CVE-2024-35960

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Properly link new fs rules into the tree Previously, add_rule_fg would only add newly created rules from the handle into the tree when they had a refcount of 1. On the other hand, create_flow_handle tries hard to find and reference already existing identical rules instead of creating new ones. These two behaviors can result in a situation where create_flow_handle 1) creates a new rule and references it, then 2) in a subsequent step during the same handle creation references it again, resulting in a rule with a refcount of 2 that is not linked into the tree, will have a NULL parent and root and will result in a crash when the flow group is deleted because del_sw_hw_rule, invoked on rule deletion, assumes node->parent is != NULL. This happened in the wild, due to another bug related to incorrect handling of duplicate pkt_reformat ids, which lead to the code in create_flow_handle incorrectly referencing a just-added rule in the same flow handle, resulting in the problem described above. Full details are at [1]. This patch changes add_rule_fg to add new rules without parents into the tree, properly initializing them and avoiding the crash. This makes it more consistent with how rules are added to an FTE in create_flow_handle.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: usb: fix possible use-after-free in smsc75xx_bind

The commit 46a8b29c6306 ("net: usb: fix memory leak in smsc75xx_bind") fails to clean up the work scheduled in smsc75xx_reset-> smsc75xx_set_multicast, which leads to use-after-free if the work is scheduled to start after the deallocation. In addition, this patch also removes a dangling pointer - dev->data[0].

This patch calls cancel_work_sync to cancel the scheduled work and set the dangling pointer to NULL.(CVE-2021-47239)

In the Linux kernel, the following vulnerability has been resolved:

RDMA: Verify port when creating flow rule

Validate port value provided by the user and with that remove no longer needed validation by the driver. The missing check in the mlx5_ib driver could cause to the below oops.

Call trace: _create_flow_rule+0x2d4/0xf28 [mlx5_ib] mlx5_ib_create_flow+0x2d0/0x5b0 [mlx5_ib] ib_uverbs_ex_create_flow+0x4cc/0x624 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xd4/0x150 [ib_uverbs] ib_uverbs_cmd_verbs.isra.7+0xb28/0xc50 [ib_uverbs] ib_uverbs_ioctl+0x158/0x1d0 [ib_uverbs] do_vfs_ioctl+0xd0/0xaf0 ksys_ioctl+0x84/0xb4 __arm64_sys_ioctl+0x28/0xc4 el0_svc_common.constprop.3+0xa4/0x254 el0_svc_handler+0x84/0xa0 el0_svc+0x10/0x26c Code: b9401260 f9615681 51000400 8b001c20 (f9403c1a)(CVE-2021-47265)

In the Linux kernel, the following vulnerability has been resolved:

bcache: avoid oversized read request in cache missing code path

In the cache missing code path of cached device, if a proper location from the internal B+ tree is matched for a cache miss range, function cached_dev_cache_miss() will be called in cache_lookup_fn() in the following code block, [code block 1] 526 unsigned int sectors = KEY_INODE(k) == s->iop.inode 527 ? min_t(uint64_t, INT_MAX, 528 KEY_START(k) - bio->bi_iter.bi_sector) 529 : INT_MAX; 530 int ret = s->d->cache_miss(b, s, bio, sectors);

Here s->d->cache_miss() is the call backfunction pointer initialized as cached_dev_cache_miss(), the last parameter 'sectors' is an important hint to calculate the size of read request to backing device of the missing cache data.

Current calculation in above code block may generate oversized value of 'sectors', which consequently may trigger 2 different potential kernel panics by BUG() or BUG_ON() as listed below,

1. BUG_ON() inside bch_btree_insert_key(), [code block 2] 886 BUG_ON(b->ops->is_extents && !KEY_SIZE(k));
2. BUG() inside biovec_slab(), [code block 3] 51 default: 52 BUG(); 53 return NULL;

All the above panics are original from cached_dev_cache_miss() by the oversized parameter 'sectors'.

Inside cached_dev_cache_miss(), parameter 'sectors' is used to calculate the size of data read from backing device for the cache missing. This size is stored in s->insert_bio_sectors by the following lines of code, [code block 4] 909 s->insert_bio_sectors = min(sectors, bio_sectors(bio) + reada);

Then the actual key inserting to the internal B+ tree is generated and stored in s->iop.replace_key by the following lines of code, [code block 5] 911 s->iop.replace_key = KEY(s->iop.inode, 912 bio->bi_iter.bi_sector + s->insert_bio_sectors, 913 s->insert_bio_sectors); The oversized parameter 'sectors' may trigger panic 1) by BUG_ON() from the above code block.

And the bio sending to backing device for the missing data is allocated with hint from s->insert_bio_sectors by the following lines of code, [code block 6] 926 cache_bio = bio_alloc_bioset(GFP_NOWAIT, 927 …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

mptcp: ensure tx skbs always have the MPTCP ext

Due to signed/unsigned comparison, the expression:

info->size_goal - skb->len > 0

evaluates to true when the size goal is smaller than the skb size. That results in lack of tx cache refill, so that the skb allocated by the core TCP code lacks the required MPTCP skb extensions.

Due to the above, syzbot is able to trigger the following WARN_ON():

WARNING: CPU: 1 PID: 810 at net/mptcp/protocol.c:1366 mptcp_sendmsg_frag+0x1362/0x1bc0 net/mptcp/protocol.c:1366 Modules linked in: CPU: 1 PID: 810 Comm: syz-executor.4 Not tainted 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:mptcp_sendmsg_frag+0x1362/0x1bc0 net/mptcp/protocol.c:1366 Code: ff 4c 8b 74 24 50 48 8b 5c 24 58 e9 0f fb ff ff e8 13 44 8b f8 4c 89 e7 45 31 ed e8 98 57 2e fe e9 81 f4 ff ff e8 fe 43 8b f8 <0f> 0b 41 bd ea ff ff ff e9 6f f4 ff ff 4c 89 e7 e8 b9 8e d2 f8 e9 RSP: 0018:ffffc9000531f6a0 EFLAGS: 00010216 RAX: 000000000000697f RBX: 0000000000000000 RCX: ffffc90012107000 RDX: 0000000000040000 RSI: ffffffff88eac9e2 RDI: 0000000000000003 RBP: ffff888078b15780 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff88eac017 R11: 0000000000000000 R12: ffff88801de0a280 R13: 0000000000006b58 R14: ffff888066278280 R15: ffff88803c2fe9c0 FS: 00007fd9f866e700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007faebcb2f718 CR3: 00000000267cb000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __mptcp_push_pending+0x1fb/0x6b0 net/mptcp/protocol.c:1547 mptcp_release_cb+0xfe/0x210 net/mptcp/protocol.c:3003 release_sock+0xb4/0x1b0 net/core/sock.c:3206 sk_stream_wait_memory+0x604/0xed0 net/core/stream.c:145 mptcp_sendmsg+0xc39/0x1bc0 net/mptcp/protocol.c:1749 inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:643 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 sock_write_iter+0x2a0/0x3e0 net/socket.c:1057 call_write_iter include/linux/fs.h:2163 [inline] new_sync_write+0x40b/0x640 fs/read_write.c:507 vfs_write+0x7cf/0xae0 fs/read_write.c:594 ksys_write+0x1ee/0x250 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4665f9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd9f866e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000056c038 RCX: 00000000004665f9 RDX: 00000000000e7b78 RSI: 0000000020000000 RDI: 0000000000000003 RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c038 R13: 0000000000a9fb1f R14: 00007fd9f866e300 R15: 0000000000022000

Fix the issue rewriting the relevant expression to avoid sign-related problems - note: size_goal is always >= 0.

Additionally, ensure that the skb in the tx cache always carries the relevant extension.(CVE-2021-47370)

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix even more out of bound writes from debugfs

CVE-2021-42327 was fixed by:

commit f23750b5b3d98653b31d4469592935ef6364ad67 Author: Thelford Williams <[email protected]> Date: Wed Oct 13 16:04:13 2021 -0400

drm/amdgpu: fix out of bounds write

but amdgpu_dm_debugfs.c contains more of the same issue so fix the remaining ones.

v2: * Add missing fix in dp_max_bpc_write (Harry…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

RDMA: Verify port when creating flow rule

Validate port value provided by the user and with that remove no longer needed validation by the driver. The missing check in the mlx5_ib driver could cause to the below oops.

Call trace: _create_flow_rule+0x2d4/0xf28 [mlx5_ib] mlx5_ib_create_flow+0x2d0/0x5b0 [mlx5_ib] ib_uverbs_ex_create_flow+0x4cc/0x624 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xd4/0x150 [ib_uverbs] ib_uverbs_cmd_verbs.isra.7+0xb28/0xc50 [ib_uverbs] ib_uverbs_ioctl+0x158/0x1d0 [ib_uverbs] do_vfs_ioctl+0xd0/0xaf0 ksys_ioctl+0x84/0xb4 __arm64_sys_ioctl+0x28/0xc4 el0_svc_common.constprop.3+0xa4/0x254 el0_svc_handler+0x84/0xa0 el0_svc+0x10/0x26c Code: b9401260 f9615681 51000400 8b001c20 (f9403c1a)(CVE-2021-47265)

In the Linux kernel, the following vulnerability has been resolved:

mISDN: fix possible use-after-free in HFC_cleanup()

This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself.(CVE-2021-47356)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: ensure tx skbs always have the MPTCP ext

Due to signed/unsigned comparison, the expression:

info->size_goal - skb->len > 0

evaluates to true when the size goal is smaller than the skb size. That results in lack of tx cache refill, so that the skb allocated by the core TCP code lacks the required MPTCP skb extensions.

