CVE-2024-38588

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Fix possible use-after-free issue in ftrace_location()

KASAN reports a bug:

BUG: KASAN: use-after-free in ftrace_location+0x90/0x120 Read of size 8 at addr ffff888141d40010 by task insmod/424 CPU: 8 PID: 424 Comm: insmod Tainted: G W 6.9.0-rc2+ [...] Call Trace: <TASK> dump_stack_lvl+0x68/0xa0 print_report+0xcf/0x610 kasan_report+0xb5/0xe0 ftrace_location+0x90/0x120 register_kprobe+0x14b/0xa40 kprobe_init+0x2d/0xff0 [kprobe_example] do_one_initcall+0x8f/0x2d0 do_init_module+0x13a/0x3c0 load_module+0x3082/0x33d0 init_module_from_file+0xd2/0x130 __x64_sys_finit_module+0x306/0x440 do_syscall_64+0x68/0x140 entry_SYSCALL_64_after_hwframe+0x71/0x79

The root cause is that, in lookup_rec(), ftrace record of some address is being searched in ftrace pages of some module, but those ftrace pages at the same time is being freed in ftrace_release_mod() as the corresponding module is being deleted:

       CPU1                       |      CPU2

register_kprobes() { | delete_module() { check_kprobe_address_safe() { | arch_check_ftrace_location() { | ftrace_location() { | lookup_rec() // USE! | ftrace_release_mod() // Free!

To fix this issue:

1. Hold rcu lock as accessing ftrace pages in ftrace_location_range();
2. Use ftrace_location_range() instead of lookup_rec() in ftrace_location();
3. Call synchronize_rcu() before freeing any ftrace pages both in ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem().

In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix possible use-after-free issue in ftrace_location() KASAN reports a bug: BUG: KASAN: use-after-free in ftrace_location+0x90/0x120 Read of size 8 at addr ffff888141d40010 by task insmod/424 CPU: 8 PID: 424 Comm: insmod Tainted: G W 6.9.0-rc2+ [...] Call Trace: <TASK> dump_stack_lvl+0x68/0xa0 print_report+0xcf/0x610 kasan_report+0xb5/0xe0 ftrace_location+0x90/0x120 register_kprobe+0x14b/0xa40 kprobe_init+0x2d/0xff0 [kprobe_example] do_one_initcall+0x8f/0x2d0 do_init_module+0x13a/0x3c0 load_module+0x3082/0x33d0 init_module_from_file+0xd2/0x130 __x64_sys_finit_module+0x306/0x440 do_syscall_64+0x68/0x140 entry_SYSCALL_64_after_hwframe+0x71/0x79 The root cause is that, in lookup_rec(), ftrace record of some address is being searched in ftrace pages of some module, but those ftrace pages at the same time is being freed in ftrace_release_mod() as the corresponding module is being deleted: CPU1 | CPU2 register_kprobes() { | delete_module() { check_kprobe_address_safe() { | arch_check_ftrace_location() { | ftrace_location() { | lookup_rec() // USE! | ftrace_release_mod() // Free! To fix this issue: 1. Hold rcu lock as accessing ftrace pages in ftrace_location_range(); 2. Use ftrace_location_range() instead of lookup_rec() in ftrace_location(); 3. Call synchronize_rcu() before freeing any ftrace pages both in ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem().

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

spi: Fix deadlock when adding SPI controllers on SPI buses

Currently we have a global spi_add_lock which we take when adding new devices so that we can check that we're not trying to reuse a chip select that's already controlled. This means that if the SPI device is itself a SPI controller and triggers the instantiation of further SPI devices we trigger a deadlock as we try to register and instantiate those devices while in the process of doing so for the parent controller and hence already holding the global spi_add_lock. Since we only care about concurrency within a single SPI bus move the lock to be per controller, avoiding the deadlock.

This can be easily triggered in the case of spi-mux.(CVE-2021-47469)

(CVE-2023-39180)

In the Linux kernel, the following vulnerability has been resolved:

hid: cp2112: Fix duplicate workqueue initialization

Previously the cp2112 driver called INIT_DELAYED_WORK within cp2112_gpio_irq_startup, resulting in duplicate initilizations of the workqueue on subsequent IRQ startups following an initial request. This resulted in a warning in set_work_data in workqueue.c, as well as a rare NULL dereference within process_one_work in workqueue.c.

Initialize the workqueue within _probe instead.(CVE-2023-52853)

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix UAF issue in ksmbd_tcp_new_connection()

The race is between the handling of a new TCP connection and its disconnection. It leads to UAF on struct tcp_transport in ksmbd_tcp_new_connection() function.(CVE-2024-26592)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path

The commit mutex should not be released during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC worker could collect expired objects and get the released commit lock within the same GC sequence.

nf_tables_module_autoload() temporarily releases the mutex to load module dependencies, then it goes back to replay the transaction again. Move it at the end of the abort phase after nft_gc_seq_end() is called.(CVE-2024-26925)

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: fix RCU usage in connect path

With lockdep enabled, calls to the connect function from cfg802.11 layer lead to the following warning:

============================= WARNING: suspicious RCU usage 6.7.0-rc1-wt+ #333 Not tainted

drivers/net/wireless/microchip/wilc1000/hif.c:386 suspicious rcu_dereference_check() usage! [...] stack backtrace: CPU: 0 PID: 100 Comm: wpa_supplicant Not tainted 6.7.0-rc1-wt+ #333 Hardware name: Atmel SAMA5 unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x34/0x48 dump_stack_lvl from wilc_parse_join_bss_param+0x7dc/0x7f4 wilc_parse_join_bss_param from connect+0x2c4/0x648 connect from cfg80211_connect+0x30c/0xb74 cfg80211_connect from nl80211_connect+0x860/0xa94 nl80211_connect from genl_rcv_msg+0x3fc/0x59c genl_rcv_msg from netlink_rcv_skb+0xd0/0x1f8 netlink_rcv_skb from genl_rcv+0x2c/0x3c genl_rcv from netlink_unicast+0x3b0/0x550 netlink_unicast from netlink_sendmsg+0x368/0x688 netlink_sendmsg from ____sys_sendmsg+0x190/0x430 ____sys_sendmsg from ___sys_sendmsg+0x110/0x158 ___sys_sendmsg from sys_sendmsg+0xe8/0x150 sys_sendmsg from ret_fast_syscall+0x0/0x1c

This warning is emitted because in the connect path, when trying to parse target BSS parameters, we dereference a RCU pointer whithout being in RCU critical section. Fix RCU dereference usage by moving it to a RCU read critical section. To avoid wrapping the whole wilc_parse_join_bss_param under the critical section, just use the critical section to copy ies…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

can: mcba_usb: fix memory leak in mcba_usb

Syzbot reported memory leak in SocketCAN driver for Microchip CAN BUS Analyzer Tool. The problem was in unfreed usb_coherent.

In mcba_usb_start() 20 coherent buffers are allocated and there is nothing, that frees them:

1. In callback function the urb is resubmitted and that's all
2. In disconnect function urbs are simply killed, but URB_FREE_BUFFER is not set (see mcba_usb_start) and this flag cannot be used with coherent buffers.

Fail log: | [ 1354.053291][ T8413] mcba_usb 1-1:0.0 can0: device disconnected | [ 1367.059384][ T8420] kmemleak: 20 new suspected memory leaks (see /sys/kernel/debug/kmem)

So, all allocated buffers should be freed with usb_free_coherent() explicitly

NOTE: The same pattern for allocating and freeing coherent buffers is used in drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c(CVE-2021-47231)

In the Linux kernel, the following vulnerability has been resolved:

can: j1939: fix Use-after-Free, hold skb ref while in use

This patch fixes a Use-after-Free found by the syzbot.

The problem is that a skb is taken from the per-session skb queue, without incrementing the ref count. This leads to a Use-after-Free if the skb is taken concurrently from the session queue due to a CTS.(CVE-2021-47232)

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: Avoid WARN_ON timing related checks

The soft/batadv interface for a queued OGM can be changed during the time the OGM was queued for transmission and when the OGM is actually transmitted by the worker.

But WARN_ON must be used to denote kernel bugs and not to print simple warnings. A warning can simply be printed using pr_warn.(CVE-2021-47252)

In the Linux kernel, the following vulnerability has been resolved:

media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()

Fix an 11-year old bug in ngene_command_config_free_buf() while addressing the following warnings caught with -Warray-bounds:

arch/alpha/include/asm/string.h:22:16: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds] arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds]

The problem is that the original code is trying to copy 6 bytes of data into a one-byte size member config of the wrong structue FW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a legitimate compiler warning because memcpy() overruns the length of &com.cmd.ConfigureBuffers.config. It seems that the right structure is FW_CONFIGURE_FREE_BUFFERS, instead, because it contains 6 more members apart from the header hdr. Also, the name of the function ngene_command_config_free_buf() suggests that the actual intention is to ConfigureFreeBuffers, instead of ConfigureBuffers (which takes place in the function ngene_command_config_buf(), above).

Fix this by enclosing those 6 members of struct FW_CONFIGURE_FREE_BUFFERS into new struct config, and use &com.cmd.ConfigureFreeBuffers.config as the destination address, instead of &com.cmd.ConfigureBuffers.config, when calling memcpy().

This also helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().(CVE-2021-47288)

In the Linux kernel, the following vulnerability has been resolved:

coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()

commit 6f755e85c332 ("coresight: Add helper for…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ubifs: Set page uptodate in the correct place

Page cache reads are lockless, so setting the freshly allocated page uptodate before we've overwritten it with the data it's supposed to have in it will allow a simultaneous reader to see old data. Move the call to SetPageUptodate into ubifs_write_end(), which is after we copied the new data into the page.(CVE-2024-35821)

In the Linux kernel, the following vulnerability has been resolved:

kprobes: Fix possible use-after-free issue on kprobe registration

When unloading a module, its state is changing MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take a time. is_module_text_address() and __module_text_address() works with MODULE_STATE_LIVE and MODULE_STATE_GOING. If we use is_module_text_address() and __module_text_address() separately, there is a chance that the first one is succeeded but the next one is failed because module->state becomes MODULE_STATE_UNFORMED between those operations.

In check_kprobe_address_safe(), if the second __module_text_address() is failed, that is ignored because it expected a kernel_text address. But it may have failed simply because module->state has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify non-exist module text address (use-after-free).

To fix this problem, we should not use separated is_module_text_address() and __module_text_address(), but use only __module_text_address() once and do try_module_get(module) which is only available with MODULE_STATE_LIVE.(CVE-2024-35955)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP

If one TCA_TAPRIO_ATTR_PRIOMAP attribute has been provided, taprio_parse_mqprio_opt() must validate it, or userspace can inject arbitrary data to the kernel, the second time taprio_change() is called.

First call (with valid attributes) sets dev->num_tc to a non zero value.

Second call (with arbitrary mqprio attributes) returns early from taprio_parse_mqprio_opt() and bad things can happen.(CVE-2024-36974)

In the Linux kernel, the following vulnerability has been resolved:

tcp: Fix shift-out-of-bounds in dctcp_update_alpha().

In dctcp_update_alpha(), we use a module parameter dctcp_shift_g as follows:

alpha -= min_not_zero(alpha, alpha >> dctcp_shift_g); ... delivered_ce <<= (10 - dctcp_shift_g);

It seems syzkaller started fuzzing module parameters and triggered shift-out-of-bounds [0] by setting 100 to dctcp_shift_g:

memcpy((void*)0x20000080, "/sys/module/tcp_dctcp/parameters/dctcp_shift_g\000", 47); res = syscall(__NR_openat, /fd=/0xffffffffffffff9cul, /file=/0x20000080ul, /flags=/2ul, /mode=/0ul); memcpy((void*)0x20000000, "100\000", 4); syscall(__NR_write, /fd=/r[0], /val=/0x20000000ul, /len=/4ul);

Let's limit the max value of dctcp_shift_g by param_set_uint_minmax().

With this patch:

echo 10 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g

cat /sys/module/tcp_dctcp/parameters/dctcp_shift_g

10

echo 11 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g

-bash: echo: write error: Invalid argument

[0]: UBSAN: shift-out-of-bounds in net/ipv4/tcp_dctcp.c:143:12 shift exponent 100 is too large for 32-bit type 'u32' (aka 'unsigned int') CPU: 0 PID: 8083 Comm: syz-executor345 Not tainted 6.9.0-05151-g1b294a1f3561 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x201/0x300 lib/dump_stack.c:114 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x346/0x3a0…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

media: lgdt3306a: Add a check against null-pointer-def

The driver should check whether the client provides the platform_data.

