#1228726)
CVE-2024-42119: drm/amd/display: Skip finding free audio for unknown engine_id (bsc#1228584)
CVE-2024-42120: drm/amd/display: Check pipe offset before setting vblank (bsc#1228588)
CVE-2024-41095: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes (bsc#1228662)
CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list (bsc#1228723).
CVE-2024-41072: wifi: cfg80211: wext: add extra SIOCSIWSCAN data check (bsc#1228626).
CVE-2024-41048: skmsg: Skip zero length skb in sk_msg_recvmsg (bsc#1228565).
CVE-2024-40995: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830).
CVE-2024-41044: ppp: reject claimed-as-LCP but actually malformed packets (bsc#1228530).
CVE-2024-41066: ibmvnic: add tx check to prevent skb leak (bsc#1228640).
CVE-2024-42093: net/dpaa2: Avoid explicit cpumask var allocation on stack (bsc#1228680).
CVE-2024-41089: drm/nouveau/dispnv04: fix null pointer dereference in (bsc#1228658)
CVE-2024-41060: drm/radeon: check bo_va->bo is non-NULL before using it (bsc#1228567)
CVE-2022-48829: NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes (bsc#1228055).
CVE-2022-48828: NFSD: Fix ia_size underflow (bsc#1228054).
CVE-2022-48827: NFSD: Fix the behavior of READ near OFFSET_MAX (bsc#1228037).
CVE-2024-41078: btrfs: qgroup: fix quota root leak after quota disable failure (bsc#1228655).
CVE-2024-41071: wifi: mac80211: Avoid address calculations via out of bounds array indexing (bsc#1228625).
CVE-2024-41064: powerpc/eeh: avoid possible crash when edev->pdev changes (bsc#1228599).
CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
CVE-2024-41081: ila: block BH in ila_output() (bsc#1228617).
CVE-2024-40978: scsi: qedi: Fix crash while reading debugfs attribute (bsc#1227929).
CVE-2022-48792: scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task (bsc#1228013).
CVE-2022-48823: scsi: qedf: Fix refcount issue when LOGO is received during TMF (bsc#1228045).
CVE-2024-41076: NFSv4: Fix memory leak in nfs4_set_security_label (bsc#1228649).
CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
CVE-2024-40987: drm/amdgpu: fix UBSAN warning in kv_dpm.c (bsc#1228235)
CVE-2022-48826: drm/vc4: Fix deadlock on DSI device attach error (bsc#1227975)
CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
CVE-2024-41015: ocfs2: add bounds checking to ocfs2_check_dir_entry() (bsc#1228409).
CVE-2024-41016: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() (bsc#1228410).
CVE-2024-41063: bluetooth: hci_core: cancel all works upon hci_unregister_dev() (bsc#1228580).
CVE-2024-42070: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (bsc#1228470).
CVE-2024-41070: KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() (bsc#1228581).
CVE-2021-47405: HID: usbhid: free raw_report buffers in usbhid_stop (bsc#1225238).
CVE-2024-40988: drm/radeon: fix UBSAN warning in kv_dpm.c (bsc#1227957)
CVE-2024-40932: drm/exynos/vidi: fix memory leak in .get_modes()…

Record: SUSE-SU-2024:2892-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2894-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
CVE-2021-47186: tipc: check for null after calling kmemdup (bsc#1222702).
CVE-2021-47546: Kabi fix for ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571)
CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len (bsc#1226555).
CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071)
CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869)
CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
CVE-2023-52812: drm/amd: check num of link levels when update pcie param (bsc#1225564).
CVE-2023-52857: drm/mediatek: Fix coverity issue with unintentional integer overflow (bsc#1225581).
CVE-2023-52863: hwmon: (axi-fan-control) Fix possible NULL pointer dereference (bsc#1225586).
CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
CVE-2024-26633: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (bsc#1221647).
CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2 (bsc#1221656).
CVE-2024-26636: llc: make llc_ui_sendmsg() more robust against bonding changes (bsc#1221659).
CVE-2024-26641: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() (bsc#1221654).
CVE-2024-26661: drm/amd/display: Add NULL test for 'timing generator' in (bsc#1222323)
CVE-2024-26663: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (bsc#1222326).
CVE-2024-26665: tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328).
CVE-2024-26802: stmmac: Clear variable when destroying workqueue (bsc#1222799).
CVE-2024-26863: hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021).
CVE-2024-26961: mac802154: fix llsec key resources release in mac802154_llsec_key_del (bsc#1223652).
CVE-2024-27015: netfilter: flowtable: incorrect pppoe tuple (bsc#1223806).
CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
CVE-2024-27025: nbd: null check for nla_nest_start (bsc#1223778)
CVE-2024-27065: netfilter: nf_tables: do not compare internal table flags on updates (bsc#1223836).
CVE-2024-27402: phonet/pep: fix racy skb_queue_empty() use (bsc#1224414).
CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ…