Due to the above, syzbot is able to trigger the following WARN_ON():

WARNING: CPU: 1 PID: 810 at net/mptcp/protocol.c:1366 mptcp_sendmsg_frag+0x1362/0x1bc0 net/mptcp/protocol.c:1366 Modules linked in: CPU: 1 PID: 810 Comm: syz-executor.4 Not tainted 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:mptcp_sendmsg_frag+0x1362/0x1bc0 net/mptcp/protocol.c:1366 Code: ff 4c 8b 74 24 50 48 8b 5c 24 58 e9 0f fb ff ff e8 13 44 8b f8 4c 89 e7 45 31 ed e8 98 57 2e fe e9 81 f4 ff ff e8 fe 43 8b f8 <0f> 0b 41 bd ea ff ff ff e9 6f f4 ff ff 4c 89 e7 e8 b9 8e d2 f8 e9 RSP: 0018:ffffc9000531f6a0 EFLAGS: 00010216 RAX: 000000000000697f RBX: 0000000000000000 RCX: ffffc90012107000 RDX: 0000000000040000 RSI: ffffffff88eac9e2 RDI: 0000000000000003 RBP: ffff888078b15780 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff88eac017 R11: 0000000000000000 R12: ffff88801de0a280 R13: 0000000000006b58 R14: ffff888066278280 R15: ffff88803c2fe9c0 FS: 00007fd9f866e700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007faebcb2f718 CR3: 00000000267cb000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __mptcp_push_pending+0x1fb/0x6b0 net/mptcp/protocol.c:1547 mptcp_release_cb+0xfe/0x210 net/mptcp/protocol.c:3003 release_sock+0xb4/0x1b0 net/core/sock.c:3206 sk_stream_wait_memory+0x604/0xed0 net/core/stream.c:145 mptcp_sendmsg+0xc39/0x1bc0 net/mptcp/protocol.c:1749 inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:643 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 sock_write_iter+0x2a0/0x3e0 net/socket.c:1057 call_write_iter include/linux/fs.h:2163 [inline] new_sync_write+0x40b/0x640 fs/read_write.c:507 vfs_write+0x7cf/0xae0 fs/read_write.c:594 ksys_write+0x1ee/0x250 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 …

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

• kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number (CVE-2023-52881,RHV-2024-1001)

• kernel: ovl: fix leaked entry (CVE-2021-46972)

• kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)

• kernel: gro: fix ownership transfer (CVE-2024-35890)

• kernel: tls: (CVE-2024-26584, CVE-2024-26583, CVE-2024-26585)

• kernel: wifi: (CVE-2024-35789, CVE-2024-27410, CVE-2024-35838, CVE-2024-35845)

• kernel: mlxsw: (CVE-2024-35855, CVE-2024-35854, CVE-2024-35853, CVE-2024-35852, CVE-2024-36007)

• kernel: PCI interrupt mapping cause oops [rhel-8] (CVE-2021-46909)

• kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)

• kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng [rhel-8] (CVE-2023-52615)

• kernel: net/mlx5e: (CVE-2023-52626, CVE-2024-35835, CVE-2023-52667, CVE-2024-35959)

• kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)

• kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset [rhel-8] (CVE-2024-26801)

• kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)

• kernel: netfilter: nf_tables: use timestamp to check for set element timeout [rhel-8.10] (CVE-2024-27397)

• kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)

• kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)

• kernel: x86/mm/swap: (CVE-2024-26759, CVE-2024-26906)

• kernel: tipc: fix kernel warning when sending SYN message [rhel-8] (CVE-2023-52700)

• kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)

• kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)

• kernel: powerpc/imc-pmu/powernv: (CVE-2023-52675, CVE-2023-52686)

• kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs (CVE-2023-5090)

• kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)

• kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)

• kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)

• kernel: crypto: (CVE-2024-26974, CVE-2023-52669, CVE-2023-52813)

• kernel: net/mlx5/bnx2x/usb: (CVE-2024-35960, CVE-2024-35958, CVE-2021-47310, CVE-2024-26804, CVE-2021-47311, CVE-2024-26859, CVE-2021-47236, CVE-2023-52703)

• kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)

• kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

• kernel: USB/usbnet: (CVE-2023-52781, CVE-2023-52877, CVE-2021-47495)

• kernel: can: (CVE-2023-52878, CVE-2021-47456)

• kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)

• kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

Bug Fix(es):

• Kernel panic - kernel BUG at mm/slub.c:376! (JIRA:Rocky Linux-29783)

• Temporary values in FIPS integrity test should be zeroized [rhel-8.10.z] (JIRA:Rocky Linux-35361)

• Rocky Linux8.6 - kernel: s390/cpum_cf: make crypto counters upward compatible (JIRA:Rocky Linux-36048)

• [Rocky Linux8] blktests block/024 failed (JIRA:Rocky Linux-8130)

• Rocky Linux8.9: EEH injections results Error: Power fault on Port 0 and other call traces(Everest/1050/Shiner) (JIRA:Rocky Linux-14195)

• Latency spikes with Matrox G200 graphic cards (JIRA:Rocky Linux-36172)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: tls (CVE-2024-26585,CVE-2024-26584, CVE-2024-26583

• kernel-rt: kernel: PCI interrupt mapping cause oops [rhel-8] (CVE-2021-46909)

• kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)

• kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng (CVE-2023-52615)

• kernel-rt: kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)

• kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset CVE-2024-26801)

• kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)

• kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397)

• kernel: wifi: mac80211: (CVE-2024-35789, CVE-2024-35838, CVE-2024-35845)

• kernel: wifi: nl80211: reject iftype change with mesh ID change (CVE-2024-27410)

• kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

• kernel:TCP-spoofed ghost ACKs and leak initial sequence number (CVE-2023-52881)

• kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

• kernel: ovl: fix leaked dentry (CVE-2021-46972)

• kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)

• kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)

• kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)

• kernel: mm/swap: fix race when skipping swapcache (CVE-2024-26759)

• kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)

• kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906)

• kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)

• kernel: net/usb: kalmia: avoid printing uninitialized value on error path (CVE-2023-52703)

• kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs (CVE-2023-5090)

• kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)

• kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)

• kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)

• kernel: net/bnx2x: Prevent access to a freed page in page_pool (CVE-2024-26859)

• kernel: crypto: (CVE-2024-26974, CVE-2023-52813)

• kernel: can: (CVE-2023-52878, CVE-2021-47456)

• kernel: usb: (CVE-2023-52781, CVE-2023-52877)

• kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)

• kernel: usbnet: sanity check for maxpacket (CVE-2021-47495)

• kernel: gro: fix ownership transfer (CVE-2024-35890)

• kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)

• kernel: tipc: fix kernel warning when sending SYN message (CVE-2023-52700)

• kernel: net/mlx5/mlxsw: (CVE-2024-35960, CVE-2024-36007, CVE-2024-35855)

• kernel: net/mlx5e: (CVE-2024-35959, CVE-2023-52626, CVE-2024-35835)

• kernel: mlxsw: (CVE-2024-35854, CVE-2024-35853, CVE-2024-35852)

• kernel: net: (CVE-2024-35958, CVE-2021-47311, CVE-2021-47236, CVE-2021-47310)

• kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)

• kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)

• kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

Bug Fix(es):

• kernel-rt: update RT source tree to the latest Rocky Linux-8.10.z kernel (JIRA:Rocky Linux-40882)

• [rhel8.9][cxgb4]BUG: using smp_processor_id() in preemptible [00000000] code: ethtool/54735 (JIRA:Rocky Linux-8779)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

• kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number (CVE-2023-52881,RHV-2024-1001)

• kernel: ovl: fix leaked entry (CVE-2021-46972)

• kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)

• kernel: gro: fix ownership transfer (CVE-2024-35890)

• kernel: tls: (CVE-2024-26584, CVE-2024-26583, CVE-2024-26585)

• kernel: wifi: (CVE-2024-35789, CVE-2024-27410, CVE-2024-35838, CVE-2024-35845)

• kernel: mlxsw: (CVE-2024-35855, CVE-2024-35854, CVE-2024-35853, CVE-2024-35852, CVE-2024-36007)

• kernel: PCI interrupt mapping cause oops [rhel-8] (CVE-2021-46909)

• kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)

• kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng [rhel-8] (CVE-2023-52615)

• kernel: net/mlx5e: (CVE-2023-52626, CVE-2024-35835, CVE-2023-52667, CVE-2024-35959)

• kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)

• kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset [rhel-8] (CVE-2024-26801)

• kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)

• kernel: netfilter: nf_tables: use timestamp to check for set element timeout [rhel-8.10] (CVE-2024-27397)

• kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)

• kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)

• kernel: x86/mm/swap: (CVE-2024-26759, CVE-2024-26906)

• kernel: tipc: fix kernel warning when sending SYN message [rhel-8] (CVE-2023-52700)

• kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)

• kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)

• kernel: powerpc/imc-pmu/powernv: (CVE-2023-52675, CVE-2023-52686)

• kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs (CVE-2023-5090)

• kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)

• kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)

• kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)