The following log reveals it:

[ 29.610324] BUG: KASAN: null-ptr-deref in kmemdup+0x30/0x40 [ 29.610730] Read of size 40 at addr 0000000000000000 by task bash/414 [ 29.612820] Call Trace: [ 29.613030] <TASK> [ 29.613201] dump_stack_lvl+0x56/0x6f [ 29.613496] ? kmemdup+0x30/0x40 [ 29.613754] print_report.cold+0x494/0x6b7 [ 29.614082] ? kmemdup+0x30/0x40 [ 29.614340] kasan_report+0x8a/0x190 [ 29.614628] ? kmemdup+0x30/0x40 [ 29.614888] kasan_check_range+0x14d/0x1d0 [ 29.615213] memcpy+0x20/0x60 [ 29.615454] kmemdup+0x30/0x40 [ 29.615700] lgdt3306a_probe+0x52/0x310 [ 29.616339] i2c_device_probe+0x951/0xa90(CVE-2022-48772)

In the Linux kernel, the following vulnerability has been resolved:

genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline

The absence of IRQD_MOVE_PCNTXT prevents immediate effectiveness of interrupt affinity reconfiguration via procfs. Instead, the change is deferred until the next instance of the interrupt being triggered on the original CPU.

When the interrupt next triggers on the original CPU, the new affinity is enforced within __irq_move_irq(). A vector is allocated from the new CPU, but the old vector on the original CPU remains and is not immediately reclaimed. Instead, apicd->move_in_progress is flagged, and the reclaiming process is delayed until the next trigger of the interrupt on the new CPU.

Upon the subsequent triggering of the interrupt on the new CPU, irq_complete_move() adds a task to the old CPU's vector_cleanup list if it remains online. Subsequently, the timer on the old CPU iterates over its vector_cleanup list, reclaiming old vectors.

However, a rare scenario arises if the old CPU is outgoing before the interrupt triggers again on the new CPU.

In that case irq_force_complete_move() is not invoked on the outgoing CPU to reclaim the old apicd->prev_vector because the interrupt isn't currently affine to the outgoing CPU, and irq_needs_fixup() returns false. Even though __vector_schedule_cleanup() is later called on the new CPU, it doesn't reclaim apicd->prev_vector; instead, it simply resets both apicd->move_in_progress and apicd->prev_vector to 0.

As a result, the vector remains unreclaimed in vector_matrix, leading to a CPU vector leak.

To address this issue, move the invocation of irq_force_complete_move() before the irq_needs_fixup() call to reclaim apicd->prev_vector, if the interrupt is currently or used to be affine to the outgoing CPU.

Additionally, reclaim the vector in __vector_schedule_cleanup() as well, following a warning message, although theoretically it should never see apicd->move_in_progress with apicd->prev_cpu pointing to an offline CPU.(CVE-2024-31076)

In the Linux kernel, the following vulnerability has been resolved:

tls: fix missing memory barrier in tls_init

In tls_init(), a write memory barrier is missing, and store-store reordering may cause NULL dereference in tls_{setsockopt,getsockopt}.

CPU0 CPU1

// In tls_init() // In tls_ctx_create() ctx = kzalloc() ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1)

// In update_sk_prot() WRITE_ONCE(sk->sk_prot, tls_prots) -(2)

                               // In sock_common_setsockopt()
                               READ_ONCE(sk->sk_prot)->setsockopt()

                               // In tls_{setsockopt,getsockopt}()
                               ctx->sk_proto->setsockopt()    -(3)

In the above scenario, when (1) and (2) are reordered, (3) can observe the NULL value of ctx->sk_proto,…

In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix possible use-after-free issue in ftrace_location() KASAN reports a bug: BUG: KASAN: use-after-free in ftrace_location+0x90/0x120 Read of size 8 at addr ffff888141d40010 by task insmod/424 CPU: 8 PID: 424 Comm: insmod Tainted: G W 6.9.0-rc2+ [...] Call Trace: <TASK> dump_stack_lvl+0x68/0xa0 print_report+0xcf/0x610 kasan_report+0xb5/0xe0 ftrace_location+0x90/0x120 register_kprobe+0x14b/0xa40 kprobe_init+0x2d/0xff0 [kprobe_example] do_one_initcall+0x8f/0x2d0 do_init_module+0x13a/0x3c0 load_module+0x3082/0x33d0 init_module_from_file+0xd2/0x130 __x64_sys_finit_module+0x306/0x440 do_syscall_64+0x68/0x140 entry_SYSCALL_64_after_hwframe+0x71/0x79 The root cause is that, in lookup_rec(), ftrace record of some address is being searched in ftrace pages of some module, but those ftrace pages at the same time is being freed in ftrace_release_mod() as the corresponding module is being deleted: CPU1 | CPU2 register_kprobes() { | delete_module() { check_kprobe_address_safe() { | arch_check_ftrace_location() { | ftrace_location() { | lookup_rec() // USE! | ftrace_release_mod() // Free! To fix this issue: 1. Hold rcu lock as accessing ftrace pages in ftrace_location_range(); 2. Use ftrace_location_range() instead of lookup_rec() in ftrace_location(); 3. Call synchronize_rcu() before freeing any ftrace pages both in ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem().

• CVE-url: https://ubuntu.com/security/CVE-2024-46802
  • drm/amd/display: added NULL check at start of dc_validate_stream
• CVE-url: https://ubuntu.com/security/CVE-2024-46818
  • drm/amd/display: fix sporadic multiple aux transaction failure
  • drm/amd/display: Check gpio_id before used as array index
• CVE-url: https://ubuntu.com/security/CVE-2024-46744
  • Squashfs: sanity check symbolic link size
• CVE-url: https://ubuntu.com/security/CVE-2024-46854
  • net: dpaa: Pad packets to ETH_ZLEN
• CVE-url: https://ubuntu.com/security/CVE-2024-46813
  • drm/amd/display: Check link_index before accessing dc->links[]
• CVE-url: https://ubuntu.com/security/CVE-2024-46731
  • drm/amd/pm: fix the Out-of-bounds read warning
• CVE-url: https://ubuntu.com/security/CVE-2024-46759
  • hwmon: (adc128d818) Fix underflows seen when writing limit attributes
• CVE-url: https://ubuntu.com/security/CVE-2024-38588
  • ftrace: Fix possible warning on checking all pages used in ftrace_process_locs()
  • ftrace: Fix possible use-after-free issue in ftrace_location()
• CVE-url: https://ubuntu.com/security/CVE-2024-46743
  • of/irq: Prevent device address out-of-bounds read in interrupt map walk
• CVE-url: https://ubuntu.com/security/CVE-2024-46738
  • VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
• CVE-url: https://ubuntu.com/security/CVE-2024-46800
  • sch/netem: fix use after free in netem_dequeue
• CVE-url: https://ubuntu.com/security/CVE-2024-46757
  • hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
• CVE-url: https://ubuntu.com/security/CVE-2024-46758
  • hwmon: (lm95234) Fix underflows seen when writing limit attributes
• CVE-url: https://ubuntu.com/security/CVE-2024-46782
  • ila: call nf_unregister_net_hooks() sooner
• CVE-url: https://ubuntu.com/security/CVE-2024-46756
  • hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
• CVE-url: https://ubuntu.com/security/CVE-2024-40912
  • wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
• CVE-url: https://ubuntu.com/security/CVE-2024-46723
  • drm/amdgpu: fix ucode out-of-bounds read warning
• CVE-url: https://ubuntu.com/security/CVE-2024-46722
  • drm/amdgpu: fix mc_data out-of-bounds read warning

• CVE-url: https://ubuntu.com/security/CVE-2024-46802
  • drm/amd/display: added NULL check at start of dc_validate_stream
• CVE-url: https://ubuntu.com/security/CVE-2024-46818
  • drm/amd/display: fix sporadic multiple aux transaction failure
  • drm/amd/display: Check gpio_id before used as array index
• CVE-url: https://ubuntu.com/security/CVE-2024-46744
  • Squashfs: sanity check symbolic link size
• CVE-url: https://ubuntu.com/security/CVE-2024-46854
  • net: dpaa: Pad packets to ETH_ZLEN
• CVE-url: https://ubuntu.com/security/CVE-2024-46813
  • drm/amd/display: Check link_index before accessing dc->links[]
• CVE-url: https://ubuntu.com/security/CVE-2024-46731
  • drm/amd/pm: fix the Out-of-bounds read warning
• CVE-url: https://ubuntu.com/security/CVE-2024-46759
  • hwmon: (adc128d818) Fix underflows seen when writing limit attributes
• CVE-url: https://ubuntu.com/security/CVE-2024-38588
  • ftrace: Fix possible warning on checking all pages used in ftrace_process_locs()
  • ftrace: Fix possible use-after-free issue in ftrace_location()
• CVE-url: https://ubuntu.com/security/CVE-2024-46743
  • of/irq: Prevent device address out-of-bounds read in interrupt map walk
• CVE-url: https://ubuntu.com/security/CVE-2024-46738
  • VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
• CVE-url: https://ubuntu.com/security/CVE-2024-46800
  • sch/netem: fix use after free in netem_dequeue
• CVE-url: https://ubuntu.com/security/CVE-2024-46757
  • hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
• CVE-url: https://ubuntu.com/security/CVE-2024-46758
  • hwmon: (lm95234) Fix underflows seen when writing limit attributes
• CVE-url: https://ubuntu.com/security/CVE-2024-46782
  • ila: call nf_unregister_net_hooks() sooner
• CVE-url: https://ubuntu.com/security/CVE-2024-46756
  • hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
• CVE-url: https://ubuntu.com/security/CVE-2024-40912
  • wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
• CVE-url: https://ubuntu.com/security/CVE-2024-46723
  • drm/amdgpu: fix ucode out-of-bounds read warning
• CVE-url: https://ubuntu.com/security/CVE-2024-46722
  • drm/amdgpu: fix mc_data out-of-bounds read warning

• CVE-url: https://ubuntu.com/security/CVE-2024-38588
  • ftrace: Fix possible warning on checking all pages used in ftrace_process_locs()
  • ftrace: Fix possible use-after-free issue in ftrace_location()
• CVE-url: https://ubuntu.com/security/CVE-2024-46744
  • Squashfs: sanity check symbolic link size
• CVE-url: https://ubuntu.com/security/CVE-2022-48733
  • btrfs: fix use-after-free after failure to create a snapshot
• CVE-url: https://ubuntu.com/security/CVE-2024-44942
  • f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
• CVE-url: https://ubuntu.com/security/CVE-2024-46731
  • drm/amd/pm: fix the Out-of-bounds read warning
• CVE-url: https://ubuntu.com/security/CVE-2024-46759
  • hwmon: (adc128d818) Fix underflows seen when writing limit attributes
• CVE-url: https://ubuntu.com/security/CVE-2024-46743
  • of/irq: Prevent device address out-of-bounds read in interrupt map walk
• CVE-url: https://ubuntu.com/security/CVE-2024-46738
  • VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
• CVE-url: https://ubuntu.com/security/CVE-2024-46800
  • sch/netem: fix use after free in netem_dequeue
• CVE-url: https://ubuntu.com/security/CVE-2024-46757
  • hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
• CVE-url: https://ubuntu.com/security/CVE-2024-46758
  • hwmon: (lm95234) Fix underflows seen when writing limit attributes
• CVE-url: https://ubuntu.com/security/CVE-2024-46756
  • hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
• CVE-url: https://ubuntu.com/security/CVE-2024-40912
  • wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
• CVE-url: https://ubuntu.com/security/CVE-2024-46723
  • drm/amdgpu: fix ucode out-of-bounds read warning
• CVE-url: https://ubuntu.com/security/CVE-2024-46722
  • drm/amdgpu: fix mc_data out-of-bounds read warning
• Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479) // CVE- url: https://ubuntu.com/security/CVE-2022-48838
  • usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
• CVE-url: https://ubuntu.com/security/CVE-2021-47188
  • scsi: ufs: core: Improve SCSI abort handling
• Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479) // CVE- url: https://ubuntu.com/security/CVE-2022-48836
  • Input: aiptek - properly check endpoint type
• CVE-url: https://ubuntu.com/security/CVE-2024-26677
  • rxrpc: Fix delayed ACKs to not set the reference serial number
• Bionic update: upstream stable patchset 2021-12-13 (LP: #1954703) // CVE- url: https://ubuntu.com/security/CVE-2021-47181
  • usb: musb: tusb6010: check return value after calling platform_get_resource()