Record: SUSE-SU-2024:2894-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2901-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
CVE-2024-42096: x86: stop playing stack games in profile_pc() (bsc#1228633).
CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).
CVE-2021-47619: i40e: Fix queues reservation for XDP (bsc#1226645).
CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743).
CVE-2024-42124: scsi: qedf: Make qedf_execute_tmf() non-preemptible (bsc#1228705).
CVE-2024-42223: media: dvb-frontends: tda10048: Fix integer overflow (bsc#1228726).
CVE-2024-42119: drm/amd/display: Skip finding free audio for unknown engine_id (bsc#1228584).
CVE-2024-42120: drm/amd/display: Check pipe offset before setting vblank (bsc#1228588).
CVE-2024-41095: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes (bsc#1228662).
CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list (bsc#1228723).
CVE-2024-41072: wifi: cfg80211: wext: add extra SIOCSIWSCAN data check (bsc#1228626).
CVE-2024-41048: skmsg: Skip zero length skb in sk_msg_recvmsg (bsc#1228565).
CVE-2024-40995: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830).
CVE-2024-41044: ppp: reject claimed-as-LCP but actually malformed packets (bsc#1228530).
CVE-2024-41066: ibmvnic: add tx check to prevent skb leak (bsc#1228640).
CVE-2024-42093: net/dpaa2: Avoid explicit cpumask var allocation on stack (bsc#1228680).
CVE-2024-41089: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes (bsc#1228658).
CVE-2024-41060: drm/radeon: check bo_va->bo is non-NULL before using it (bsc#1228567).
CVE-2022-48829: NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes (bsc#1228055).
CVE-2022-48828: NFSD: Fix ia_size underflow (bsc#1228054).
CVE-2022-48827: NFSD: Fix the behavior of READ near OFFSET_MAX (bsc#1228037).
CVE-2024-41078: btrfs: qgroup: fix quota root leak after quota disable failure (bsc#1228655).
CVE-2024-41071: wifi: mac80211: Avoid address calculations via out of bounds array indexing (bsc#1228625).
CVE-2024-41064: powerpc/eeh: avoid possible crash when edev->pdev changes (bsc#1228599).
CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
CVE-2024-41081: ila: block BH in ila_output() (bsc#1228617).
CVE-2024-40978: scsi: qedi: Fix crash while reading debugfs attribute (bsc#1227929).
CVE-2022-48792: scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task (bsc#1228013).
CVE-2022-48823: scsi: qedf: Fix refcount issue when LOGO is received during TMF (bsc#1228045).
CVE-2024-41076: NFSv4: Fix memory leak in nfs4_set_security_label (bsc#1228649).
CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
CVE-2024-40987: drm/amdgpu: fix UBSAN warning in kv_dpm.c (bsc#1228235).
CVE-2022-48826: drm/vc4: Fix deadlock on DSI device attach error (bsc#1227975)
CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
CVE-2024-41015: ocfs2: add bounds checking to ocfs2_check_dir_entry() (bsc#1228409).
CVE-2024-41016: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() (bsc#1228410).
CVE-2024-41063: bluetooth: hci_core: cancel all works upon hci_unregister_dev() (bsc#1228580).
CVE-2024-42070: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (bsc#1228470).
CVE-2024-41070: KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() (bsc#1228581).
CVE-2021-47405: HID: usbhid: free raw_report buffers in usbhid_stop (bsc#1225238).
CVE-2024-40988: drm/radeon: fix UBSAN warning in kv_dpm.c (bsc#1227957).
CVE-2024-40932: drm/exynos/vidi:…