• kernel: crypto: (CVE-2024-26974, CVE-2023-52669, CVE-2023-52813)

• kernel: net/mlx5/bnx2x/usb: (CVE-2024-35960, CVE-2024-35958, CVE-2021-47310, CVE-2024-26804, CVE-2021-47311, CVE-2024-26859, CVE-2021-47236, CVE-2023-52703)

• kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)

• kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

• kernel: USB/usbnet: (CVE-2023-52781, CVE-2023-52877, CVE-2021-47495)

• kernel: can: (CVE-2023-52878, CVE-2021-47456)

• kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)

• kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

Bug Fix(es):

• Kernel panic - kernel BUG at mm/slub.c:376! (JIRA:Rocky Linux SIG Cloud-29783)

• Temporary values in FIPS integrity test should be zeroized [rhel-8.10.z] (JIRA:Rocky Linux SIG Cloud-35361)

• Rocky Linux SIG Cloud8.6 - kernel: s390/cpum_cf: make crypto counters upward compatible (JIRA:Rocky Linux SIG Cloud-36048)

• [Rocky Linux SIG Cloud8] blktests block/024 failed (JIRA:Rocky Linux SIG Cloud-8130)

• Rocky Linux SIG Cloud8.9: EEH injections results Error: Power fault on Port 0 and other call traces(Everest/1050/Shiner) (JIRA:Rocky Linux SIG Cloud-14195)

• Latency spikes with Matrox G200 graphic cards (JIRA:Rocky Linux SIG Cloud-36172)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Properly link new fs rules into the tree Previously, add_rule_fg would only add newly created rules from the handle into the tree when they had a refcount of 1. On the other hand, create_flow_handle tries hard to find and reference already existing identical rules instead of creating new ones. These two behaviors can result in a situation where create_flow_handle 1) creates a new rule and references it, then 2) in a subsequent step during the same handle creation references it again, resulting in a rule with a refcount of 2 that is not linked into the tree, will have a NULL parent and root and will result in a crash when the flow group is deleted because del_sw_hw_rule, invoked on rule deletion, assumes node->parent is != NULL. This happened in the wild, due to another bug related to incorrect handling of duplicate pkt_reformat ids, which lead to the code in create_flow_handle incorrectly referencing a just-added rule in the same flow handle, resulting in the problem described above. Full details are at [1]. This patch changes add_rule_fg to add new rules without parents into the tree, properly initializing them and avoiding the crash. This makes it more consistent with how rules are added to an FTE in create_flow_handle.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)
• kernel:TCP-spoofed ghost ACKs and leak leak initial sequence number (CVE-2023-52881,RHV-2024-1001)
• kernel: ovl: fix leaked dentry (CVE-2021-46972)
• kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)
• kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)
• kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)
• kernel: mm/swap: fix race when skipping swapcache (CVE-2024-26759)
• kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)
• kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)
• kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906)
• kernel: powerpc/powernv: Add a null pointer check in opal_event_init() (CVE-2023-52686)
• kernel: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (CVE-2023-52675)
• kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs (CVE-2023-5090)
• kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)
• kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)
• kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)
• kernel: net/bnx2x: Prevent access to a freed page in page_pool (CVE-2024-26859)
• kernel: crypto: qat - resolve race condition during AER recovery (CVE-2024-26974)
• kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)
• kernel: net/mlx5: Properly link new fs rules into the tree (CVE-2024-35960)
• kernel: net/mlx5e: Fix mlx5e_priv_init() cleanup flow (CVE-2024-35959)
• kernel: net: ena: Fix incorrect descriptor free behavior (CVE-2024-35958)
• kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)
• kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)
• kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)
• kernel: net: ti: fix UAF in tlan_remove_one (CVE-2021-47310)

Bug Fix(es):

• Kernel panic - kernel BUG at mm/slub.c:376! (JIRA:AlmaLinux-29783)
• Temporary values in FIPS integrity test should be zeroized [almalinux-8.10.z] (JIRA:AlmaLinux-35361)
• AlmaLinux8.6 - kernel: s390/cpum_cf: make crypto counters upward compatible (JIRA:AlmaLinux-36048)
• [AlmaLinux8] blktests block/024 failed (JIRA:AlmaLinux-8130)
• AlmaLinux8.9: EEH injections results Error: Power fault on Port 0 and other call traces(Everest/1050/Shiner) (JIRA:AlmaLinux-14195)
• Latency spikes with Matrox G200 graphic cards (JIRA:AlmaLinux-36172)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (CVE-2023-52626)
• kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset (CVE-2024-26801)
• kernel: crypto: qat - resolve race condition during AER recovery (CVE-2024-26974)
• kernel: xen-netfront: Add missing skb_mark_for_recycle (CVE-2024-27393)
• kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)
• kernel: smb: client: fix UAF in smb2_reconnect_server() (CVE-2024-35870)
• kernel: net/mlx5: Properly link new fs rules into the tree (CVE-2024-35960)
• kernel: net: hns3: do not allow call hns3_nic_net_open repeatedly (CVE-2021-47400)

Bug Fix(es):

• cifs - kernel panic with cifs_put_smb_ses (JIRA:AlmaLinux-28943)
• BUG: unable to handle page fault for address: ff16bf752f593ff8 [almalinux-9.4.z] (JIRA:AlmaLinux-35672)
• [HPE 9.4 Bug] Request merge of AMD address translation library patch series [almalinux-9.4.z] (JIRA:AlmaLinux-36220)
• [AlmaLinux9] kernel BUG at lib/list_debug.c:51! [almalinux-9.4.z] (JIRA:AlmaLinux-36687)
• ice: DPLL-related fixes [almalinux-9.4.z] (JIRA:AlmaLinux-36716)
• CNB95: net/sched: update TC core to upstream v6.8 [almalinux-9.4.z] (JIRA:AlmaLinux-37641)
• IPv6: SR: backport fixes from upstream [almalinux-9.4.z] (JIRA:AlmaLinux-37669)
• [RFE] Backport tmpfs noswap mount option [almalinux-9.4.z] (JIRA:AlmaLinux-38252)
• Isolated cores causing issues on latest AlmaLinux9.4 kernel and not functioning as desired. [almalinux-9.4.z] (JIRA:AlmaLinux-38595)
• [ice] Add automatic VF reset on Tx MDD events [almalinux-9.4.z] (JIRA:AlmaLinux-39083)
• [HPEMC AlmaLinux 9.4 REGRESSION] turbostat: turbostat broken on 10+ sockets. [almalinux-9.4.z] (JIRA:AlmaLinux-34953)
• bnx2x: fix crashes in PCI error handling, resource leaks [almalinux-9.4.z] (JIRA:AlmaLinux-43272)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: tls (CVE-2024-26585,CVE-2024-26584, CVE-2024-26583
• kernel-rt: kernel: PCI interrupt mapping cause oops [almalinux-8] (CVE-2021-46909)
• kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)
• kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng (CVE-2023-52615)
• kernel-rt: kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)
• kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset CVE-2024-26801)
• kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)
• kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397)
• kernel: wifi: mac80211: (CVE-2024-35789, CVE-2024-35838, CVE-2024-35845)
• kernel: wifi: nl80211: reject iftype change with mesh ID change (CVE-2024-27410)
• kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)
• kernel:TCP-spoofed ghost ACKs and leak initial sequence number (CVE-2023-52881)
• kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)
• kernel: ovl: fix leaked dentry (CVE-2021-46972)
• kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)
• kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)
• kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)
• kernel: mm/swap: fix race when skipping swapcache (CVE-2024-26759)
• kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)
• kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906)
• kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)
• kernel: net/usb: kalmia: avoid printing uninitialized value on error path (CVE-2023-52703)
• kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs (CVE-2023-5090)
• kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)
• kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)
• kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)
• kernel: net/bnx2x: Prevent access to a freed page in page_pool (CVE-2024-26859)
• kernel: crypto: (CVE-2024-26974, CVE-2023-52813)
• kernel: can: (CVE-2023-52878, CVE-2021-47456)
• kernel: usb: (CVE-2023-52781, CVE-2023-52877)
• kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)
• kernel: usbnet: sanity check for maxpacket (CVE-2021-47495)
• kernel: gro: fix ownership transfer (CVE-2024-35890)
• kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)
• kernel: tipc: fix kernel warning when sending SYN message (CVE-2023-52700)
• kernel: net/mlx5/mlxsw: (CVE-2024-35960, CVE-2024-36007, CVE-2024-35855)
• kernel: net/mlx5e: (CVE-2024-35959, CVE-2023-52626, CVE-2024-35835)
• kernel: mlxsw: (CVE-2024-35854, CVE-2024-35853, CVE-2024-35852)
• kernel: net: (CVE-2024-35958, CVE-2021-47311, CVE-2021-47236, CVE-2021-47310)
• kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)
• kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)
• kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

Bug Fix(es):