• CVE-url: https://ubuntu.com/security/CVE-2024-38588
  • ftrace: Fix possible warning on checking all pages used in ftrace_process_locs()
  • ftrace: Fix possible use-after-free issue in ftrace_location()
• CVE-url: https://ubuntu.com/security/CVE-2024-46744
  • Squashfs: sanity check symbolic link size
• CVE-url: https://ubuntu.com/security/CVE-2022-48733
  • btrfs: fix use-after-free after failure to create a snapshot
• CVE-url: https://ubuntu.com/security/CVE-2024-44942
  • f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
• CVE-url: https://ubuntu.com/security/CVE-2024-46731
  • drm/amd/pm: fix the Out-of-bounds read warning
• CVE-url: https://ubuntu.com/security/CVE-2024-46759
  • hwmon: (adc128d818) Fix underflows seen when writing limit attributes
• CVE-url: https://ubuntu.com/security/CVE-2024-46743
  • of/irq: Prevent device address out-of-bounds read in interrupt map walk
• CVE-url: https://ubuntu.com/security/CVE-2024-46738
  • VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
• CVE-url: https://ubuntu.com/security/CVE-2024-46800
  • sch/netem: fix use after free in netem_dequeue
• CVE-url: https://ubuntu.com/security/CVE-2024-46757
  • hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
• CVE-url: https://ubuntu.com/security/CVE-2024-46758
  • hwmon: (lm95234) Fix underflows seen when writing limit attributes
• CVE-url: https://ubuntu.com/security/CVE-2024-46756
  • hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
• CVE-url: https://ubuntu.com/security/CVE-2024-40912
  • wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
• CVE-url: https://ubuntu.com/security/CVE-2024-46723
  • drm/amdgpu: fix ucode out-of-bounds read warning
• CVE-url: https://ubuntu.com/security/CVE-2024-46722
  • drm/amdgpu: fix mc_data out-of-bounds read warning
• Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479) // CVE- url: https://ubuntu.com/security/CVE-2022-48838
  • usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
• CVE-url: https://ubuntu.com/security/CVE-2021-47188
  • scsi: ufs: core: Improve SCSI abort handling
• Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479) // CVE- url: https://ubuntu.com/security/CVE-2022-48836
  • Input: aiptek - properly check endpoint type
• CVE-url: https://ubuntu.com/security/CVE-2024-26677
  • rxrpc: Fix delayed ACKs to not set the reference serial number
• Bionic update: upstream stable patchset 2021-12-13 (LP: #1954703) // CVE- url: https://ubuntu.com/security/CVE-2021-47181
  • usb: musb: tusb6010: check return value after calling platform_get_resource()

• drm/amd/pm: Fix negative array index read {CVE-2024-46821}
• drm/amd/display: Check gpio_id before used as array index {CVE-2024-46818}
• drm/amd/display: Check link_index before accessing dc->links[] {CVE-2024-46813}
• drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box {CVE-2024-46811}
• Squashfs: sanity check symbolic link size {CVE-2024-46744}
• platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses {CVE-2024-46859}
• net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() {CVE-2024-40995}
• net/sched: act_api: rely on rcu in tcf_idr_check_alloc {CVE-2024-40995}
• netfilter: bridge: confirm multicast packets before passing them up the stack {CVE-2024-27415}
• netfilter: let reset rules clean out conntrack entries {CVE-2024-27415}
• mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray {CVE-2024-42243}
• gpiolib: cdev: Fix use after free in lineinfo_changed_notify {CVE-2024-36899}
• bpf, sockmap: Prevent lock inversion deadlock in map delete elem {CVE-2024-35895}
• bpf, sockmap: Fix preempt_rt splat when using raw_spin_lock_t {CVE-2024-35895}
• mm/huge_memory: don't unpoison huge_zero_folio {CVE-2024-40914}
• cxgb4: fix use after free bugs caused by circular dependency problem {CVE-2023-4133}
• timers: Restore ABI Compatibility with timer_delete Functions {CVE-2023-4133}
• timers: Provide timer_shutdown_sync {CVE-2023-4133}
• timers: Add shutdown mechanism to the internal functions {CVE-2023-4133}
• timers: Split [try_to_]del_timer_sync to prepare for shutdown mode {CVE-2023-4133}
• timers: Silently ignore timers with a NULL function {CVE-2023-4133}
• timers: Rename del_timer() to timer_delete() {CVE-2023-4133}
• timers: Rename del_timer_sync() to timer_delete_sync() {CVE-2023-4133}
• timers: Use del_timer_sync() even on UP {CVE-2023-4133}
• timers: Update kernel-doc for various functions {CVE-2023-4133}
• timers: Replace BUG_ON()s {CVE-2023-4133}
• timers: Get rid of del_singleshot_timer_sync() {CVE-2023-4133}
• clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function {CVE-2023-4133}
• clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function {CVE-2023-4133}
• mm: avoid overflows in dirty throttling logic {CVE-2024-42131}
• ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
• igc: avoid returning frame twice in XDP_REDIRECT {CVE-2024-26853}
• igc: Avoid transmit queue timeout for XDP {CVE-2024-26853}
• nfsd: fix RELEASE_LOCKOWNER {CVE-2024-26629}
• tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc {CVE-2023-52880}
• nvmet: fix a possible leak when destroy a ctrl during qp establishment {CVE-2024-42152}
• net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() {CVE-2024-42110}
• x86: stop playing stack games in profile_pc() {CVE-2024-42096}
• xdp: Remove WARN() from __xdp_reg_mem_model() {CVE-2024-42082}
• NFSv4: Fix memory leak in nfs4_set_security_label {CVE-2024-41076}
• ppp: reject claimed-as-LCP but actually malformed packets {CVE-2024-41044}
• udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). {CVE-2024-41041}
• sched/deadline: Fix task_struct reference leak {CVE-2024-41023}
• tipc: force a dst refcount before doing decryption {CVE-2024-40983}
• scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978}
• wifi: iwlwifi: mvm: don't read past the mfuart notifcation {CVE-2024-40941}
• wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
• xhci: Handle TD clearing for multiple streams case {CVE-2024-40927}
• wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() {CVE-2024-40912}
• wifi: cfg80211: Lock wiphy in cfg80211_get_station {CVE-2024-40911}
• ipv6: fix possible race in __fib6_drop_pcpu_from() {CVE-2024-40905}
• md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING {CVE-2024-39476}
• usb-storage: alauda: Check whether the media is…

• ftrace: Fix possible use-after-free issue in ftrace_location() {CVE-2024-38588}
• ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() {CVE-2024-38588}
• ftrace: Store the order of pages allocated in ftrace_page {CVE-2024-38588}
• ftrace: Check if pages were allocated before calling free_pages() {CVE-2024-38588}
• net/sched: Fix UAF when resolving a clash {CVE-2024-41040}
• net/sched: act_ct: fix err check for nf_conntrack_confirm {CVE-2024-41040}
• netns: Make get_net_ns() handle zero refcount net {CVE-2024-40958}
• net/packet: fix packet_sock xmit return value checking {CVE-2022-20368}
• net/packet: fix slab-out-of-bounds access in packet_recvmsg() {CVE-2022-20368}
• af_packet: fix data-race in packet_setsockopt / packet_setsockopt {CVE-2022-20368}
• drm/amd/pm: Fix negative array index read {CVE-2024-46821}
• drm/amd/display: Check link_index before accessing dc->links[] {CVE-2024-46813}
• drm/amd/pm: fix the Out-of-bounds read warning {CVE-2024-46731}
• drm/amd/display: Check gpio_id before used as array index {CVE-2024-46818}
• Squashfs: sanity check symbolic link size {CVE-2024-46744}
• hwmon: (w83627ehf) Fix underflows seen when writing limit attributes {CVE-2024-46756}
• hwmon: (lm95234) Fix underflows seen when writing limit attributes {CVE-2024-46758}
• hwmon: (nct6775-core) Fix underflows seen when writing limit attributes {CVE-2024-46757}

• ftrace: Fix possible use-after-free issue in ftrace_location() {CVE-2024-38588}
• ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() {CVE-2024-38588}
• ftrace: Store the order of pages allocated in ftrace_page {CVE-2024-38588}
• ftrace: Check if pages were allocated before calling free_pages() {CVE-2024-38588}
• net/sched: Fix UAF when resolving a clash {CVE-2024-41040}
• net/sched: act_ct: fix err check for nf_conntrack_confirm {CVE-2024-41040}
• netns: Make get_net_ns() handle zero refcount net {CVE-2024-40958}
• net/packet: fix packet_sock xmit return value checking {CVE-2022-20368}
• net/packet: fix slab-out-of-bounds access in packet_recvmsg() {CVE-2022-20368}
• af_packet: fix data-race in packet_setsockopt / packet_setsockopt {CVE-2022-20368}
• drm/amd/pm: Fix negative array index read {CVE-2024-46821}
• drm/amd/display: Check link_index before accessing dc->links[] {CVE-2024-46813}
• drm/amd/pm: fix the Out-of-bounds read warning {CVE-2024-46731}
• drm/amd/display: Check gpio_id before used as array index {CVE-2024-46818}
• Squashfs: sanity check symbolic link size {CVE-2024-46744}
• hwmon: (w83627ehf) Fix underflows seen when writing limit attributes {CVE-2024-46756}
• hwmon: (lm95234) Fix underflows seen when writing limit attributes {CVE-2024-46758}
• hwmon: (nct6775-core) Fix underflows seen when writing limit attributes {CVE-2024-46757}

• drm/amdgpu: Validate TA binary size {CVE-2024-44977}
• drm/amd/display: Avoid overflow from uint32_t to uint8_t {CVE-2024-47661}
• scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info {CVE-2024-46842}
• ALSA: line6: Fix racy access to midibuf {CVE-2024-44954}
• exec: Fix ToCToU between perm check and set-uid/gid usage {CVE-2024-43882}
• drm/amd/display: Check link_index before accessing dc->links[] {CVE-2024-46813}
• drm/amdgpu/mes: fix mes ring buffer overflow {CVE-2024-46700}
• RDMA/iwcm: Fix a use-after-free related to destroying CM IDs {CVE-2024-42285}
• scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}
• ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
• drm/amdgpu: fix mc_data out-of-bounds read warning {CVE-2024-46722}
• ftrace: Fix possible use-after-free issue in ftrace_location() {CVE-2024-38588}
• ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() {CVE-2024-38588}
• ftrace: Store the order of pages allocated in ftrace_page {CVE-2024-38588}
• ftrace: Check if pages were allocated before calling free_pages() {CVE-2024-38588}
• x86/ibt,ftrace: Search for fentry location {CVE-2024-38588}
• drm/amdgpu: fix ucode out-of-bounds read warning {CVE-2024-46723}
• VMCI: Fix use-after-free when removing resource in vmci_resource_remove() {CVE-2024-46738}
• sch/netem: fix use after free in netem_dequeue {CVE-2024-46800}
• drm/amdgpu: Fix out-of-bounds write warning {CVE-2024-46725}
• drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number {CVE-2024-46724}
• Squashfs: sanity check symbolic link size {CVE-2024-46744}
• drm/amd/pm: Fix negative array index read {CVE-2024-46821}
• drm/amd/display: Check gpio_id before used as array index {CVE-2024-46818}
• KVM: x86: do not set st->preempted when going back to user space {CVE-2022-39189}
• net: Return errno in sk->sk_prot->get_port(). {CVE-2023-0461}
• drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box {CVE-2024-46811}
• ext4: do not create EA inode under buffer lock {CVE-2024-40972}
• ext4: fold quota accounting into ext4_xattr_inode_lookup_create() {CVE-2024-40972}
• ext4: check the return value of ext4_xattr_inode_dec_ref() {CVE-2024-40972}
• ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() {CVE-2024-40972}
• nvme: avoid double free special payload {CVE-2024-41073}
• drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL {CVE-2023-52817}
• wifi: mac80211: Avoid address calculations via out of bounds array indexing {CVE-2024-41071}
• mISDN: Fix a use after free in hfcmulti_tx() {CVE-2024-42280}
• tipc: Return non-zero value from tipc_udp_addr2str() on error {CVE-2024-42284}
• dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
• parport: Standardize use of printmode {CVE-2024-42301}
• parport: Convert printk(KERN_<LEVEL> to pr_<level> {CVE-2024-42301}
• parport: parport_pc: Mark expected switch fall-through {CVE-2024-42301}
• protect the fetch of ->fd[fd] in do_dup2() from mispredictions {CVE-2024-42265}
• leds: trigger: Unregister sysfs attributes before calling deactivate() {CVE-2024-43830}
• hwmon: (lm95234) Fix underflows seen when writing limit attributes {CVE-2024-46758}
• HID: amd_sfh: free driver_data after destroying hid device {CVE-2024-46746}
• hwmon: (adc128d818) Fix underflows seen when writing limit attributes {CVE-2024-46759}
• hwmon: (w83627ehf) Fix underflows seen when writing limit attributes {CVE-2024-46756}
• netns: Make get_net_ns() handle zero refcount net {CVE-2024-40958}
• net: make get_net_ns return error if NET_NS is disabled {CVE-2024-40958}
• mm, slub: fix potential memoryleak in kmem_cache_open() {CVE-2021-47466}
• slub: don't panic for memcg kmem cache creation failure {CVE-2021-47466}
• tunnels: fix out of bounds access when building IPv6 PMTU error {CVE-2024-26665}
• xfs: don't walk off the end of a directory data block {CVE-2024-42084}
• firmware: cs_dsp: Fix overflow checking of wmfw header {CVE-2024-41039}…