Record: SUSE-SU-2024:2901-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2939-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958).
CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
CVE-2021-47186: tipc: check for null after calling kmemdup (bsc#1222702).
CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
CVE-2021-47546: ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571).
CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len. (bsc#1226555).
CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071).
CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869).
CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
CVE-2023-52787: blk-mq: make…

Record: SUSE-SU-2024:2939-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2940-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
CVE-2024-42096: x86: stop playing stack games in profile_pc() (bsc#1228633).
CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).
CVE-2021-47619: i40e: Fix queues reservation for XDP (bsc#1226645).
CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743).
CVE-2024-42124: scsi: qedf: Make qedf_execute_tmf() non-preemptible (bsc#1228705).
CVE-2024-42223: media: dvb-frontends: tda10048: Fix integer overflow (bsc#1228726)
CVE-2024-42119: drm/amd/display: Skip finding free audio for unknown engine_id (bsc#1228584)
CVE-2024-42120: drm/amd/display: Check pipe offset before setting vblank (bsc#1228588)
CVE-2024-41095: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes (bsc#1228662)
CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list (bsc#1228723).
CVE-2024-41072: wifi: cfg80211: wext: add extra SIOCSIWSCAN data check (bsc#1228626).
CVE-2024-41048: skmsg: Skip zero length skb in sk_msg_recvmsg (bsc#1228565).
CVE-2024-40995: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830).
CVE-2024-41044: ppp: reject claimed-as-LCP but actually malformed packets (bsc#1228530).
CVE-2024-41066: ibmvnic: add tx check to prevent skb leak (bsc#1228640).
CVE-2024-42093: net/dpaa2: Avoid explicit cpumask var allocation on stack (bsc#1228680).
CVE-2024-41089: drm/nouveau/dispnv04: fix null pointer dereference in (bsc#1228658)
CVE-2024-41060: drm/radeon: check bo_va->bo is non-NULL before using it (bsc#1228567)
CVE-2022-48829: NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes (bsc#1228055).
CVE-2022-48828: NFSD: Fix ia_size underflow (bsc#1228054).
CVE-2022-48827: NFSD: Fix the behavior of READ near OFFSET_MAX (bsc#1228037).
CVE-2024-41078: btrfs: qgroup: fix quota root leak after quota disable failure (bsc#1228655).
CVE-2024-41071: wifi: mac80211: Avoid address calculations via out of bounds array indexing (bsc#1228625).
CVE-2024-41064: powerpc/eeh: avoid possible crash when edev->pdev changes (bsc#1228599).
CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
CVE-2024-41081: ila: block BH in ila_output() (bsc#1228617).
CVE-2024-40978: scsi: qedi: Fix crash while reading debugfs attribute (bsc#1227929).
CVE-2022-48792: scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task (bsc#1228013).
CVE-2022-48823: scsi: qedf: Fix refcount issue when LOGO is received during TMF (bsc#1228045).
CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
CVE-2024-40987: drm/amdgpu: fix UBSAN warning in kv_dpm.c (bsc#1228235)
CVE-2022-48826: drm/vc4: Fix deadlock on DSI device attach error (bsc#1227975)
CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
CVE-2024-41015: ocfs2: add bounds checking to ocfs2_check_dir_entry() (bsc#1228409).
CVE-2024-41016: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() (bsc#1228410).
CVE-2024-41063: bluetooth: hci_core: cancel all works upon hci_unregister_dev() (bsc#1228580).
CVE-2024-42070: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (bsc#1228470).
CVE-2024-41070: KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() (bsc#1228581).
CVE-2021-47405: HID: usbhid: free raw_report buffers in usbhid_stop (bsc#1225238).
CVE-2024-40988: drm/radeon: fix UBSAN warning in kv_dpm.c (bsc#1227957)
CVE-2024-40932: drm/exynos/vidi: fix memory leak in .get_modes() (bsc#1227828)
CVE-2021-47403: ipack: ipoctal: fix module reference leak…