• kernel-rt: update RT source tree to the latest AlmaLinux-8.10.z kernel (JIRA:AlmaLinux-40882)
• [almalinux8.9][cxgb4]BUG: using smp_processor_id() in preemptible [00000000] code: ethtool/54735 (JIRA:AlmaLinux-8779)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-url: https://ubuntu.com/security/CVE-2024-35902
  • net/rds: fix possible cp null dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-38587
  • speakup: Fix sizeof() vs ARRAY_SIZE() bug
• CVE-url: https://ubuntu.com/security/CVE-2024-39493
  • crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
• CVE-url: https://ubuntu.com/security/CVE-2024-38381
  • nfc: nci: Fix uninit-value in nci_rx_work
• CVE-url: https://ubuntu.com/security/CVE-2024-26810
  • vfio/pci: Lock external INTx masking ops
• CVE-url: https://ubuntu.com/security/CVE-2024-26687
  • xen/events: close evtchn after mapping cleanup
• CVE-url: https://ubuntu.com/security/CVE-2024-35893
  • net: sched: change type of reference and bind counters
  • net: sched: act_skbmod: remove dependency on rtnl lock
  • net/sched: act_skbmod: prevent kernel-infoleak
• CVE-url: https://ubuntu.com/security/CVE-2024-35823
  • vt: preserve unicode values corresponding to screen characters
  • vt: fix unicode buffer corruption when deleting characters
• CVE-url: https://ubuntu.com/security/CVE-2024-35805
  • dm snapshot: Replace mutex with rw semaphore
  • dm snapshot: fix lockup in dm_exception_table_exit
• CVE-url: https://ubuntu.com/security/CVE-2024-27004
  • clk: core: clarify the check for runtime PM
  • clk: Get runtime PM before walking tree during disable_unused
• CVE-url: https://ubuntu.com/security/CVE-2024-26852
  • net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
• CVE-url: https://ubuntu.com/security/CVE-2023-52620
  • netfilter: nf_tables: disallow timeout for anonymous sets
• CVE-url: https://ubuntu.com/security/CVE-2024-25739
  • ubi: Check for too small LEB size in VTBL code
• CVE-url: https://ubuntu.com/security/CVE-2024-27437
  • genirq: Add IRQF_NO_AUTOEN for request_irq/nmi()
  • vfio/pci: Disable auto-enable of exclusive INTx IRQ
• CVE-url: https://ubuntu.com/security/CVE-2022-48627
  • vc: separate state
  • vt: fix memory overlapping when deleting chars in the buffer
• CVE-url: https://ubuntu.com/security/CVE-2024-35910
  • mptcp: add sk_stop_timer_sync helper
  • tcp: properly terminate timers for kernel sockets
• CVE-url: https://ubuntu.com/security/CVE-2024-35969
  • ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
• CVE-url: https://ubuntu.com/security/CVE-2024-27024
  • RDS: RDMA: Fix the NULL-ptr deref in rds_ib_get_mr
  • net/rds: fix WARNING in rds_conn_connect_if_down
• CVE-url: https://ubuntu.com/security/CVE-2024-26863
  • hsr: Fix uninit-value access in hsr_get_node()
• CVE-url: https://ubuntu.com/security/CVE-2024-26984
  • nouveau: fix instmem race condition around ptr stores
• CVE-url: https://ubuntu.com/security/CVE-2024-36020
  • i40e: fix vf may be used uninitialized in this function warning
• CVE-url: https://ubuntu.com/security/CVE-2024-35849
  • btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
• CVE-url: https://ubuntu.com/security/CVE-2024-27388
  • SUNRPC: fix some memleaks in gssx_dec_option_array
• CVE-url: https://ubuntu.com/security/CVE-2024-35886
  • ipv6: Fix infinite recursion in fib6_dump_done().
• CVE-url: https://ubuntu.com/security/CVE-2024-35809
  • PCI/PM: Drain runtime-idle callbacks before driver removal
• CVE-url: https://ubuntu.com/security/CVE-2024-26875
  • media: pvrusb2: fix uaf in pvr2_context_set_notify
• CVE-url: https://ubuntu.com/security/CVE-2024-26851
  • netfilter: nf_conntrack_h323: Add protection for bmp length out of range
• CVE-url: https://ubuntu.com/security/CVE-2024-26999
  • serial/pmac_zilog: Remove flawed mitigation for rx irq flood
• CVE-url: https://ubuntu.com/security/CVE-2024-35819
  • soc: fsl: qbman: Use raw spinlock for cgr_lock
• CVE-url: https://ubuntu.com/security/CVE-2024-35806
  • soc: fsl: qbman: Always disable interrupts when taking…

• Bump ABI 4.15.0-232

• net: fix __dst_negative_advice() race {CVE-2024-36971}
• spec: update shim Conflicts, Provides keys
• ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() {CVE-2024-36902}
• ipv6: prevent NULL dereference in ip6_output() {CVE-2024-36901}
• drm/amd/display: Atom Integrated System Info v2_2 for DCN35 {CVE-2024-36897}
• i2c: smbus: fix NULL function pointer dereference {CVE-2024-35984}
• Bluetooth: Fix memory leak in hci_req_sync_complete() {CVE-2024-35978}
• net/mlx5: Properly link new fs rules into the tree {CVE-2024-35960}
• net: ena: Fix incorrect descriptor free behavior {CVE-2024-35958}
• tun: limit printing rate when illegal packet received by tun dev {CVE-2024-27013}
• Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security {CVE-2024-26903}
• bpf: Fix re-attachment branch in bpf_tracing_prog_attach {CVE-2024-26591}
• ubi: Check for too small LEB size in VTBL code {CVE-2024-25739}
• Bluetooth: Fix atomicity violation in {min,max}_key_size_set {CVE-2024-24860}
• dm: limit the number of targets and parameter size area {CVE-2024-23851}
• netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() {CVE-2024-27020}
• netfilter: nf_tables: __nft_expr_type_get() selects specific family type
• scsi: qla2xxx: Fix double free of the ha->vp_map pointer {CVE-2024-26930}
• scsi: qla2xxx: Fix double free of fcport {CVE-2024-26929}
• net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() {CVE-2024-26882}
• ext4: improve error recovery code paths in __ext4_remount() {CVE-2024-0775}
• netfilter: nf_tables: Reject tables of unsupported family {CVE-2023-6040}

• smb: client: reject userspace cifs.spnego descriptions
• mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash {CVE-2024-35854}
• cifs: Fix memory leak when build ntlmssp negotiate blob failed {CVE-2022-50372}
• scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() {CVE-2023-53038}
• drm/amd/display: Do not set DRR on pipe Commit {CVE-2023-53042}
• tcp: fix skb_copy_ubufs() vs BIG TCP {CVE-2023-53669}
• clk: Fix clk_core_get NULL dereference {CVE-2024-27038}
• drm/amd/display: Check null pointers before using dc->clk_mgr {CVE-2024-49907}
• bpf: reject unhashed sockets in bpf_sk_assign {CVE-2023-53585}
• driver core: fix resource leak in device_add() {CVE-2023-53594}
• wifi: ath9k: hif_usb: fix memory leak of remain_skbs {CVE-2023-53641}
• wifi: ath9k: verify the expected usb_endpoints are present {CVE-2022-50297}
• drm/amd/display: Fix potential null-deref in dm_resume {CVE-2022-50535}
• ext4: don't allow journal inode to have encrypt flag {CVE-2022-50277}
• tls: get psock ref after taking rxlock to avoid leak {CVE-2024-35908}
• cpumap: Zero-initialise xdp_rxq_info struct before running XDP program {CVE-2024-27431}
• bpf: Guard stack limits against 32bit overflow {CVE-2023-52676}
• can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible() {CVE-2021-47457}
• serial: core: fix transmit-buffer reset and memleak {CVE-2021-47527}
• cpufreq: exit() callback is optional {CVE-2024-38615}
• ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() {CVE-2024-39276}
• tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets {CVE-2024-36905}
• wifi: nl80211: reject iftype change with mesh ID change {CVE-2024-27410}
• tcp: do not accept ACK of bytes we never sent {CVE-2023-52881}
• crypto: pcrypt - Fix hungtask for PADATA_RESET {CVE-2023-52813}
• net/mlx5: Properly link new fs rules into the tree {CVE-2024-35960}
• usb: ulpi: fix memory leak on ulpi_register() error paths
• usb: ulpi: fix double free in ulpi_register_interface() error path {CVE-2026-31759}
• wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
• net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute {CVE-2025-21653}
• calipso: fix memory leak in netlbl_calipso_add_pass() {CVE-2023-52698}
• wifi: iwlwifi: mvm: avoid NULL pointer dereference {CVE-2024-49929}
• ext4: update orig_path in ext4_find_extent() {CVE-2024-49881}
• drm/vmwgfx: Fix a deadlock in dma buf fence polling {CVE-2024-43863}
• RDMA/restrack: Fix potential invalid address access {CVE-2024-42080}
• net: can: j1939: Initialize unused data in j1939_send_one() {CVE-2024-42076}
• nfsd: clear acl_access/acl_default after releasing them {CVE-2025-21796}
• rtc: pl031: fix rtc features null pointer dereference {CVE-2022-49273}
• net: veth: clear GRO when clearing XDP even when down {CVE-2024-26803}
• coresight: cti: Fix hang in cti_disable_hw() {CVE-2022-50491}
• scsi: qla2xxx: Fix deletion race condition {CVE-2023-53615}
• iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() {CVE-2023-53476}
• scsi: qla2xxx: Fix potential NULL pointer dereference {CVE-2023-53451}
• usb: ucsi_acpi: Increase the command completion timeout {CVE-2023-53168}
• drivers: base: dd: fix memory leak with using debugfs_lookup() {CVE-2023-53390}
• USB: fix memory leak with using debugfs_lookup() {CVE-2023-53359}
• PM: domains: fix memory leak with using debugfs_lookup() {CVE-2023-53202}
• drm/client: Fix memory leak in drm_client_modeset_probe {CVE-2023-53288}
• drivers: base: component: fix memory leak with using debugfs_lookup() {CVE-2023-53409}
• USB: uhci: fix memory leak with using debugfs_lookup() {CVE-2023-53197}
• media: uvcvideo: Handle cameras with invalid descriptors {CVE-2023-53437}
• arm64: csum: Fix OoB access in IP checksum code for negative lengths {CVE-2023-53726}
• bnxt: Do not read past the end of test names {CVE-2023-53010}
• dax: make sure inodes are flushed before destroy cache {CVE-2022-49220}
• cifs: Fix oops due to uncleared server->smbd_conn…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (CVE-2023-52626)

• kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset (CVE-2024-26801)

• kernel: crypto: qat - resolve race condition during AER recovery (CVE-2024-26974)

• kernel: xen-netfront: Add missing skb_mark_for_recycle (CVE-2024-27393)

• kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)

• kernel: smb: client: fix UAF in smb2_reconnect_server() (CVE-2024-35870)

• kernel: net/mlx5: Properly link new fs rules into the tree (CVE-2024-35960)

• kernel: net: hns3: do not allow call hns3_nic_net_open repeatedly (CVE-2021-47400)

Bug Fix(es):

• cifs - kernel panic with cifs_put_smb_ses (JIRA:Rocky Linux-28943)

• BUG: unable to handle page fault for address: ff16bf752f593ff8 [rhel-9.4.z] (JIRA:Rocky Linux-35672)

• [HPE 9.4 Bug] Request merge of AMD address translation library patch series [rhel-9.4.z] (JIRA:Rocky Linux-36220)

• [Rocky Linux9] kernel BUG at lib/list_debug.c:51! [rhel-9.4.z] (JIRA:Rocky Linux-36687)

• ice: DPLL-related fixes [rhel-9.4.z] (JIRA:Rocky Linux-36716)

• CNB95: net/sched: update TC core to upstream v6.8 [rhel-9.4.z] (JIRA:Rocky Linux-37641)

• IPv6: SR: backport fixes from upstream [rhel-9.4.z] (JIRA:Rocky Linux-37669)

• [RFE] Backport tmpfs noswap mount option [rhel-9.4.z] (JIRA:Rocky Linux-38252)

• Isolated cores causing issues on latest Rocky Linux9.4 kernel and not functioning as desired. [rhel-9.4.z] (JIRA:Rocky Linux-38595)

• [ice] Add automatic VF reset on Tx MDD events [rhel-9.4.z] (JIRA:Rocky Linux-39083)

• [HPEMC Rocky Linux 9.4 REGRESSION] turbostat: turbostat broken on 10+ sockets. [rhel-9.4.z] (JIRA:Rocky Linux-34953)

• bnx2x: fix crashes in PCI error handling, resource leaks [rhel-9.4.z] (JIRA:Rocky Linux-43272)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (CVE-2023-52626)

• kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset (CVE-2024-26801)

• kernel: crypto: qat - resolve race condition during AER recovery (CVE-2024-26974)

• kernel: xen-netfront: Add missing skb_mark_for_recycle (CVE-2024-27393)

• kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)

• kernel: smb: client: fix UAF in smb2_reconnect_server() (CVE-2024-35870)

• kernel: net/mlx5: Properly link new fs rules into the tree (CVE-2024-35960)

• kernel: net: hns3: do not allow call hns3_nic_net_open repeatedly (CVE-2021-47400)

Bug Fix(es):

• cifs - kernel panic with cifs_put_smb_ses (JIRA:Rocky Linux SIG Cloud-28943)

• BUG: unable to handle page fault for address: ff16bf752f593ff8 [rhel-9.4.z] (JIRA:Rocky Linux SIG Cloud-35672)

• [HPE 9.4 Bug] Request merge of AMD address translation library patch series [rhel-9.4.z] (JIRA:Rocky Linux SIG Cloud-36220)

• [Rocky Linux SIG Cloud9] kernel BUG at lib/list_debug.c:51! [rhel-9.4.z] (JIRA:Rocky Linux SIG Cloud-36687)

• ice: DPLL-related fixes [rhel-9.4.z] (JIRA:Rocky Linux SIG Cloud-36716)

• CNB95: net/sched: update TC core to upstream v6.8 [rhel-9.4.z] (JIRA:Rocky Linux SIG Cloud-37641)

• IPv6: SR: backport fixes from upstream [rhel-9.4.z] (JIRA:Rocky Linux SIG Cloud-37669)

• [RFE] Backport tmpfs noswap mount option [rhel-9.4.z] (JIRA:Rocky Linux SIG Cloud-38252)

• Isolated cores causing issues on latest Rocky Linux SIG Cloud9.4 kernel and not functioning as desired. [rhel-9.4.z] (JIRA:Rocky Linux SIG Cloud-38595)

• [ice] Add automatic VF reset on Tx MDD events [rhel-9.4.z] (JIRA:Rocky Linux SIG Cloud-39083)

• [HPEMC Rocky Linux SIG Cloud 9.4 REGRESSION] turbostat: turbostat broken on 10+ sockets. [rhel-9.4.z] (JIRA:Rocky Linux SIG Cloud-34953)