• sctp: sysctl: auth_enable: avoid using current->nsproxy
• sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy {CVE-2025-21640}
• bpf: Use preempt_count() directly in bpf_send_signal_common()
• Revert "sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy"
• jfs: fix slab-out-of-bounds read in ea_get()
• serial: 8250_dma: terminate correct DMA in tx_dma_flush()
• Revert "sctp: sysctl: auth_enable: avoid using current->nsproxy"
• net: usb: usbnet: restore usb%d name exception for local mac addresses
• vlan: fix memory leak in vlan_newlink() {CVE-2022-49636}
• rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity
• LTS tag: v5.4.291
• eeprom: digsy_mtc: Make GPIO lookup table match the device
• slimbus: messaging: Free transaction ID in delayed interrupt scenario {CVE-2025-21914}
• intel_th: pci: Add Panther Lake-P/U support
• intel_th: pci: Add Panther Lake-H support
• intel_th: pci: Add Arrow Lake support
• Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
• xhci: pci: Fix indentation in the PCI device ID definitions
• usb: gadget: Check bmAttributes only if configuration is valid
• usb: gadget: Fix setting self-powered state on suspend
• usb: gadget: Set self-powered based on MaxPower and bmAttributes
• usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality
• usb: typec: ucsi: increase timeout for PPM reset operations
• usb: atm: cxacru: fix a flaw in existing endpoint checks {CVE-2025-21916}
• usb: renesas_usbhs: Flush the notify_hotplug_work {CVE-2025-21917}
• usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader
• usb: renesas_usbhs: Use devm_usb_get_phy()
• usb: renesas_usbhs: Call clk_put()
• Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"
• gpio: rcar: Fix missing of_node_put() call
• net: ipv6: fix missing dst ref drop in ila lwtunnel
• net: ipv6: fix dst ref loop in ila lwtunnel
• net-timestamp: support TCP GSO case for a few missing flags
• vlan: enforce underlying device type {CVE-2025-21920}
• ppp: Fix KMSAN uninit-value warning with bpf {CVE-2025-21922}
• be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
• drm/sched: Fix preprocessor guard
• hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()
• llc: do not use skb_get() before dev_queue_xmit() {CVE-2025-21925}
• hwmon: (ad7314) Validate leading zero bits and return error
• hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
• hwmon: (pmbus) Initialise page count in pmbus_identify()
• caif_virtio: fix wrong pointer check in cfv_probe() {CVE-2025-21904}
• net: gso: fix ownership in __udp_gso_segment {CVE-2025-21926}
• HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
• HID: google: fix unused variable warning under !CONFIG_ACPI
• wifi: iwlwifi: limit printed string from FW file {CVE-2025-21905}
• mm/page_alloc: fix uninitialized variable
• rapidio: fix an API misues when rio_add_net() fails {CVE-2025-21934}
• rapidio: add check for rio_add_net() in rio_scan_alloc_net()
• wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
• wifi: cfg80211: regulatory: improve invalid hints checking {CVE-2025-21910}
• x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
• x86/cpu: Validate CPUID leaf 0x2 EDX output
• x86/cacheinfo: Validate CPUID leaf 0x2 EDX output
• platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
• drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
• ALSA: hda/realtek: update ALC222 depop optimize
• ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
• HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
• Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'"
• drm/amdgpu: disable BAR resize on Dell G5 SE
• drm/amdgpu: Check extended configuration space register when system uses large bar
• drm/amdgpu: skip BAR resizing if the bios already…

• fbcon: Fix OOB access in font allocation {CVE-2025-39967}
• fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
• macvlan: observe an RCU grace period in macvlan_common_newlink() error path {CVE-2026-23273}
• macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• net_sched: sch_sfq: move the limit validation {CVE-2025-37752}
• bpf: Fix oob access in cgroup local storage {CVE-2025-38502}
• ftrace: Fix possible use-after-free issue in ftrace_location() {CVE-2024-38588}
• driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT {CVE-2026-43475}
• unshare: fix unshare_fs() handling {CVE-2026-43472}
• netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path {CVE-2026-43451}
• nvme-pci: Fix race bug in nvme_poll_irqdisable() {CVE-2026-43448}
• e1000/e1000e: Fix leak in DMA error cleanup {CVE-2026-43445}
• cgroup: fix race between task migration and iteration {CVE-2026-43439}
• ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces {CVE-2026-43436}
• usb: image: mdc800: kill download URB on timeout {CVE-2026-43425}
• tipc: fix divide-by-zero in tipc_sk_filter_connect() {CVE-2026-43411}
• nouveau/dpcd: return EBUSY for aux xfer if the device is asleep {CVE-2026-43381}
• ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() {CVE-2026-43068}
• netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP {CVE-2026-31424}
• net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() {CVE-2026-31423}
• net/sched: cls_flow: fix NULL pointer dereference on shared blocks {CVE-2026-31422}
• net/sched: cls_fw: fix NULL pointer dereference on shared blocks {CVE-2026-31421}
• netfilter: ipset: drop logically empty buckets in mtype_del {CVE-2026-31418}
• netfilter: nfnetlink_log: account for netlink header size {CVE-2026-31416}
• sunrpc: fix cache_request leak in cache_release {CVE-2026-31400}
• PM: runtime: Fix a race condition related to device removal {CVE-2026-23452}
• net: usb: kaweth: validate USB endpoints {CVE-2026-23312}
• nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449}
• netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() {CVE-2026-43453}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• RDMA/umem: Fix double dma_buf_unpin in failure path {CVE-2026-43128}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown {CVE-2026-23454}
• netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() {CVE-2025-38441}
• nvmet: fix memory leak of bio integrity {CVE-2025-38405}
• nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. {CVE-2025-38400}
• dmaengine: idxd: fix memory leak in error handling path of idxd_alloc {CVE-2025-38015}
• bonding: check xdp prog when set bond mode {CVE-2025-22105}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD {CVE-2026-31428}
• netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp {CVE-2026-31427}
• ipv6: avoid overflows in ip6_datagram_send_ctl() {CVE-2026-31415}
• net: atm: fix crash due to unvalidated vcc pointer in sigd_send() {CVE-2026-31411}
• RDMA/umad: Reject negative data_len in ib_umad_write {CVE-2026-23243}
• perf/x86/intel/uncore: Fix die ID init and look up bugs {CVE-2026-43344}
• x86/apic: Disable x2apic on resume if the kernel expects so {CVE-2026-43363}
• dm: remove fake timeout to avoid leak request {CVE-2026-43314}
• drm: Account property blob allocations to memcg {CVE-2026-43287}
• HID:…

• Bump kernel ABI to 29: ship the ELS kernel as 4.19.0-29-*, distinct from the prior 4.19.0-28.
• CVE-2021-46984
  • kyber: fix out of bounds access when preempted {CVE-2021-46984}
• CVE-2021-47049
  • Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}
• CVE-2021-47101
  • asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
• CVE-2021-47191
  • scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• CVE-2021-47352
  • virtio-net: Add validation for used length {CVE-2021-47352}
• CVE-2021-47379
  • blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd {CVE-2021-47379}
• CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests {CVE-2021-47391}
• CVE-2021-47479
  • staging: rtl8712: fix use-after-free in rtl8712_dl_fw {CVE-2021-47479}
• CVE-2022-21546
  • scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• CVE-2022-39189
  • KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• CVE-2022-43945
  • SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
  • NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2022-49026
  • e100: Fix possible use after free in e100_xmit_prepare {CVE-2022-49026}
• CVE-2022-49720
  • block: Fix handling of offline queues in blk_mq_alloc_request_hctx() {CVE-2022-49720}
• CVE-2022-49975
  • bpf: Don't redirect packets with invalid pkt_len {CVE-2022-49975}
  • bpf: Move skb->len == 0 checks into __bpf_redirect {CVE-2022-49975}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2022-50103
  • sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• CVE-2022-50129
  • RDMA/srpt: Introduce a reference count in struct srpt_device {CVE-2022-50129}
  • RDMA/srpt: Fix a use-after-free {CVE-2022-50129}
• CVE-2022-50300
  • btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300}
• CVE-2022-50406
  • iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50552
  • blk-mq: use quiesced elevator switch when reinitializing queues {CVE-2022-50552}
• CVE-2023-51779
  • Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
• CVE-2023-52434
  • smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• CVE-2023-52515
  • RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
• CVE-2023-52531
  • wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
• CVE-2023-52741
  • cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
• CVE-2023-53000
  • netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• CVE-2023-53039
  • workqueue: Add resource managed version of delayed work init {CVE-2023-53039}
  • devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc {CVE-2023-53039}
  • devm-helpers: Add resource managed version of work init {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc {CVE-2023-53039}
• CVE-2023-53111
  • loop: Fix use-after-free issues {CVE-2023-53111}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels…

Upstream kernel version 6.6.37 fix bugs and vulnerabilities. The dwarves, kmod-virtualbox and kmod-xtables-addons packages have been updated to work with this new kernel. For information about the vulnerabilities see the links.

Vanilla upstream kernel version 6.6.37 fix bugs and vulnerabilities. For information about the vulnerabilities see the links.