Record: SUSE-SU-2024:2940-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2947-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
CVE-2021-47186: ipc: check for null after calling kmemdup (bsc#1222702).
CVE-2021-47546: Kabi fix for ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571)
CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len (bsc#1226555).
CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071)
CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869)
CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
CVE-2023-52812: drm/amd: check num of link levels when update pcie param (bsc#1225564).
CVE-2023-52857: drm/mediatek: Fix coverity issue with unintentional integer overflow (bsc#1225581).
CVE-2023-52863: hwmon: (axi-fan-control) Fix possible NULL pointer dereference (bsc#1225586).
CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
CVE-2024-26633: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (bsc#1221647).
CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2 (bsc#1221656).
CVE-2024-26636: llc: make llc_ui_sendmsg() more robust against bonding changes (bsc#1221659).
CVE-2024-26641: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() (bsc#1221654).
CVE-2024-26661: drm/amd/display: Add NULL test for 'timing generator' in (bsc#1222323)
CVE-2024-26663: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (bsc#1222326).
CVE-2024-26665: tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328).
CVE-2024-26802: stmmac: Clear variable when destroying workqueue (bsc#1222799).
CVE-2024-26863: hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021).
CVE-2024-26961: mac802154: fix llsec key resources release in mac802154_llsec_key_del (bsc#1223652).
CVE-2024-27015: netfilter: flowtable: incorrect pppoe tuple (bsc#1223806).
CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
CVE-2024-27025: nbd: null check for nla_nest_start (bsc#1223778)
CVE-2024-27065: netfilter: nf_tables: do not compare internal table flags on updates (bsc#1223836).
CVE-2024-27402: phonet/pep: fix racy skb_queue_empty() use (bsc#1224414).
CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ…

Record: SUSE-SU-2024:2947-1
Updated: 2026-11-02

OSVSUSE-SU-2024:3194-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
CVE-2024-43911: Fix NULL dereference at band check in starting tx ba session (bsc#1229827).
CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
CVE-2024-36270: Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (bsc#1226798)
CVE-2024-36881: Reset ptes when close() for wr-protected ones (bsc#1225718).
CVE-2024-42316: Fix div-by-zero in vmpressure_calc_level() (bsc#1229353).
CVE-2024-43855: Fix deadlock between mddev_suspend and flush bio (bsc#1229342,).
CVE-2024-43864: Fix CT entry update leaks of modify header context (bsc#1229496)
CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
CVE-2024-42109: Unconditionally flush pending work before notifier (bsc#1228505)
CVE-2024-41084: Avoid null pointer dereference in region lookup (bsc#1228472)
CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
CVE-2024-27079: Add kABI workaround patch (bsc#1223742).
CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26809: Release elements in clone only from destroy path (bsc#1222633).
CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).
CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).
CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).
CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).
CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)
CVE-2024-27433: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
CVE-2024-40920: Fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
CVE-2024-40921: Pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
CVE-2024-36979: Fix vlan use-after-free (bsc#1226604).
CVE-2024-26590: Fix inconsistent per-file compression format (bsc#1220252,).
CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).
CVE-2024-42270: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404)
CVE-2024-42269: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402)
CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383) -…

Record: SUSE-SU-2024:3194-1
Updated: 2026-11-02

OSVSUSE-SU-2024:3195-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
CVE-2024-43911: Fix NULL dereference at band check in starting tx ba session (bsc#1229827).
CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
CVE-2024-36881: Fix reset ptes when close() for wr-protected (bsc#1225718).
CVE-2024-42316: Fix div-by-zero in vmpressure_calc_level() (bsc#1229353).
CVE-2024-43855: Fix deadlock between mddev_suspend and flush bio (bsc#1229342).
CVE-2024-43864: Fix CT entry update leaks of modify header context (bsc#1229496).
CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
CVE-2024-42109: Unconditionally flush pending work before notifier (bsc#1228505).
CVE-2024-41084: Avoid null pointer dereference in region lookup (bsc#1228472).
CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
CVE-2024-27079: Fix NULL domain on device release (bsc#1223742).
CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26809: Release elements in clone only from destroy path (bsc#1222633).
CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).
CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).
CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).
CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).
CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)
CVE-2024-27433: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
CVE-2024-40920: Fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
CVE-2024-40921: Pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
CVE-2024-36979: Fix vlan use-after-free (bsc#1226604).
CVE-2024-26590: Fix inconsistent per-file compression format (bsc#1220252).
CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).
CVE-2024-42270: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404).
CVE-2024-42269: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402).
CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383)
CVE-2024-42312: Always initialize i_uid/i_gid (bsc#1229357)
CVE-2024-43854: Initialize integrity buffer to zero…