• bnx2x: fix crashes in PCI error handling, resource leaks [rhel-9.4.z] (JIRA:Rocky Linux SIG Cloud-43272)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
• CVE-2024-26764: Fixed IOCB_AIO_RW check in fs/aio before the struct aio_kiocb conversion (bsc#1222721).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).
• CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).
• CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).
• CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).
• CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).
• CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).
• CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
• CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
• CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).
• CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).
• CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).
• CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).
• CVE-2024-26772: Fixed ext4 to avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (bsc#1222613).
• CVE-2024-26906: Disallowed vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26816: Ignore relocations in .notes section when building with CONFIG_XEN_PV=y (bsc#1222624).
• CVE-2024-26783: Fixed mm/vmscan bug when calling wakeup_kswapd() with a wrong zone index (bsc#1222615).
• CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).
• CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).
• CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).
• CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).
• CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
• CVE-2024-26836: Fixed platform/x86/think-lmi password opcode ordering for workstations (bsc#1222968).
• CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
• CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found() (bsc#1222618).
• CVE-2024-26807: Fixed spi/cadence-qspi NULL pointer reference in runtime PM hooks (bsc#1222801).
• CVE-2024-26737: Fixed selftests/bpf racing between bpf_timer_cancel_and_free and bpf_timer_cancel (bsc#1222557).
• CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).
• CVE-2024-26684: Fixed net/stmmac/xgmac handling of DPP safety error for DMA channels (bsc#1222445).
• CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).
• CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).
• CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
• CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
• CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
• CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
• CVE-2023-6270: Fixed a use-after-free issue in…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-52434: Fixed potential OOBs in smb2_parse_contexts() (bsc#1220148).
• CVE-2023-52458: Fixed check that partition length needs to be aligned with block size (bsc#1220428).
• CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52631: Fixed an NULL dereference bug (bsc#1222264 CVE-2023-52631).
• CVE-2023-52635: Fixed PM/devfreq to synchronize devfreq_monitor_[start/stop] (bsc#1222294).
• CVE-2023-52640: Fixed out-of-bounds in ntfs_listxattr (bsc#1222301).
• CVE-2023-52641: Fixed NULL ptr dereference checking at the end of attr_allocate_frame() (bsc#1222303)
• CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
• CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
• CVE-2023-52659: Fixed to pfn_to_kaddr() not treated as a 64-bit type (bsc#1224442).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52771: Fixed delete_endpoint() vs parent unregistration race (bsc#1225007).
• CVE-2023-52772: Fixed use-after-free in unix_stream_read_actor() (bsc#1224989).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-6238: Fixed kcalloc() arguments order (bsc#1217384).
• CVE-2023-7042: Fixed a null-pointer-dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (bsc#1218336).
• CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
• CVE-2024-21823: Fixed safety flag to struct ends (bsc#1223625).
• CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
• CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
• CVE-2024-24861: Fixed an overflow due to race condition in media/xc4000 device driver in xc4000 xc4000_get_frequency() function (bsc#1219623).
• CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
• CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
• CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
• CVE-2024-26632: Fixed iterating over an empty bio with bio_for_each_folio_all (bsc#1221635).
• CVE-2024-26638: Fixed uninitialize struct msghdr completely (bsc#1221649 CVE-2024-26638).
• CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26654: Fixed use after free in ALSA/sh/aica (bsc#1222304).
• CVE-2024-26656: Fixed drm/amdgpu use-after-free bug (bsc#1222307).
• CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).
• CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).
• CVE-2024-26674: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups (bsc#1222378).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26684: Fixed net/stmmac/xgmac handling of DPP safety error for DMA channels (bsc#1222445).
• CVE-2024-26685: Fixed nilfs2 potential bug in end_buffer_async_write (bsc#1222437).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26704: Fixed a…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52754: media: imon: fix access to invalid resource for the second interface (bsc#1225490).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52764: media: gspca: cpia1: shift-out-of-bounds in set_flicker (bsc#1225571).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52832: wifi: mac80211: do not return unset power in ieee80211_get_tx_power() (bsc#1225577).
• CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958.
• CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
• CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
• CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
• CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
• CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
• CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
• CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
• CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
• CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
• CVE-2023-52869: pstore/platform: Add check for kstrdup (bsc#1225050).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2023-52882: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change (bsc#1225692).
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
• CVE-2024-26644: btrfs: do not abort filesystem when attempting to snapshot deleted subvolume (bsc#1221282bsc#1222072).
• CVE-2024-26720: mm: Avoid overflows in dirty throttling logic (bsc#1222364).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
• CVE-2024-26973: fat: fix uninitialized field in nostale filehandles (git-fixesbsc#1223641).
• CVE-2024-27432: net: ethernet: mtk_eth_soc: fix PPE hanging issue (bsc#1224716).
• CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
• CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
• CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (bsc#1224712).
• CVE-2024-35807: ext4: fix corruption during on-line resize (bsc#1224735).
• CVE-2024-35835: net/mlx5e: fix a double-free in arfs_create_groups (bsc#1224605).
• CVE-2024-35848: eeprom: at24: fix memory corruption race condition (bsc#1224612).
• CVE-2024-35857: icmp: prevent possible NULL dereferences from icmp_build_probe() (bsc#1224619).
• CVE-2024-35861:…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52754: media: imon: fix access to invalid resource for the second interface (bsc#1225490).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52764: media: gspca: cpia1: shift-out-of-bounds in set_flicker (bsc#1225571).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52832: wifi: mac80211: do not return unset power in ieee80211_get_tx_power() (bsc#1225577).
• CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52843: llc: verify mac len before…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958.
• CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
• CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
• CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
• CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
• CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
• CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
• CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
• CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
• CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
• CVE-2023-52869: pstore/platform: Add check for kstrdup (bsc#1225050).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2023-52882: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change (bsc#1225692).
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
• CVE-2024-26644: btrfs: do not abort filesystem when attempting to snapshot deleted subvolume (bsc#1221282, bsc#1222072).
• CVE-2024-26720: mm: Avoid overflows in dirty throttling logic (bsc#1222364).
• CVE-2024-26845: scsi: target: core: Add TMF to tmr_list handling (bsc#1223018).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
• CVE-2024-26973: fat: fix uninitialized field in nostale filehandles (bsc#1223641).
• CVE-2024-27432: net: ethernet: mtk_eth_soc: fix PPE hanging issue (bsc#1224716).
• CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
• CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
• CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (bsc#1224712).
• CVE-2024-35807: ext4: fix corruption during on-line resize (bsc#1224735).
• CVE-2024-35835: net/mlx5e: fix a double-free in arfs_create_groups (bsc#1224605).
• CVE-2024-35848: eeprom: at24: fix memory corruption race condition (bsc#1224612).
• CVE-2024-35857: icmp: prevent possible…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-10135: Legacy pairing and secure-connections pairing authentication Bluetooth might have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access (bsc#1171988).
• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47145: btrfs: do not BUG_ON in link_to_fixup_dir (bsc#1222005).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47201: iavf: free q_vectors before queues in iavf_disable_vf (bsc#1222792).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47275: bcache: avoid oversized read request in cache missing code path (bsc#1224965).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47328: blacklist.conf: bsc#1225047 CVE-2021-47328: breaks kABI Also, does not apply.
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47438: net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() (bsc#1225229)
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47498: dm rq: do not queue request to blk-mq during DM suspend (bsc#1225357).
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47520: can: pch_can: pch_can_rx_normal: fix use after free (bsc#1225431).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
• CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958).
• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47186: tipc: check for null after calling kmemdup (bsc#1222702).
• CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
• CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
• CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
• CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
• CVE-2021-47546: ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
• CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
• CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
• CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
• CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571).
• CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len. (bsc#1226555).
• CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
• CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
• CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
• CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
• CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071).
• CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869).
• CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
• CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
• CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52787: blk-mq: make…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-38417: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225600).
• CVE-2023-47210: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225601).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52458: Fixed check that partition length needs to be aligned with block size (bsc#1220428).
• CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52631: Fixed an NULL dereference bug (bsc#1222264 CVE-2023-52631).
• CVE-2023-52640: Fixed out-of-bounds in ntfs_listxattr (bsc#1222301).
• CVE-2023-52641: Fixed NULL ptr dereference checking at the end of attr_allocate_frame() (bsc#1222303)
• CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
• CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52659: Fixed to pfn_to_kaddr() not treated as a 64-bit type (bsc#1224442)
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52699: sysv: don't call sb_bread() with pointers_lock held (bsc#1224659).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52771: Fixed delete_endpoint() vs parent unregistration race (bsc#1225007).
• CVE-2023-52772: Fixed use-after-free in unix_stream_read_actor() (bsc#1224989).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52786: ext4: fix racy may inline data check in dio write (bsc#1224939).
• CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
• CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
• CVE-2023-52855: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (bsc#1225583).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2023-6238: Fixed kcalloc() arguments order (bsc#1217384).
• CVE-2024-21823: Fixed safety flag to struct ends (bsc#1223625).
• CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
• CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
• CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
• CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
• CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
• CVE-2024-26623: pds_core: Prevent race issues involving the adminq (bsc#1221057).
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086) -…

The SUSE Linux Enterprise Micro 6.0 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
• CVE-2024-40948: mm/page_table_check: fix crash on ZONE_DEVICE (bsc#1227801).
• CVE-2024-35890:…

The SUSE Linux Enterprise Micro 6.0 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).
• CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).
• CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
• CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).
• CVE-2024-44996: vsock: fix recursive ->recvmsg calls (bsc#1230205).
• CVE-2024-45828: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request (bsc#1235705).
• CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).
• CVE-2024-48881: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again (bsc#1235727).
• CVE-2024-49948: net: add more sanity checks to qdisc_pkt_len_init() (bsc#1232161).
• CVE-2024-49951: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (bsc#1232158).
• CVE-2024-49978: gso: fix udp gso fraglist segmentation after pull from frag_list (bsc#1232101).
• CVE-2024-49998: net: dsa: improve shutdown sequence (bsc#1232087).
• CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).
• CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).
• CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).
• CVE-2024-50151: smb: client: fix OOBs when building SMB2_IOCTL request (bsc#1233055).
• CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unuse_vma (bsc#1233112).
• CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).
• CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).
• CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).
• CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).
• CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).
• CVE-2024-50299: sctp: properly validate chunk size in sctp_sf_ootb() (bsc#1233488).
• CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
• CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).
• CVE-2024-53091: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (bsc#1233638).
• CVE-2024-53099: bpf: Check validity of link->type in bpf_link_show_fdinfo() (bsc#1233772).
• CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).
• CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).
• CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).
• CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).
• CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).
• CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).
• CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).
• CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).
• CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)
• CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).
• CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
• CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).
• CVE-2024-53161:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).
• CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).
• CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
• CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).
• CVE-2024-44996: vsock: fix recursive ->recvmsg calls (bsc#1230205).
• CVE-2024-45828: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request (bsc#1235705).
• CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).
• CVE-2024-48881: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again (bsc#1235727).
• CVE-2024-49948: net: add more sanity checks to qdisc_pkt_len_init() (bsc#1232161).
• CVE-2024-49951: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (bsc#1232158).
• CVE-2024-49978: gso: fix udp gso fraglist segmentation after pull from frag_list (bsc#1232101).
• CVE-2024-49998: net: dsa: improve shutdown sequence (bsc#1232087).
• CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).
• CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).
• CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).
• CVE-2024-50151: smb: client: fix OOBs when building SMB2_IOCTL request (bsc#1233055).
• CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unuse_vma (bsc#1233112).
• CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).
• CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).
• CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).
• CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).
• CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).
• CVE-2024-50299: sctp: properly validate chunk size in sctp_sf_ootb() (bsc#1233488).
• CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
• CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).
• CVE-2024-53091: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (bsc#1233638).
• CVE-2024-53099: bpf: Check validity of link->type in bpf_link_show_fdinfo() (bsc#1233772).
• CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).
• CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).
• CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).
• CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).
• CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).
• CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).
• CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).
• CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).
• CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)
• CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).
• CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
• CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).
• CVE-2024-53161:…

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Accessibility subsystem;
• Android drivers;
• Drivers core;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• Buffer Sharing and Synchronization framework;
• GPU drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• Device tree and open firmware driver;
• Chrome hardware platform drivers;
• i.MX PM domains;
• TI SCI PM domains driver;
• S/390 drivers;
• SCSI drivers;
• SPI subsystem;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• Framebuffer layer;
• BTRFS file system;
• Network file system server daemon;
• NILFS2 file system;
• File systems infrastructure;
• Pstore file system;
• SMB network file system;
• BPF subsystem;
• Bluetooth subsystem;
• Netfilter;
• io_uring subsystem;
• Core kernel;
• Extra boot config (XBC);
• Memory management;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• eXpress Data Path;
• SELinux security module; (CVE-2024-35967, CVE-2024-35886, CVE-2024-26999, CVE-2024-27008, CVE-2024-26988, CVE-2024-35980, CVE-2024-26982, CVE-2024-35946, CVE-2024-35918, CVE-2024-27015, CVE-2024-35900, CVE-2024-35942, CVE-2024-35879, CVE-2024-35961, CVE-2024-35944, CVE-2024-35934, CVE-2024-35978, CVE-2024-35938, CVE-2024-27003, CVE-2024-35976, CVE-2024-36019, CVE-2024-35880, CVE-2024-35866, CVE-2024-35929, CVE-2024-35917, CVE-2024-35912, CVE-2024-35896, CVE-2024-26986, CVE-2024-35951, CVE-2024-35958, CVE-2024-26997, CVE-2024-35965, CVE-2024-35953, CVE-2024-26993, CVE-2024-26991, CVE-2024-35892, CVE-2024-36026, CVE-2024-35882, CVE-2024-35964, CVE-2024-35865, CVE-2024-35897, CVE-2024-26981, CVE-2024-35872, CVE-2024-36027, CVE-2024-26983, CVE-2024-35909, CVE-2024-35985, CVE-2024-35875, CVE-2024-35890, CVE-2024-26922, CVE-2024-26994, CVE-2024-35903, CVE-2024-35936, CVE-2024-35904, CVE-2024-27013, CVE-2024-36025, CVE-2024-26980, CVE-2024-27006, CVE-2024-35861, CVE-2024-35864, CVE-2024-27018, CVE-2024-36022, CVE-2024-26990, CVE-2024-35968, CVE-2024-35860, CVE-2024-36024, CVE-2024-35933, CVE-2024-27019, CVE-2024-35925, CVE-2024-35950, CVE-2024-35915, CVE-2024-35916, CVE-2024-35956, CVE-2024-36020, CVE-2024-35873, CVE-2024-27002, CVE-2024-35963, CVE-2024-35959, CVE-2024-35937, CVE-2024-27011, CVE-2024-27020, CVE-2024-35883, CVE-2024-35913, CVE-2024-35910, CVE-2024-27021, CVE-2024-35921, CVE-2024-35905, CVE-2024-27010, CVE-2024-35981, CVE-2024-35885, CVE-2024-35955, CVE-2024-35894, CVE-2024-35969, CVE-2024-36018, CVE-2024-35867, CVE-2024-27007, CVE-2024-35908, CVE-2024-26985, CVE-2024-27016, CVE-2024-35960, CVE-2024-35935, CVE-2024-35932, CVE-2024-35957, CVE-2024-27001, CVE-2024-35871, CVE-2024-35907, CVE-2024-35878, CVE-2024-35979, CVE-2024-35972, CVE-2024-35975, CVE-2024-35877, CVE-2024-35926, CVE-2024-26817, CVE-2024-35899, CVE-2024-27004, CVE-2024-35920, CVE-2024-35924, CVE-2024-35977, CVE-2024-35930, CVE-2024-35911, CVE-2024-26996,…

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Accessibility subsystem;
• Android drivers;
• Drivers core;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• Buffer Sharing and Synchronization framework;
• GPU drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• Device tree and open firmware driver;
• Chrome hardware platform drivers;
• i.MX PM domains;
• TI SCI PM domains driver;
• S/390 drivers;
• SCSI drivers;
• SPI subsystem;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• Framebuffer layer;
• BTRFS file system;
• Network file system server daemon;
• NILFS2 file system;
• File systems infrastructure;
• Pstore file system;
• SMB network file system;
• BPF subsystem;
• Bluetooth subsystem;
• Netfilter;
• io_uring subsystem;
• Core kernel;
• Extra boot config (XBC);
• Memory management;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• eXpress Data Path;
• SELinux security module; (CVE-2024-35976, CVE-2024-35873, CVE-2024-35959, CVE-2024-27012, CVE-2024-36025, CVE-2024-35868, CVE-2024-26995, CVE-2024-35916, CVE-2024-36023, CVE-2024-35964, CVE-2024-35890, CVE-2024-26980, CVE-2024-35950, CVE-2024-27006, CVE-2024-35955, CVE-2024-35885, CVE-2024-35960, CVE-2024-35932, CVE-2024-26986, CVE-2024-35884, CVE-2024-35860, CVE-2024-36020, CVE-2024-35930, CVE-2024-35919, CVE-2024-27020, CVE-2024-26928, CVE-2024-35903, CVE-2024-35907, CVE-2024-35904, CVE-2024-35972, CVE-2024-35892, CVE-2024-26921, CVE-2024-35869, CVE-2024-35957, CVE-2024-35967, CVE-2024-35927, CVE-2024-35946, CVE-2024-27000, CVE-2024-35943, CVE-2024-35902, CVE-2024-27013, CVE-2024-35968, CVE-2024-35970, CVE-2024-35865, CVE-2024-36022, CVE-2024-26993, CVE-2024-36027, CVE-2024-35895, CVE-2024-35908, CVE-2024-35901, CVE-2024-35872, CVE-2024-26925, CVE-2024-35917, CVE-2024-35898, CVE-2024-35861, CVE-2024-35900, CVE-2024-26984, CVE-2024-35891, CVE-2023-52699, CVE-2024-35961, CVE-2024-35951, CVE-2024-36019, CVE-2024-27021, CVE-2024-35939, CVE-2024-26997, CVE-2024-26999, CVE-2024-35897, CVE-2024-35896, CVE-2024-26817, CVE-2024-35875, CVE-2024-35935, CVE-2024-27015, CVE-2024-26982, CVE-2024-35958, CVE-2024-26989, CVE-2024-26922, CVE-2024-26811, CVE-2024-27003, CVE-2024-35920, CVE-2024-27007, CVE-2024-35879, CVE-2024-35979, CVE-2024-35978, CVE-2024-35914, CVE-2024-35938, CVE-2024-35913, CVE-2024-26985, CVE-2024-35915, CVE-2024-35974, CVE-2024-27001, CVE-2024-35940, CVE-2024-35867, CVE-2024-26994, CVE-2024-35886, CVE-2024-35899, CVE-2024-27022, CVE-2024-35910, CVE-2024-35893, CVE-2024-27010, CVE-2024-36024, CVE-2024-26926, CVE-2024-26923, CVE-2024-26990, CVE-2024-35912, CVE-2024-26987, CVE-2024-35966, CVE-2024-35977, CVE-2024-35866, CVE-2024-35975, CVE-2024-35965, CVE-2024-35933, CVE-2024-26936, CVE-2024-35889, CVE-2024-35863, CVE-2024-27002, CVE-2024-27018, CVE-2024-36021, CVE-2024-27019, CVE-2024-35921, CVE-2024-35870,…