Record: SUSE-SU-2024:3195-1
Updated: 2026-11-02

OSVSUSE-SU-2024:3383-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-43911: wifi: mac80211: fix NULL dereference at band check in starting tx ba session (bsc#1229827).
CVE-2024-43899: drm/amd/display: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
CVE-2024-43880: kabi: lib: objagg: Put back removed metod in struct objagg_ops (bsc#1229481).
CVE-2024-43866: net/mlx5: Always drain health in shutdown callback (bsc#1229495).
CVE-2024-43864: net/mlx5e: Fix CT entry update leaks of modify header context (bsc#1229496).
CVE-2024-43855: md: fix deadlock between mddev_suspend and flush bio (bsc#1229342).
CVE-2024-43854: block: initialize integrity buffer to zero before writing it to media (bsc#1229345)
CVE-2024-43850: soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove (bsc#1229316).
CVE-2024-43839: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).
CVE-2024-43837: bpf: Fix updating attached freplace prog in prog_array map (bsc#1229297).
CVE-2024-43834: xdp: fix invalid wait context of page_pool_destroy() (bsc#1229314)
CVE-2024-43831: media: mediatek: vcodec: Handle invalid decoder vsi (bsc#1229309).
CVE-2024-43821: scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315).
CVE-2024-42322: ipvs: properly dereference pe in ip_vs_add_service (bsc#1229347)
CVE-2024-42318: landlock: Do not lose track of restrictions on cred_transfer (bsc#1229351).
CVE-2024-42316: mm/mglru: fix div-by-zero in vmpressure_calc_level() (bsc#1229353).
CVE-2024-42312: sysctl: always initialize i_uid/i_gid (bsc#1229357)
CVE-2024-42308: Update DRM patch reference (bsc#1229411)
CVE-2024-42301: dev/parport: fix the array out-of-bounds risk (bsc#1229407).
CVE-2024-42295: nilfs2: handle inconsistent state in nilfs_btnode_create_block() (bsc#1229370).
CVE-2024-42291: ice: Add a per-VF limit on number of FDIR filters (bsc#1229374).
CVE-2024-42290: irqchip/imx-irqsteer: Handle runtime power management correctly (bsc#1229379).
CVE-2024-42284: tipc: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
CVE-2024-42283: net: nexthop: Initialize all fields in dumped nexthops (bsc#1229383)
CVE-2024-42281: bpf: Fix a segment issue when downgrading gso_size (bsc#1229386).
CVE-2024-42277: iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
CVE-2024-42270: netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404).
CVE-2024-42269: netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402).
CVE-2024-42268: net/mlx5: Fix missing lock on sync reset reload (bsc#1229391).
CVE-2024-42247: wireguard: allowedips: avoid unaligned 64-bit memory accesses (bsc#1228988).
CVE-2024-42246: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).
CVE-2024-42245: Revert 'sched/fair: Make sure to try to detach at least one movable task' (bsc#1228978).
CVE-2024-42241: mm/shmem: disable PMD-sized page cache if needed (bsc#1228986).
CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list (bsc#1228723).
CVE-2024-42162: gve: Account for stopped queues when reading NIC stats (bsc#1228706).
CVE-2024-42161: bpf: avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756).
CVE-2024-42159: scsi: mpi3mr: fix sanitise num_phys (bsc#1228754).
CVE-2024-42158: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
CVE-2024-42157: s390/pkey: Wipe sensitive data on failure (bsc#1228727).
CVE-2024-42156: s390/pkey: Wipe copies of clear-key structures on failure (bsc#1228722).
CVE-2024-42155: s390/pkey: Wipe copies of protected- and secure-keys (bsc#1228733).
CVE-2024-42148: bnx2x: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).
CVE-2024-42145:…

Record: SUSE-SU-2024:3383-1
Updated: 2026-11-02

OSVSUSE-SU-2024:4120-1 No score

Security update for the Linux Kernel RT (Live Patch 8 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-150500_13_27 fixes several issues.