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Accessibility subsystem;
• Android drivers;
• Drivers core;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• Buffer Sharing and Synchronization framework;
• GPU drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• Device tree and open firmware driver;
• Chrome hardware platform drivers;
• i.MX PM domains;
• TI SCI PM domains driver;
• S/390 drivers;
• SCSI drivers;
• SPI subsystem;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• Framebuffer layer;
• BTRFS file system;
• Network file system server daemon;
• NILFS2 file system;
• File systems infrastructure;
• Pstore file system;
• SMB network file system;
• BPF subsystem;
• Bluetooth subsystem;
• Netfilter;
• io_uring subsystem;
• Core kernel;
• Extra boot config (XBC);
• Memory management;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• eXpress Data Path;
• SELinux security module; (CVE-2024-35955, CVE-2024-35921, CVE-2024-35946, CVE-2024-35934, CVE-2024-26993, CVE-2024-35899, CVE-2024-35952, CVE-2024-35894, CVE-2024-35886, CVE-2024-35872, CVE-2024-35970, CVE-2024-35936, CVE-2024-35907, CVE-2024-27013, CVE-2024-35910, CVE-2024-27009, CVE-2024-35875, CVE-2024-36021, CVE-2024-26923, CVE-2024-26997, CVE-2024-35978, CVE-2024-35981, CVE-2024-27015, CVE-2024-26928, CVE-2024-35963, CVE-2024-35897, CVE-2024-27020, CVE-2024-35922, CVE-2024-27001, CVE-2024-27011, CVE-2024-35940, CVE-2024-35871, CVE-2024-35900, CVE-2024-35869, CVE-2024-35905, CVE-2024-35974, CVE-2024-35873, CVE-2024-35882, CVE-2024-35914, CVE-2024-35956, CVE-2024-35887, CVE-2024-35920, CVE-2024-27018, CVE-2024-35880, CVE-2024-35943, CVE-2024-35912, CVE-2024-35979, CVE-2024-35862, CVE-2024-36019, CVE-2024-35950, CVE-2024-35977, CVE-2024-35918, CVE-2024-26992, CVE-2024-35884, CVE-2024-35916, CVE-2024-26817, CVE-2024-35959, CVE-2024-35909, CVE-2024-35933, CVE-2024-35982, CVE-2024-26996, CVE-2024-35980, CVE-2024-36018, CVE-2024-26925, CVE-2024-35929, CVE-2024-35971, CVE-2024-26990, CVE-2024-35885, CVE-2024-36025, CVE-2024-26998, CVE-2024-35930, CVE-2024-26982, CVE-2024-36022, CVE-2024-35895, CVE-2024-35902, CVE-2024-35911, CVE-2024-27002, CVE-2024-35968, CVE-2024-35861, CVE-2024-35903, CVE-2024-36026, CVE-2024-35896, CVE-2024-35945, CVE-2024-26936, CVE-2024-35954, CVE-2024-26985, CVE-2024-35908, CVE-2024-35924, CVE-2024-35938, CVE-2024-26991, CVE-2024-27017, CVE-2024-26922, CVE-2024-35919, CVE-2024-35915, CVE-2024-35985, CVE-2024-26995, CVE-2024-35870, CVE-2024-27010, CVE-2024-35904, CVE-2024-26999, CVE-2024-26983, CVE-2024-35939, CVE-2024-35865, CVE-2024-35860, CVE-2024-35944, CVE-2024-27021, CVE-2024-27016, CVE-2024-27004, CVE-2024-27019, CVE-2024-36027, CVE-2024-35890, CVE-2024-35975, CVE-2024-35901, CVE-2024-35967, CVE-2024-26986, CVE-2024-35957, CVE-2024-35937, CVE-2024-26988, CVE-2024-35972, CVE-2024-35926, CVE-2024-26926,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• ACPI drivers;
• Android drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• PCI subsystem;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• FAT file system;
• NILFS2 file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Packet sockets;
• RDS protocol;
• Network traffic control;
• Sun RPC protocol;
• Unix domain sockets;
• ALSA SH drivers;
• USB sound devices;
• KVM core; (CVE-2024-35969, CVE-2024-35819, CVE-2024-26851, CVE-2024-26816, CVE-2024-26643, CVE-2023-52656, CVE-2024-27020, CVE-2024-35821, CVE-2024-35930, CVE-2024-35936, CVE-2024-27075, CVE-2024-26817, CVE-2024-26984, CVE-2024-35895, CVE-2024-35853, CVE-2024-27043, CVE-2024-35978, CVE-2024-35960, CVE-2024-26882, CVE-2024-35806, CVE-2024-35830, CVE-2024-26852, CVE-2024-35915, CVE-2024-36006, CVE-2024-35935, CVE-2024-26926, CVE-2024-35877, CVE-2024-27396, CVE-2024-26654, CVE-2024-27077, CVE-2024-27078, CVE-2024-27000, CVE-2024-35888, CVE-2024-27437, CVE-2024-26994, CVE-2024-26973, CVE-2024-26687, CVE-2024-26955, CVE-2024-26898, CVE-2024-26859, CVE-2023-52620,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• ACPI drivers;
• Android drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• PCI subsystem;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• FAT file system;
• NILFS2 file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Packet sockets;
• RDS protocol;
• Network traffic control;
• Sun RPC protocol;
• Unix domain sockets;
• ALSA SH drivers;
• USB sound devices;
• KVM core; (CVE-2024-27076, CVE-2024-35849, CVE-2024-35899, CVE-2024-27038, CVE-2024-35982, CVE-2024-26687, CVE-2024-26863, CVE-2024-36004, CVE-2024-27004, CVE-2024-27065, CVE-2024-36020, CVE-2024-27000, CVE-2024-26981, CVE-2024-26973, CVE-2024-35922, CVE-2024-35969, CVE-2024-26851, CVE-2023-52880, CVE-2024-35813, CVE-2024-26859, CVE-2024-27078, CVE-2024-27020, CVE-2024-35809, CVE-2024-27001, CVE-2024-26969, CVE-2024-26993, CVE-2024-35935, CVE-2024-35815, CVE-2024-26931, CVE-2024-35823, CVE-2024-26984, CVE-2024-27024, CVE-2024-27419, CVE-2024-27008, CVE-2024-35825, CVE-2023-52644, CVE-2024-35933, CVE-2024-35830, CVE-2024-35900, CVE-2024-27046, CVE-2024-26651,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• ACPI drivers;
• Android drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• PCI subsystem;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• FAT file system;
• NILFS2 file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Packet sockets;
• RDS protocol;
• Network traffic control;
• Sun RPC protocol;
• Unix domain sockets;
• ALSA SH drivers;
• USB sound devices;
• KVM core; (CVE-2023-52620, CVE-2023-52650, CVE-2024-26999, CVE-2024-26857, CVE-2024-35984, CVE-2024-27043, CVE-2024-26810, CVE-2023-52880, CVE-2024-35915, CVE-2024-26955, CVE-2024-27396, CVE-2024-35922, CVE-2024-27395, CVE-2024-35899, CVE-2024-35809, CVE-2024-27000, CVE-2024-27004, CVE-2024-35830, CVE-2024-26931, CVE-2024-26993, CVE-2024-27013, CVE-2024-26812, CVE-2024-35893, CVE-2024-27073, CVE-2024-26687, CVE-2024-26969, CVE-2024-26901, CVE-2024-26875, CVE-2024-26976, CVE-2024-26889, CVE-2024-26586, CVE-2024-36020, CVE-2024-26859, CVE-2024-35944, CVE-2024-35888, CVE-2024-26965, CVE-2024-36007, CVE-2024-35847, CVE-2024-27436, CVE-2024-35982, CVE-2023-52699,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• ACPI drivers;
• Android drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• PCI subsystem;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• FAT file system;
• NILFS2 file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Packet sockets;
• RDS protocol;
• Network traffic control;
• Sun RPC protocol;
• Unix domain sockets;
• ALSA SH drivers;
• USB sound devices;
• KVM core; (CVE-2024-35930, CVE-2024-26687, CVE-2024-26828, CVE-2024-26903, CVE-2024-35893, CVE-2024-35847, CVE-2024-35849, CVE-2024-35789, CVE-2024-26812, CVE-2024-26898, CVE-2024-26937, CVE-2024-35809, CVE-2023-52620, CVE-2024-35852, CVE-2024-26922, CVE-2024-26923, CVE-2024-27001, CVE-2024-35915, CVE-2024-35935, CVE-2024-26974, CVE-2024-26859, CVE-2024-26999, CVE-2024-26981, CVE-2024-35982, CVE-2024-26969, CVE-2024-26889, CVE-2024-26984, CVE-2024-27077, CVE-2024-26973, CVE-2024-27436, CVE-2024-26965, CVE-2024-35855, CVE-2024-27024, CVE-2024-26934, CVE-2024-35806, CVE-2024-35895, CVE-2024-27076, CVE-2024-26931, CVE-2024-35888, CVE-2024-35899, CVE-2024-35815,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• ACPI drivers;
• Android drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• PCI subsystem;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• FAT file system;
• NILFS2 file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Packet sockets;
• RDS protocol;
• Network traffic control;
• Sun RPC protocol;
• Unix domain sockets;
• ALSA SH drivers;
• USB sound devices;
• KVM core; (CVE-2024-35982, CVE-2024-26862, CVE-2024-35997, CVE-2024-26851, CVE-2024-26817, CVE-2024-26820, CVE-2024-26974, CVE-2024-35806, CVE-2024-26903, CVE-2024-35822, CVE-2024-27076, CVE-2024-26901, CVE-2024-26955, CVE-2024-26976, CVE-2024-35821, CVE-2024-27038, CVE-2024-26994, CVE-2023-52656, CVE-2024-27008, CVE-2024-26966, CVE-2024-26898, CVE-2024-26931, CVE-2024-35888, CVE-2024-26810, CVE-2024-26969, CVE-2024-35960, CVE-2024-26884, CVE-2024-26999, CVE-2024-35847, CVE-2024-35807, CVE-2024-26857, CVE-2024-35915, CVE-2023-52880, CVE-2024-35936, CVE-2024-26875, CVE-2024-26973, CVE-2024-35899, CVE-2024-35910, CVE-2024-27020, CVE-2024-26828, CVE-2024-26957,…

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• Android drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• DMA engine subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• S/390 drivers;
• SCSI drivers;
• Freescale SoC drivers;
• Trusted Execution Environment drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• FAT file system;
• Network file system client;
• Network file system server daemon;
• NILFS2 file system;
• Pstore file system;
• SMB network file system;
• UBI file system;
• Netfilter;
• BPF subsystem;
• Core kernel;
• PCI iomap interfaces;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• IEEE 802.15.4 subsystem;
• NFC subsystem;
• Open vSwitch;
• RDS protocol;
• Network traffic control;
• SMC sockets;
• Unix domain sockets;
• eXpress Data Path;
• ALSA SH drivers;
• KVM core; (CVE-2024-35955, CVE-2024-35805, CVE-2024-26814, CVE-2024-27008, CVE-2024-26970, CVE-2024-35944, CVE-2024-27013, CVE-2024-35938, CVE-2024-35853, CVE-2024-35969, CVE-2024-26981, CVE-2024-26929, CVE-2024-27020, CVE-2024-35885, CVE-2024-35973, CVE-2024-35958, CVE-2024-26961, CVE-2024-35912, CVE-2024-35890, CVE-2024-35804, CVE-2024-35813, CVE-2024-27393, CVE-2024-26956, CVE-2024-35915, CVE-2024-26642, CVE-2024-35847, CVE-2024-26960, CVE-2024-26923, CVE-2024-35935, CVE-2024-36025, CVE-2024-35898, CVE-2024-26810, CVE-2024-35809, CVE-2024-26813, CVE-2024-36007, CVE-2024-35817, CVE-2024-35849, CVE-2024-35819, CVE-2024-35884, CVE-2024-35922, CVE-2024-36008, CVE-2024-27004, CVE-2024-35902, CVE-2024-26828, CVE-2024-35791, CVE-2024-35930, CVE-2024-26973, CVE-2024-26984, CVE-2024-35806, CVE-2024-26629, CVE-2024-26955, CVE-2024-26937, CVE-2024-27059, CVE-2024-35872, CVE-2024-35978, CVE-2024-26950, CVE-2024-27018, CVE-2024-35857, CVE-2024-35990, CVE-2024-27437, CVE-2024-35822, CVE-2024-36020,…