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-39371: io_uring: check for non-NULL file pointer in io_file_can_poll() (bsc#1226990).
• CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
• CVE-2024-38610: drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() (bsc#1226758).
• CVE-2024-37354: btrfs: fix crash on racing fsync and size-extending write into prealloc (bsc#1227101).
• CVE-2024-36919: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (bsc#1225767).
• CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
• CVE-2024-38570: gfs2: Fix potential glock use-after-free on unmount (bsc#1226775).
• CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
• CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
• CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595).
• CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
• CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
• CVE-2023-52865: Add check for mtk_alloc_clk_data (bsc#1225086).
• CVE-2023-52821: Fixed a possible null pointer dereference (bsc#1225022).
• CVE-2023-52867: Fixed possible buffer overflow (bsc#1225009).
• CVE-2024-38578: ecryptfs: Fix buffer size for tag 66 packet (bsc#1226634,).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
• CVE-2023-52759: Ignore negated quota changes (bsc#1225560).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52864: Fixed opening of char device (bsc#1225132).
• CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).
• CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).
• CVE-2024-39301: net/9p: fix uninit-value in p9_client_rpc() (bsc#1226994).
• CVE-2024-35843: iommu/vt-d: Use device rbtree in iopf reporting path (bsc#1224751).
• CVE-2024-37078: nilfs2: fix potential kernel bug due to lack of writeback flag waiting (bsc#1227066).
• CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
• CVE-2024-36479: fpga: bridge: add owner module and take its refcount (bsc#1226949).
• CVE-2024-37021: fpga: manager: add owner module and take its refcount (bsc#1226950).
• CVE-2024-36281: net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules (bsc#1226799).
• CVE-2024-38580: epoll: be better about file lifetimes (bsc#1226610).
• CVE-2024-36478: null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' (bsc#1226841).
• CVE-2024-38636: f2fs: multidev: fix to recognize valid zero block address (bsc#1226879).
• CVE-2024-38661: s390/ap: Fix crash in AP internal function modify_bitmap() (bsc#1226996).
• CVE-2024-38564: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (bsc#1226789).
• CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).
• CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
• CVE-2024-36917: block: fix overflow in blk_ioctl_discard() (bsc#1225770).
• CVE-2024-38627: stm class: Fix a double free in stm_register_device() (bsc#1226857).
• CVE-2024-38603: drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset() (bsc#1226842).
• CVE-2024-38553: net: fec: remove .ndo_poll_controller to avoid deadlock (bsc#1226744).
• CVE-2024-38555: net/mlx5: Discard command completions in internal error (bsc#1226607).
• CVE-2024-38556:…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47186: tipc: check for null after calling kmemdup (bsc#1222702).
• CVE-2021-47546: Kabi fix for ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
• CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
• CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
• CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571)
• CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len (bsc#1226555).
• CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
• CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
• CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
• CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071)
• CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869)
• CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52812: drm/amd: check num of link levels when update pcie param (bsc#1225564).
• CVE-2023-52857: drm/mediatek: Fix coverity issue with unintentional integer overflow (bsc#1225581).
• CVE-2023-52863: hwmon: (axi-fan-control) Fix possible NULL pointer dereference (bsc#1225586).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
• CVE-2024-26633: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (bsc#1221647).
• CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2 (bsc#1221656).
• CVE-2024-26636: llc: make llc_ui_sendmsg() more robust against bonding changes (bsc#1221659).
• CVE-2024-26641: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() (bsc#1221654).
• CVE-2024-26661: drm/amd/display: Add NULL test for 'timing generator' in (bsc#1222323)
• CVE-2024-26663: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (bsc#1222326).
• CVE-2024-26665: tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328).
• CVE-2024-26802: stmmac: Clear variable when destroying workqueue (bsc#1222799).
• CVE-2024-26863: hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021).
• CVE-2024-26961: mac802154: fix llsec key resources release in mac802154_llsec_key_del (bsc#1223652).
• CVE-2024-27015: netfilter: flowtable: incorrect pppoe tuple (bsc#1223806).
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27025: nbd: null check for nla_nest_start (bsc#1223778)
• CVE-2024-27065: netfilter: nf_tables: do not compare internal table flags on updates (bsc#1223836).
• CVE-2024-27402: phonet/pep: fix racy skb_queue_empty() use (bsc#1224414).
• CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
• CVE-2024-40948: mm/page_table_check: fix crash on ZONE_DEVICE (bsc#1227801). -…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
• CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958).
• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47186: tipc: check for null after calling kmemdup (bsc#1222702).
• CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
• CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
• CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
• CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
• CVE-2021-47546: ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
• CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
• CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
• CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
• CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571).
• CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len. (bsc#1226555).
• CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
• CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
• CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
• CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
• CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071).
• CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869).
• CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
• CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
• CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52787: blk-mq: make…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47186: ipc: check for null after calling kmemdup (bsc#1222702).
• CVE-2021-47546: Kabi fix for ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
• CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
• CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
• CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571)
• CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len (bsc#1226555).
• CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
• CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
• CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
• CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071)
• CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869)
• CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52812: drm/amd: check num of link levels when update pcie param (bsc#1225564).
• CVE-2023-52857: drm/mediatek: Fix coverity issue with unintentional integer overflow (bsc#1225581).
• CVE-2023-52863: hwmon: (axi-fan-control) Fix possible NULL pointer dereference (bsc#1225586).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
• CVE-2024-26633: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (bsc#1221647).
• CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2 (bsc#1221656).
• CVE-2024-26636: llc: make llc_ui_sendmsg() more robust against bonding changes (bsc#1221659).
• CVE-2024-26641: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() (bsc#1221654).
• CVE-2024-26661: drm/amd/display: Add NULL test for 'timing generator' in (bsc#1222323)
• CVE-2024-26663: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (bsc#1222326).
• CVE-2024-26665: tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328).
• CVE-2024-26802: stmmac: Clear variable when destroying workqueue (bsc#1222799).
• CVE-2024-26863: hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021).
• CVE-2024-26961: mac802154: fix llsec key resources release in mac802154_llsec_key_del (bsc#1223652).
• CVE-2024-27015: netfilter: flowtable: incorrect pppoe tuple (bsc#1223806).
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27025: nbd: null check for nla_nest_start (bsc#1223778)
• CVE-2024-27065: netfilter: nf_tables: do not compare internal table flags on updates (bsc#1223836).
• CVE-2024-27402: phonet/pep: fix racy skb_queue_empty() use (bsc#1224414).
• CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-38417: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225600).
• CVE-2023-47210: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225601).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52458: Fixed check that partition length needs to be aligned with block size (bsc#1220428).
• CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52631: Fixed an NULL dereference bug (bsc#1222264 CVE-2023-52631).
• CVE-2023-52640: Fixed out-of-bounds in ntfs_listxattr (bsc#1222301).
• CVE-2023-52641: Fixed NULL ptr dereference checking at the end of attr_allocate_frame() (bsc#1222303)
• CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
• CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52659: Fixed to pfn_to_kaddr() not treated as a 64-bit type (bsc#1224442)
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52699: sysv: don't call sb_bread() with pointers_lock held (bsc#1224659).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52771: Fixed delete_endpoint() vs parent unregistration race (bsc#1225007).
• CVE-2023-52772: Fixed use-after-free in unix_stream_read_actor() (bsc#1224989).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52786: ext4: fix racy may inline data check in dio write (bsc#1224939).
• CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
• CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
• CVE-2023-52855: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (bsc#1225583).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2023-6238: Fixed kcalloc() arguments order (bsc#1217384).
• CVE-2024-21823: Fixed safety flag to struct ends (bsc#1223625).
• CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
• CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
• CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
• CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
• CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
• CVE-2024-26623: pds_core: Prevent race issues involving the adminq (bsc#1221057).
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086) -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47212: net/mlx5: Update error handler for UCTX and UMEM (bsc#1222709).
• CVE-2021-47455: ptp: Fix possible memory leak in ptp_clock_register() (bsc#1225254).
• CVE-2021-47527: serial: core: fix transmit-buffer reset and memleak (bsc#1227768).
• CVE-2022-21546: scsi: target: Fix WRITE_SAME No Data Buffer crash (bsc#1242243).
• CVE-2022-49154: KVM: SVM: fix panic on out-of-bounds guest IRQ (bsc#1238167).
• CVE-2022-49622: netfilter: nf_tables: fix crash when nf_trace is enabled (bsc#1239042).
• CVE-2022-49731: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (bsc#1239071).
• CVE-2022-49764: kABI: workaround 'bpf: Prevent bpf program recursion for raw tracepoint probes' changes (bsc#1242301).
• CVE-2022-49780: scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() (bsc#1242262).
• CVE-2022-49814: kcm: close race conditions on sk_receive_queue (bsc#1242498).
• CVE-2022-49879: ext4: fix BUG_ON() when directory entry has invalid rec_len (bsc#1242733).
• CVE-2022-49881: wifi: cfg80211: fix memory leak in query_regdb_file() (bsc#1242481).
• CVE-2022-49917: ipvs: fix WARNING in ip_vs_app_net_cleanup() (bsc#1242406).
• CVE-2022-49921: net: sched: Fix use after free in red_enqueue() (bsc#1242359).
• CVE-2022-50055: iavf: Fix adminq error handling (bsc#1245039).
• CVE-2022-50087: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (bsc#1245119).
• CVE-2022-50134: RDMA/hfi1: fix potential memory leak in setup_base_ctxt() (bsc#1244802).
• CVE-2022-50200: selinux: Add boundary check in put_entry() (bsc#1245149).
• CVE-2023-52500: Fixed information leaking when processing OPC_INB_SET_CONTROLLER_CONFIG command (bsc#1220883).
• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2023-53020: l2tp: fix lockdep splat (bsc#1240224).
• CVE-2023-53090: drm/amdkfd: Fix an illegal memory access (bsc#1242753).
• CVE-2023-53091: ext4: update s_journal_inum if it changes after journal replay (bsc#1242767).
• CVE-2023-53133: bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() (bsc#1242423).
• CVE-2024-26586: mlxsw: spectrum_acl_tcam: Fix stack corruption (bsc#1220243).
• CVE-2024-26825: nfc: nci: free rx_data_reassembly skb on NCI device cleanup (bsc#1223065).
• CVE-2024-26872: RDMA/srpt: Do not register event handler until srpt device is fully setup (bsc#1223115).
• CVE-2024-26875: media: pvrusb2: fix uaf in pvr2_context_set_notify (bsc#1223118).
• CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (bsc#1224712).
• CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).
• CVE-2024-38588: ftrace: Fix possible use-after-free issue in ftrace_location() (bsc#1226837).
• CVE-2024-57982: xfrm: state: fix out-of-bounds read during lookup (bsc#1237913).
• CVE-2025-21898: ftrace: Avoid potential division by zero in function_stat_show() (bsc#1240610).
• CVE-2025-21920: vlan: enforce underlying device type (bsc#1240686).
• CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
• CVE-2025-22035: tracing: Fix use-after-free in print_graph_function_flags during tracer switching (bsc#1241544).
• CVE-2025-23149: tpm: do not start chip while suspended (bsc#1242758).
• CVE-2025-37756: net: tls: explicitly disallow disconnect (bsc#1242515).
• CVE-2025-37757: tipc: fix memory leak in tipc_link_xmit (bsc#1242521).
• CVE-2025-37781: i2c: cros-ec-tunnel: defer probe if parent EC is not present (bsc#1242575).
• CVE-2025-37800: driver core: fix potential NULL pointer dereference in dev_uevent() (bsc#1242849).
• CVE-2025-37810: usb: dwc3: gadget: check that event count does not exceed event buffer length (bsc#1242906).
• CVE-2025-37836: PCI: Fix reference…

The SUSE Linux Enterprise Micro 6.0 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
• CVE-2024-40948: mm/page_table_check: fix crash on ZONE_DEVICE (bsc#1227801).
• CVE-2024-35890:…

The SUSE Linux Enterprise Micro 6.0 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• M68K architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• Bluetooth drivers;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• DPLL subsystem;
• FireWire subsystem;
• EFI core;
• Qualcomm firmware drivers;
• GPIO subsystem;
• GPU drivers;
• Microsoft Hyper-V drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• EEPROM drivers;
• MMC subsystem;
• Network drivers;
• STMicroelectronics network drivers;
• Device tree and open firmware driver;
• HiSilicon SoC PMU drivers;
• PHY drivers;
• Pin controllers subsystem;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI drivers;
• SPI subsystem;
• Media staging drivers;
• Thermal drivers;
• Userspace I/O drivers;
• USB subsystem;
• DesignWare USB3 driver;
• ACRN Hypervisor Service Module driver;
• Virtio drivers;
• 9P distributed file system;
• BTRFS file system;
• eCrypt file system;
• EROFS file system;
• File systems infrastructure;
• GFS2 file system;
• JFFS2 file system;
• Network file systems library;
• Network file system client;
• Network file system server daemon;
• NILFS2 file system;
• Proc file system;
• SMB network file system;
• Tracing file system;
• Mellanox drivers;
• Memory management;
• Socket messages infrastructure;
• Slab allocator;
• Tracing infrastructure;
• User-space API (UAPI);
• Core kernel;
• BPF subsystem;
• DMA mapping infrastructure;
• RCU subsystem;
• Dynamic debug library;
• KUnit library;
• Maple Tree data structure library;
• Heterogeneous memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• NSH protocol;
• Open vSwitch;
• Phonet protocol;
• SMC sockets;
• TIPC protocol;
• Unix domain sockets;
• Wireless networking;
• Key management;
• ALSA framework;
• HD-audio driver;
• Kirkwood ASoC drivers;
• MediaTek ASoC drivers; (CVE-2024-36006, CVE-2024-36922, CVE-2024-38567, CVE-2024-38584, CVE-2024-36923, CVE-2024-36892, CVE-2024-35855, CVE-2024-35853, CVE-2024-38562, CVE-2024-36920, CVE-2024-38543, CVE-2024-38576, CVE-2024-38572, CVE-2024-36898, CVE-2024-38560, CVE-2024-36004, CVE-2024-36956, CVE-2024-36881, CVE-2024-36977, CVE-2024-36955, CVE-2024-36906, CVE-2024-36013, CVE-2024-36884, CVE-2024-38563, CVE-2024-36966, CVE-2024-38547, CVE-2024-38594, CVE-2024-36926, CVE-2024-38587, CVE-2024-38566, CVE-2024-27400, CVE-2024-36941, CVE-2024-36017, CVE-2024-38544, CVE-2024-36899, CVE-2024-35851, CVE-2024-38577, CVE-2024-38590, CVE-2024-38568, CVE-2024-38559, CVE-2024-38611, CVE-2024-36887, CVE-2024-36886, CVE-2024-35996, CVE-2024-38612, CVE-2024-36925, CVE-2024-38586, CVE-2024-38596, CVE-2024-36932, CVE-2024-39482, CVE-2024-38585, CVE-2024-36033, CVE-2024-38614, CVE-2024-35852, CVE-2024-36908, CVE-2024-36939, CVE-2024-36963, CVE-2024-27401, CVE-2024-36029, CVE-2024-38540, CVE-2024-38565, CVE-2024-36927, CVE-2024-36910, CVE-2024-42134, CVE-2024-36888, CVE-2024-35859, CVE-2024-36911, CVE-2024-35947, CVE-2024-36940, CVE-2024-36921, CVE-2024-36913, CVE-2024-36943, CVE-2024-35986, CVE-2024-38616, CVE-2024-36900, CVE-2024-36954, CVE-2024-36915, CVE-2024-38602, CVE-2024-41011, CVE-2024-35991, CVE-2024-36909, CVE-2024-38603, CVE-2023-52882, CVE-2024-36953, CVE-2024-38599, CVE-2024-38574, CVE-2024-36967, CVE-2024-36895, CVE-2024-36003,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• M68K architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• Bluetooth drivers;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• DPLL subsystem;
• FireWire subsystem;
• EFI core;
• Qualcomm firmware drivers;
• GPIO subsystem;
• GPU drivers;
• Microsoft Hyper-V drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• EEPROM drivers;
• MMC subsystem;
• Network drivers;
• STMicroelectronics network drivers;
• Device tree and open firmware driver;
• HiSilicon SoC PMU drivers;
• PHY drivers;
• Pin controllers subsystem;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI drivers;
• SPI subsystem;
• Media staging drivers;
• Thermal drivers;
• Userspace I/O drivers;
• USB subsystem;
• DesignWare USB3 driver;
• ACRN Hypervisor Service Module driver;
• Virtio drivers;
• 9P distributed file system;
• BTRFS file system;
• eCrypt file system;
• EROFS file system;
• File systems infrastructure;
• GFS2 file system;
• JFFS2 file system;
• Network file systems library;
• Network file system client;
• Network file system server daemon;
• NILFS2 file system;
• Proc file system;
• SMB network file system;
• Tracing file system;
• Mellanox drivers;
• Memory management;
• Socket messages infrastructure;
• Slab allocator;
• Tracing infrastructure;
• User-space API (UAPI);
• Core kernel;
• BPF subsystem;
• DMA mapping infrastructure;
• RCU subsystem;
• Dynamic debug library;
• KUnit library;
• Maple Tree data structure library;
• Heterogeneous memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• NSH protocol;
• Open vSwitch;
• Phonet protocol;
• SMC sockets;
• TIPC protocol;
• Unix domain sockets;
• Wireless networking;
• Key management;
• ALSA framework;
• HD-audio driver;
• Kirkwood ASoC drivers;
• MediaTek ASoC drivers; (CVE-2024-36006, CVE-2024-36922, CVE-2024-38567, CVE-2024-38584, CVE-2024-36923, CVE-2024-36892, CVE-2024-35855, CVE-2024-35853, CVE-2024-38562, CVE-2024-36920, CVE-2024-38543, CVE-2024-38576, CVE-2024-38572, CVE-2024-36898, CVE-2024-38560, CVE-2024-36004, CVE-2024-36956, CVE-2024-36881, CVE-2024-36977, CVE-2024-36955, CVE-2024-36906, CVE-2024-36013, CVE-2024-36884, CVE-2024-38563, CVE-2024-36966, CVE-2024-38547, CVE-2024-38594, CVE-2024-36926, CVE-2024-38587, CVE-2024-38566, CVE-2024-27400, CVE-2024-36941, CVE-2024-36017, CVE-2024-38544, CVE-2024-36899, CVE-2024-35851, CVE-2024-38577, CVE-2024-38590, CVE-2024-38568, CVE-2024-38559, CVE-2024-38611, CVE-2024-36887, CVE-2024-36886, CVE-2024-35996, CVE-2024-38612, CVE-2024-36925, CVE-2024-38586, CVE-2024-38596, CVE-2024-36932, CVE-2024-39482, CVE-2024-38585, CVE-2024-36033, CVE-2024-38614, CVE-2024-35852, CVE-2024-36908, CVE-2024-36939, CVE-2024-36963, CVE-2024-27401, CVE-2024-36029, CVE-2024-38540, CVE-2024-38565, CVE-2024-36927, CVE-2024-36910, CVE-2024-42134, CVE-2024-36888, CVE-2024-35859, CVE-2024-36911, CVE-2024-35947, CVE-2024-36940, CVE-2024-36921, CVE-2024-36913, CVE-2024-36943, CVE-2024-35986, CVE-2024-38616, CVE-2024-36900, CVE-2024-36954, CVE-2024-36915, CVE-2024-38602, CVE-2024-41011, CVE-2024-35991, CVE-2024-36909, CVE-2024-38603, CVE-2023-52882, CVE-2024-36953, CVE-2024-38599, CVE-2024-38574, CVE-2024-36967, CVE-2024-36895, CVE-2024-36003,…

Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde discovered that an untrusted hypervisor could inject malicious #VC interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw is known as WeSee. A local attacker in control of the hypervisor could use this to expose sensitive information or possibly execute arbitrary code in the trusted execution environment. (CVE-2024-25742)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• M68K architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• Bluetooth drivers;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• DPLL subsystem;
• FireWire subsystem;
• EFI core;
• Qualcomm firmware drivers;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Microsoft Hyper-V drivers;
• I2C subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• EEPROM drivers;
• MMC subsystem;
• Network drivers;
• STMicroelectronics network drivers;
• Device tree and open firmware driver;
• HiSilicon SoC PMU drivers;
• PHY drivers;
• Pin controllers subsystem;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI drivers;
• SPI subsystem;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB subsystem;
• DesignWare USB3 driver;
• ACRN Hypervisor Service Module driver;
• Virtio drivers;
• 9P distributed file system;
• BTRFS file system;
• eCrypt file system;
• EROFS file system;
• File systems infrastructure;
• GFS2 file system;
• JFFS2 file system;
• Network file systems library;
• Network file system client;
• Network file system server daemon;
• NILFS2 file system;
• Proc file system;
• SMB network file system;
• Tracing file system;
• Mellanox drivers;
• Memory management;
• Socket messages infrastructure;
• Slab allocator;
• Tracing infrastructure;
• User-space API (UAPI);
• Core kernel;
• BPF subsystem;
• DMA mapping infrastructure;
• RCU subsystem;
• Dynamic debug library;
• KUnit library;
• Maple Tree data structure library;
• Heterogeneous memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• NSH protocol;
• Open vSwitch;
• Phonet protocol;
• SMC sockets;
• TIPC protocol;
• Unix domain sockets;
• Wireless networking;
• Key management;
• ALSA framework;
• HD-audio driver;
• Kirkwood ASoC drivers;
• MediaTek ASoC drivers; (CVE-2024-38601, CVE-2024-36935, CVE-2024-35991, CVE-2024-36032, CVE-2024-35988, CVE-2024-36886, CVE-2024-36913, CVE-2024-36928, CVE-2024-38553, CVE-2024-36927, CVE-2024-38615, CVE-2024-36958, CVE-2024-36977, CVE-2024-36889, CVE-2024-38554, CVE-2024-38590, CVE-2024-42134, CVE-2024-35857, CVE-2024-35850, CVE-2024-35986, CVE-2024-36921, CVE-2024-38569, CVE-2024-36966, CVE-2024-38542, CVE-2024-38585, CVE-2024-36884, CVE-2024-36006, CVE-2024-38577, CVE-2024-36016, CVE-2024-38584, CVE-2024-36887, CVE-2024-38598, CVE-2024-35994, CVE-2024-38603, CVE-2024-35998, CVE-2024-27401, CVE-2024-35852, CVE-2024-36944, CVE-2024-38572, CVE-2024-36917, CVE-2024-36943, CVE-2024-36009, CVE-2024-38587, CVE-2024-35949, CVE-2024-36945, CVE-2024-36004, CVE-2024-36919, CVE-2024-27398, CVE-2024-38582, CVE-2024-35847, CVE-2024-38580, CVE-2024-38602, CVE-2024-36916, CVE-2024-36903, CVE-2024-38555, CVE-2024-36952, CVE-2024-38589, CVE-2024-27394, CVE-2024-36933,…

Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde discovered that an untrusted hypervisor could inject malicious #VC interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw is known as WeSee. A local attacker in control of the hypervisor could use this to expose sensitive information or possibly execute arbitrary code in the trusted execution environment. (CVE-2024-25742)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• M68K architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• Bluetooth drivers;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• DPLL subsystem;
• FireWire subsystem;
• EFI core;
• Qualcomm firmware drivers;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Microsoft Hyper-V drivers;
• I2C subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• EEPROM drivers;
• MMC subsystem;
• Network drivers;
• STMicroelectronics network drivers;
• Device tree and open firmware driver;
• HiSilicon SoC PMU drivers;
• PHY drivers;
• Pin controllers subsystem;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI drivers;
• SPI subsystem;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB subsystem;
• DesignWare USB3 driver;
• ACRN Hypervisor Service Module driver;
• Virtio drivers;
• 9P distributed file system;
• BTRFS file system;
• eCrypt file system;
• EROFS file system;
• File systems infrastructure;
• GFS2 file system;
• JFFS2 file system;
• Network file systems library;
• Network file system client;
• Network file system server daemon;
• NILFS2 file system;
• Proc file system;
• SMB network file system;
• Tracing file system;
• Mellanox drivers;
• Memory management;
• Socket messages infrastructure;
• Slab allocator;
• Tracing infrastructure;
• User-space API (UAPI);
• Core kernel;
• BPF subsystem;
• DMA mapping infrastructure;
• RCU subsystem;
• Dynamic debug library;
• KUnit library;
• Maple Tree data structure library;
• Heterogeneous memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• NSH protocol;
• Open vSwitch;
• Phonet protocol;
• SMC sockets;
• TIPC protocol;
• Unix domain sockets;
• Wireless networking;
• Key management;
• ALSA framework;
• HD-audio driver;
• Kirkwood ASoC drivers;
• MediaTek ASoC drivers; (CVE-2024-38601, CVE-2024-36935, CVE-2024-35991, CVE-2024-36032, CVE-2024-35988, CVE-2024-36886, CVE-2024-36913, CVE-2024-36928, CVE-2024-38553, CVE-2024-36927, CVE-2024-38615, CVE-2024-36958, CVE-2024-36977, CVE-2024-36889, CVE-2024-38554, CVE-2024-38590, CVE-2024-42134, CVE-2024-35857, CVE-2024-35850, CVE-2024-35986, CVE-2024-36921, CVE-2024-38569, CVE-2024-36966, CVE-2024-38542, CVE-2024-38585, CVE-2024-36884, CVE-2024-36006, CVE-2024-38577, CVE-2024-36016, CVE-2024-38584, CVE-2024-36887, CVE-2024-38598, CVE-2024-35994, CVE-2024-38603, CVE-2024-35998, CVE-2024-27401, CVE-2024-35852, CVE-2024-36944, CVE-2024-38572, CVE-2024-36917, CVE-2024-36943, CVE-2024-36009, CVE-2024-38587, CVE-2024-35949, CVE-2024-36945, CVE-2024-36004, CVE-2024-36919, CVE-2024-27398, CVE-2024-38582, CVE-2024-35847, CVE-2024-38580, CVE-2024-38602, CVE-2024-36916, CVE-2024-36903, CVE-2024-38555, CVE-2024-36952, CVE-2024-38589, CVE-2024-27394, CVE-2024-36933,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• M68K architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• Bluetooth drivers;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• DPLL subsystem;
• FireWire subsystem;
• EFI core;
• Qualcomm firmware drivers;
• GPIO subsystem;
• GPU drivers;
• Microsoft Hyper-V drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• EEPROM drivers;
• MMC subsystem;
• Network drivers;
• STMicroelectronics network drivers;
• Device tree and open firmware driver;
• HiSilicon SoC PMU drivers;
• PHY drivers;
• Pin controllers subsystem;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI drivers;
• SPI subsystem;
• Media staging drivers;
• Thermal drivers;
• Userspace I/O drivers;
• USB subsystem;
• DesignWare USB3 driver;
• ACRN Hypervisor Service Module driver;
• Virtio drivers;
• 9P distributed file system;
• BTRFS file system;
• eCrypt file system;
• EROFS file system;
• File systems infrastructure;
• GFS2 file system;
• JFFS2 file system;
• Network file systems library;
• Network file system client;
• Network file system server daemon;
• NILFS2 file system;
• Proc file system;
• SMB network file system;
• Tracing file system;
• Mellanox drivers;
• Memory management;
• Socket messages infrastructure;
• Slab allocator;
• Tracing infrastructure;
• User-space API (UAPI);
• Core kernel;
• BPF subsystem;
• DMA mapping infrastructure;
• RCU subsystem;
• Dynamic debug library;
• KUnit library;
• Maple Tree data structure library;
• Heterogeneous memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• NSH protocol;
• Open vSwitch;
• Phonet protocol;
• SMC sockets;
• TIPC protocol;
• Unix domain sockets;
• Wireless networking;
• Key management;
• ALSA framework;
• HD-audio driver;
• Kirkwood ASoC drivers;
• MediaTek ASoC drivers; (CVE-2024-35987, CVE-2024-36931, CVE-2024-38614, CVE-2024-35857, CVE-2024-36949, CVE-2024-38599, CVE-2024-35994, CVE-2024-35849, CVE-2024-36916, CVE-2024-38590, CVE-2024-36944, CVE-2024-38561, CVE-2024-38538, CVE-2024-36017, CVE-2024-38593, CVE-2024-36028, CVE-2024-36960, CVE-2024-36002, CVE-2024-36967, CVE-2024-36898, CVE-2024-35989, CVE-2024-36975, CVE-2024-38578, CVE-2024-38582, CVE-2024-38588, CVE-2024-38579, CVE-2024-38617, CVE-2024-36901, CVE-2024-38550, CVE-2023-52882, CVE-2024-38603, CVE-2024-38620, CVE-2024-36956, CVE-2024-36880, CVE-2024-36895, CVE-2024-36979, CVE-2024-36887, CVE-2024-27396, CVE-2024-27400, CVE-2024-36952, CVE-2024-36886, CVE-2024-36905, CVE-2024-36883, CVE-2024-38540, CVE-2024-38605, CVE-2024-36029, CVE-2024-36934, CVE-2024-27395, CVE-2024-36000, CVE-2024-38549, CVE-2024-35999, CVE-2024-38585, CVE-2024-38589, CVE-2024-38565, CVE-2024-36917, CVE-2024-36930, CVE-2024-36940, CVE-2024-36900, CVE-2024-35850, CVE-2024-38592, CVE-2024-38553, CVE-2024-36929, CVE-2024-36915, CVE-2024-36004, CVE-2024-38573, CVE-2024-36941, CVE-2024-38607, CVE-2024-36009, CVE-2024-27398, CVE-2024-36909, CVE-2024-35848, CVE-2024-36950, CVE-2024-38564, CVE-2024-36947, CVE-2024-38613, CVE-2024-38570, CVE-2024-38612, CVE-2024-38580, CVE-2024-38557, CVE-2024-36959, CVE-2024-27399, CVE-2024-41011, CVE-2024-36928, CVE-2024-38543, CVE-2024-38541, CVE-2024-38583, CVE-2024-35855, CVE-2024-38611, CVE-2024-36891,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• M68K architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Accessibility subsystem;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Pin controllers subsystem;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• eCrypt file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFFS2 file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• IOMMU subsystem;
• Memory management;
• Netfilter;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• Multipath TCP;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Network traffic control;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• ALSA framework;
• SoC Audio for Freescale CPUs drivers;
• Kirkwood ASoC drivers; (CVE-2024-40961, CVE-2024-38597, CVE-2024-39468, CVE-2024-36978, CVE-2024-42161, CVE-2024-38573, CVE-2024-40905, CVE-2024-42094, CVE-2024-36894, CVE-2024-40914, CVE-2024-40956, CVE-2024-42106, CVE-2024-38610, CVE-2024-39506, CVE-2024-42098, CVE-2024-42232, CVE-2024-38590, CVE-2024-39488, CVE-2024-42127, CVE-2024-41006, CVE-2024-42131, CVE-2024-41005, CVE-2024-40963, CVE-2024-38559, CVE-2024-42130, CVE-2024-37078, CVE-2024-42082, CVE-2024-40984, CVE-2024-38560, CVE-2024-42090, CVE-2024-33621, CVE-2024-40974, CVE-2024-42115, CVE-2024-40971, CVE-2024-40943, CVE-2024-38627, CVE-2024-38548, CVE-2024-40934, CVE-2024-38579, CVE-2024-38558, CVE-2024-39495, CVE-2023-52884, CVE-2024-42225, CVE-2024-38659, CVE-2024-40927, CVE-2024-40967, CVE-2024-38624, CVE-2024-38583, CVE-2024-41047, CVE-2024-38623, CVE-2024-39509, CVE-2024-36971, CVE-2024-42120, CVE-2024-38589, CVE-2024-36270, CVE-2024-42105, CVE-2024-36032, CVE-2024-42101, CVE-2024-40908,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• M68K architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Accessibility subsystem;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Pin controllers subsystem;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• eCrypt file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFFS2 file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• IOMMU subsystem;
• Memory management;
• Netfilter;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• Multipath TCP;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Network traffic control;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• ALSA framework;
• SoC Audio for Freescale CPUs drivers;
• Kirkwood ASoC drivers; (CVE-2024-42140, CVE-2024-38580, CVE-2024-38555, CVE-2024-38591, CVE-2024-40942, CVE-2024-42130, CVE-2024-41095, CVE-2024-40994, CVE-2024-39469, CVE-2024-38610, CVE-2024-42097, CVE-2024-42137, CVE-2024-31076, CVE-2024-38552, CVE-2024-36489, CVE-2024-40983, CVE-2024-40908, CVE-2024-39493, CVE-2024-40970, CVE-2024-40901, CVE-2024-38567, CVE-2024-38599, CVE-2024-38605, CVE-2024-42119, CVE-2024-38590, CVE-2024-38558, CVE-2023-52884, CVE-2024-41000, CVE-2024-42101, CVE-2024-40943, CVE-2024-39507, CVE-2024-42115, CVE-2024-40968, CVE-2024-42095, CVE-2024-41034, CVE-2024-38618, CVE-2024-38633, CVE-2024-40904, CVE-2024-42070, CVE-2024-38583, CVE-2024-39471, CVE-2024-38578, CVE-2024-38637, CVE-2024-40987, CVE-2024-39506, CVE-2024-39482, CVE-2024-42124, CVE-2024-40981, CVE-2024-35927, CVE-2022-48772, CVE-2024-38588, CVE-2023-52887, CVE-2024-40941, CVE-2024-34027, CVE-2024-38627, CVE-2024-42106, CVE-2024-40927, CVE-2024-38559, CVE-2024-39499,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• M68K architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Accessibility subsystem;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Pin controllers subsystem;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• eCrypt file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFFS2 file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• IOMMU subsystem;
• Memory management;
• Netfilter;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• Multipath TCP;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Network traffic control;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• ALSA framework;
• SoC Audio for Freescale CPUs drivers;
• Kirkwood ASoC drivers; (CVE-2024-42105, CVE-2024-41002, CVE-2024-38558, CVE-2023-52887, CVE-2024-39487, CVE-2024-39276, CVE-2024-42077, CVE-2024-39493, CVE-2024-40934, CVE-2024-39277, CVE-2024-42087, CVE-2024-38598, CVE-2024-38618, CVE-2024-40981, CVE-2024-42127, CVE-2024-38607, CVE-2024-38586, CVE-2024-40901, CVE-2024-40916, CVE-2024-42247, CVE-2024-42093, CVE-2024-36489, CVE-2024-38615, CVE-2024-42120, CVE-2024-38567, CVE-2024-40957, CVE-2024-39501, CVE-2024-42140, CVE-2024-33621, CVE-2024-38573, CVE-2023-52884, CVE-2024-39468, CVE-2024-41092, CVE-2024-40931, CVE-2024-42145, CVE-2024-39490, CVE-2024-38555, CVE-2024-42086, CVE-2024-38597, CVE-2024-40956, CVE-2024-42223, CVE-2024-36894, CVE-2024-40961, CVE-2024-42076, CVE-2024-40994, CVE-2024-38619, CVE-2024-39467, CVE-2024-39466, CVE-2022-48772, CVE-2024-39507, CVE-2024-40914, CVE-2024-41046, CVE-2024-42094, CVE-2024-38591, CVE-2024-42098, CVE-2024-41027, CVE-2024-41040, CVE-2024-41089, CVE-2024-40945,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• M68K architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Accessibility subsystem;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Pin controllers subsystem;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• eCrypt file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFFS2 file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• IOMMU subsystem;
• Memory management;
• Netfilter;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• Multipath TCP;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Network traffic control;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• ALSA framework;
• SoC Audio for Freescale CPUs drivers;
• Kirkwood ASoC drivers; (CVE-2024-38613, CVE-2024-42096, CVE-2024-40908, CVE-2024-42137, CVE-2024-38590, CVE-2024-41044, CVE-2024-39480, CVE-2024-39469, CVE-2024-39471, CVE-2024-42089, CVE-2024-38588, CVE-2024-41092, CVE-2024-42120, CVE-2024-40901, CVE-2024-40981, CVE-2024-42127, CVE-2024-40932, CVE-2024-39475, CVE-2024-40957, CVE-2024-39501, CVE-2024-42090, CVE-2024-40904, CVE-2024-40978, CVE-2022-48772, CVE-2024-40934, CVE-2024-38548, CVE-2024-41005, CVE-2024-36489, CVE-2024-36978, CVE-2024-38573, CVE-2024-42106, CVE-2024-42104, CVE-2024-42085, CVE-2024-38621, CVE-2024-42098, CVE-2024-38662, CVE-2024-38587, CVE-2024-41089, CVE-2024-42095, CVE-2024-40916, CVE-2024-39487, CVE-2024-42229, CVE-2023-52884, CVE-2024-40974, CVE-2024-40980, CVE-2024-42225, CVE-2024-39502, CVE-2024-37356, CVE-2024-39488, CVE-2024-40912, CVE-2024-39507, CVE-2024-38591, CVE-2024-31076, CVE-2024-40984, CVE-2024-39500, CVE-2024-38582, CVE-2024-34027, CVE-2024-36270, CVE-2024-42076,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• M68K architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Accessibility subsystem;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Pin controllers subsystem;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• eCrypt file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFFS2 file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• IOMMU subsystem;
• Memory management;
• Netfilter;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• Multipath TCP;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Network traffic control;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• ALSA framework;
• SoC Audio for Freescale CPUs drivers;
• Kirkwood ASoC drivers; (CVE-2024-42076, CVE-2024-40994, CVE-2024-40932, CVE-2024-41000, CVE-2024-42224, CVE-2024-38633, CVE-2024-40954, CVE-2024-36270, CVE-2024-38623, CVE-2024-38549, CVE-2024-42225, CVE-2024-42085, CVE-2024-42157, CVE-2024-42229, CVE-2024-42109, CVE-2024-41040, CVE-2024-38607, CVE-2024-39493, CVE-2024-38546, CVE-2024-41046, CVE-2024-38567, CVE-2024-42092, CVE-2024-39501, CVE-2024-41005, CVE-2024-42223, CVE-2024-39480, CVE-2024-38571, CVE-2024-41048, CVE-2024-38605, CVE-2024-42094, CVE-2024-38598, CVE-2024-38559, CVE-2024-38558, CVE-2024-40931, CVE-2024-40942, CVE-2024-39495, CVE-2024-40981, CVE-2024-40911, CVE-2024-42148, CVE-2024-33621, CVE-2024-39502, CVE-2024-41095, CVE-2024-40960, CVE-2024-36286, CVE-2024-42232, CVE-2024-42130, CVE-2024-42154, CVE-2024-41087, CVE-2024-41004, CVE-2024-39277, CVE-2024-38560, CVE-2024-36978, CVE-2024-42089, CVE-2024-37356, CVE-2024-38547, CVE-2024-38381, CVE-2024-36015, CVE-2024-38548, CVE-2024-42120,…

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741)

Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde discovered that an untrusted hypervisor could inject malicious #VC interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw is known as WeSee. A local attacker in control of the hypervisor could use this to expose sensitive information or possibly execute arbitrary code in the trusted execution environment. (CVE-2024-25742)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• M68K architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• SuperH RISC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Accessibility subsystem;
• ACPI drivers;
• Android drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• FireWire subsystem;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• EEPROM drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• PTP clock framework;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI drivers;
• Freescale SoC…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• S390 architecture;
• SuperH RISC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Cryptographic API;
• Virtio block driver;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCPI message protocol;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Microsoft Hyper-V drivers;
• I3C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Real Time Clock drivers;
• SCSI subsystem;
• SuperH / SH-Mobile drivers;
• QCOM SoC drivers;
• SPI subsystem;
• USB Gadget drivers;
• USB Serial drivers;
• USB Type-C Port Controller Manager driver;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• File systems infrastructure;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• Overlay file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• Timer subsystem;
• VLANs driver;
• LAPB network protocol;
• Kernel init infrastructure;
• BPF subsystem;
• Kernel CPU control infrastructure;
• Tracing infrastructure;
• Memory management;
• 9P file system network protocol;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• DCCP (Datagram Congestion Control Protocol);
• IEEE802154.4 network protocol;
• IPv4 networking;
• IPv6 networking;
• IEEE 802.15.4 subsystem;
• Netfilter;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• Network traffic control;
• SCTP protocol;
• Sun RPC protocol;
• TIPC protocol;
• eXpress Data Path;
• SELinux security module;
• USB sound devices; (CVE-2024-53172, CVE-2024-56572, CVE-2024-56739, CVE-2024-56643, CVE-2024-53131, CVE-2024-57904, CVE-2024-53145, CVE-2024-57908, CVE-2024-53155, CVE-2024-56691, CVE-2024-57901, CVE-2024-56595, CVE-2024-55916, CVE-2024-50051, CVE-2024-49936, CVE-2024-57900, CVE-2024-53239, CVE-2024-53142, CVE-2024-57889, CVE-2024-53217, CVE-2024-56619, CVE-2025-21653, CVE-2024-53140, CVE-2024-53130, CVE-2024-43098, CVE-2024-56746, CVE-2024-56650, CVE-2024-56723, CVE-2024-56558, CVE-2024-57884, CVE-2024-56601, CVE-2024-56581, CVE-2024-57906, CVE-2024-57948, CVE-2024-49996, CVE-2024-56598, CVE-2025-21638, CVE-2024-49925, CVE-2024-56767, CVE-2024-53127, CVE-2024-53181, CVE-2024-53194, CVE-2024-57902, CVE-2024-56630, CVE-2024-56567, CVE-2024-56602, CVE-2024-56562, CVE-2024-56596, CVE-2024-56570, CVE-2024-56670, CVE-2024-53135, CVE-2024-56629, CVE-2024-56769, CVE-2024-56637, CVE-2024-56681, CVE-2024-57910, CVE-2024-57892, CVE-2024-56574, CVE-2024-53121, CVE-2024-56532, CVE-2025-21689, CVE-2024-53156, CVE-2024-57912, CVE-2024-56597, CVE-2025-21640, CVE-2024-53690, CVE-2024-56548, CVE-2024-56633, CVE-2024-43900, CVE-2024-56631, CVE-2021-47219, CVE-2024-56659, CVE-2024-53158, CVE-2025-21639, CVE-2024-53136, CVE-2024-56615, CVE-2024-56586, CVE-2024-57946, CVE-2024-57911, CVE-2025-21699, CVE-2025-21664, CVE-2024-53174, CVE-2024-53184, CVE-2024-53138, CVE-2024-53680, CVE-2024-56593, CVE-2024-56644,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• S390 architecture;
• SuperH RISC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Cryptographic API;
• Virtio block driver;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCPI message protocol;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Microsoft Hyper-V drivers;
• I3C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Real Time Clock drivers;
• SCSI subsystem;
• SuperH / SH-Mobile drivers;
• QCOM SoC drivers;
• SPI subsystem;
• USB Gadget drivers;
• USB Serial drivers;
• USB Type-C Port Controller Manager driver;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• File systems infrastructure;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• Overlay file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• Timer subsystem;
• VLANs driver;
• LAPB network protocol;
• Kernel init infrastructure;
• BPF subsystem;
• Kernel CPU control infrastructure;
• Tracing infrastructure;
• Memory management;
• 9P file system network protocol;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• DCCP (Datagram Congestion Control Protocol);
• IEEE802154.4 network protocol;
• IPv4 networking;
• IPv6 networking;
• IEEE 802.15.4 subsystem;
• Netfilter;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• Network traffic control;
• SCTP protocol;
• Sun RPC protocol;
• TIPC protocol;
• eXpress Data Path;
• SELinux security module;
• USB sound devices; (CVE-2024-56532, CVE-2024-53127, CVE-2024-56574, CVE-2024-56576, CVE-2024-57922, CVE-2024-53135, CVE-2024-56606, CVE-2024-53155, CVE-2024-53136, CVE-2024-56769, CVE-2024-56690, CVE-2024-53150, CVE-2024-38588, CVE-2024-53171, CVE-2024-56748, CVE-2024-56558, CVE-2024-56595, CVE-2024-56670, CVE-2024-56637, CVE-2024-56739, CVE-2024-56681, CVE-2024-53158, CVE-2024-53172, CVE-2024-56700, CVE-2024-56645, CVE-2024-56723, CVE-2024-56572, CVE-2024-57889, CVE-2024-43098, CVE-2024-56614, CVE-2024-53197, CVE-2025-21640, CVE-2024-57938, CVE-2024-53140, CVE-2024-57929, CVE-2024-56593, CVE-2024-56691, CVE-2025-21687, CVE-2024-56770, CVE-2024-53131, CVE-2024-56531, CVE-2024-56603, CVE-2025-21653, CVE-2024-53239, CVE-2024-57946, CVE-2024-56581, CVE-2024-56694, CVE-2024-56597, CVE-2024-57849, CVE-2024-56601, CVE-2024-53156, CVE-2024-56747, CVE-2024-53146, CVE-2025-21664, CVE-2024-53217, CVE-2025-21638, CVE-2024-53157, CVE-2024-56688, CVE-2024-47707, CVE-2024-53173, CVE-2024-56605, CVE-2024-56619, CVE-2024-49925, CVE-2024-49936, CVE-2024-56586, CVE-2024-57892, CVE-2024-56562, CVE-2024-57902,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• S390 architecture;
• SuperH RISC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Cryptographic API;
• Virtio block driver;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCPI message protocol;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Microsoft Hyper-V drivers;
• I3C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Real Time Clock drivers;
• SCSI subsystem;
• SuperH / SH-Mobile drivers;
• QCOM SoC drivers;
• SPI subsystem;
• USB Gadget drivers;
• USB Serial drivers;
• USB Type-C Port Controller Manager driver;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• File systems infrastructure;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• Overlay file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• Timer subsystem;
• VLANs driver;
• LAPB network protocol;
• Kernel init infrastructure;
• BPF subsystem;
• Kernel CPU control infrastructure;
• Tracing infrastructure;
• Memory management;
• 9P file system network protocol;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• DCCP (Datagram Congestion Control Protocol);
• IEEE802154.4 network protocol;
• IPv4 networking;
• IPv6 networking;
• IEEE 802.15.4 subsystem;
• Netfilter;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• Network traffic control;
• SCTP protocol;
• Sun RPC protocol;
• TIPC protocol;
• eXpress Data Path;
• SELinux security module;
• USB sound devices; (CVE-2024-56532, CVE-2024-53127, CVE-2024-56574, CVE-2024-56576, CVE-2024-57922, CVE-2024-53135, CVE-2024-56606, CVE-2024-53155, CVE-2024-53136, CVE-2024-56769, CVE-2024-56690, CVE-2024-53150, CVE-2024-38588, CVE-2024-53171, CVE-2024-56748, CVE-2024-56558, CVE-2024-56595, CVE-2024-56670, CVE-2024-56637, CVE-2024-56739, CVE-2024-56681, CVE-2024-53158, CVE-2024-53172, CVE-2024-56700, CVE-2024-56645, CVE-2024-56723, CVE-2024-56572, CVE-2024-57889, CVE-2024-43098, CVE-2024-56614, CVE-2024-53197, CVE-2025-21640, CVE-2024-57938, CVE-2024-53140, CVE-2024-57929, CVE-2024-56593, CVE-2024-56691, CVE-2025-21687, CVE-2024-56770, CVE-2024-53131, CVE-2024-56531, CVE-2024-56603, CVE-2025-21653, CVE-2024-53239, CVE-2024-57946, CVE-2024-56581, CVE-2024-56694, CVE-2024-56597, CVE-2024-57849, CVE-2024-56601, CVE-2024-53156, CVE-2024-56747, CVE-2024-53146, CVE-2025-21664, CVE-2024-53217, CVE-2025-21638, CVE-2024-53157, CVE-2024-56688, CVE-2024-47707, CVE-2024-53173, CVE-2024-56605, CVE-2024-56619, CVE-2024-49925, CVE-2024-49936, CVE-2024-56586, CVE-2024-57892, CVE-2024-56562, CVE-2024-57902,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• S390 architecture;
• SuperH RISC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Cryptographic API;
• Virtio block driver;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCPI message protocol;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Microsoft Hyper-V drivers;
• I3C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Real Time Clock drivers;
• SCSI subsystem;
• SuperH / SH-Mobile drivers;
• QCOM SoC drivers;
• SPI subsystem;
• USB Gadget drivers;
• USB Serial drivers;
• USB Type-C Port Controller Manager driver;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• File systems infrastructure;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• Overlay file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• Timer subsystem;
• VLANs driver;
• LAPB network protocol;
• Kernel init infrastructure;
• BPF subsystem;
• Kernel CPU control infrastructure;
• Tracing infrastructure;
• Memory management;
• 9P file system network protocol;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• DCCP (Datagram Congestion Control Protocol);
• IEEE802154.4 network protocol;
• IPv4 networking;
• IPv6 networking;
• IEEE 802.15.4 subsystem;
• Netfilter;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• Network traffic control;
• SCTP protocol;
• Sun RPC protocol;
• TIPC protocol;
• eXpress Data Path;
• SELinux security module;
• USB sound devices; (CVE-2024-56532, CVE-2024-53127, CVE-2024-56574, CVE-2024-56576, CVE-2024-57922, CVE-2024-53135, CVE-2024-56606, CVE-2024-53155, CVE-2024-53136, CVE-2024-56769, CVE-2024-56690, CVE-2024-53150, CVE-2024-38588, CVE-2024-53171, CVE-2024-56748, CVE-2024-56558, CVE-2024-56595, CVE-2024-56670, CVE-2024-56637, CVE-2024-56739, CVE-2024-56681, CVE-2024-53158, CVE-2024-53172, CVE-2024-56700, CVE-2024-56645, CVE-2024-56723, CVE-2024-56572, CVE-2024-57889, CVE-2024-43098, CVE-2024-56614, CVE-2024-53197, CVE-2025-21640, CVE-2024-57938, CVE-2024-53140, CVE-2024-57929, CVE-2024-56593, CVE-2024-56691, CVE-2025-21687, CVE-2024-56770, CVE-2024-53131, CVE-2024-56531, CVE-2024-56603, CVE-2025-21653, CVE-2024-53239, CVE-2024-57946, CVE-2024-56581, CVE-2024-56694, CVE-2024-56597, CVE-2024-57849, CVE-2024-56601, CVE-2024-53156, CVE-2024-56747, CVE-2024-53146, CVE-2025-21664, CVE-2024-53217, CVE-2025-21638, CVE-2024-53157, CVE-2024-56688, CVE-2024-47707, CVE-2024-53173, CVE-2024-56605, CVE-2024-56619, CVE-2024-49925, CVE-2024-49936, CVE-2024-56586, CVE-2024-57892, CVE-2024-56562, CVE-2024-57902,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• S390 architecture;
• SuperH RISC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Cryptographic API;
• Virtio block driver;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCPI message protocol;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Microsoft Hyper-V drivers;
• I3C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Real Time Clock drivers;
• SCSI subsystem;
• SuperH / SH-Mobile drivers;
• QCOM SoC drivers;
• SPI subsystem;
• USB Gadget drivers;
• USB Serial drivers;
• USB Type-C Port Controller Manager driver;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• File systems infrastructure;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• Overlay file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• Timer subsystem;
• VLANs driver;
• LAPB network protocol;
• Kernel init infrastructure;
• BPF subsystem;
• Kernel CPU control infrastructure;
• Tracing infrastructure;
• Memory management;
• 9P file system network protocol;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• DCCP (Datagram Congestion Control Protocol);
• IEEE802154.4 network protocol;
• IPv4 networking;
• IPv6 networking;
• IEEE 802.15.4 subsystem;
• Netfilter;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• Network traffic control;
• SCTP protocol;
• Sun RPC protocol;
• TIPC protocol;
• eXpress Data Path;
• SELinux security module;
• USB sound devices; (CVE-2024-56532, CVE-2024-53127, CVE-2024-56574, CVE-2024-56576, CVE-2024-57922, CVE-2024-53135, CVE-2024-56606, CVE-2024-53155, CVE-2024-53136, CVE-2024-56769, CVE-2024-56690, CVE-2024-53150, CVE-2024-38588, CVE-2024-53171, CVE-2024-56748, CVE-2024-56558, CVE-2024-56595, CVE-2024-56670, CVE-2024-56637, CVE-2024-56739, CVE-2024-56681, CVE-2024-53158, CVE-2024-53172, CVE-2024-56700, CVE-2024-56645, CVE-2024-56723, CVE-2024-56572, CVE-2024-57889, CVE-2024-43098, CVE-2024-56614, CVE-2024-53197, CVE-2025-21640, CVE-2024-57938, CVE-2024-53140, CVE-2024-57929, CVE-2024-56593, CVE-2024-56691, CVE-2025-21687, CVE-2024-56770, CVE-2024-53131, CVE-2024-56531, CVE-2024-56603, CVE-2025-21653, CVE-2024-53239, CVE-2024-57946, CVE-2024-56581, CVE-2024-56694, CVE-2024-56597, CVE-2024-57849, CVE-2024-56601, CVE-2024-53156, CVE-2024-56747, CVE-2024-53146, CVE-2025-21664, CVE-2024-53217, CVE-2025-21638, CVE-2024-53157, CVE-2024-56688, CVE-2024-47707, CVE-2024-53173, CVE-2024-56605, CVE-2024-56619, CVE-2024-49925, CVE-2024-49936, CVE-2024-56586, CVE-2024-57892, CVE-2024-56562, CVE-2024-57902,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• S390 architecture;
• SuperH RISC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• Virtio block driver;
• TPM device driver;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCPI message protocol;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Microsoft Hyper-V drivers;
• I2C subsystem;
• I3C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• NTB driver;
• Virtio pmem driver;
• NVME drivers;
• Parport drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Real Time Clock drivers;
• SCSI subsystem;
• SuperH / SH-Mobile drivers;
• QCOM SoC drivers;
• SPI subsystem;
• Direct Digital Synthesis drivers;
• USB Device Class drivers;
• USB Gadget drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Port Controller Manager driver;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• BTRFS file system;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• File systems infrastructure;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• Overlay file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• Timer subsystem;
• VLANs driver;
• LAPB network protocol;
• Network traffic control;
• Network sockets;
• TCP network protocol;
• Kernel init infrastructure;
• BPF subsystem;
• Kernel CPU control infrastructure;
• Perf events;
• Arbitrary resource management;
• Tracing infrastructure;
• Closures library;
• Memory management;
• 9P file system network protocol;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Ethernet bridge;
• CAN network layer;
• Networking core;
• DCCP (Datagram Congestion Control Protocol);
• IEEE802154.4 network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• IEEE 802.15.4 subsystem;
• Netfilter;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• SCTP protocol;
• Sun RPC protocol;
• TIPC protocol;
• Wireless networking;
• eXpress Data Path;
• XFRM subsystem;
• Key management;
• SELinux security module;
• FireWire sound drivers;
• AudioScience HPI driver;
• Amlogic Meson SoC drivers;
• USB sound devices;
• KVM core; (CVE-2024-49938, CVE-2024-41066, CVE-2024-57951, CVE-2024-56779, CVE-2024-50194, CVE-2024-50265, CVE-2024-56596, CVE-2024-57922, CVE-2024-56614, CVE-2024-57912, CVE-2024-50251, CVE-2024-56569, CVE-2024-56587, CVE-2024-57807, CVE-2024-50051, CVE-2024-49997, CVE-2024-57911, CVE-2024-50195,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• S390 architecture;
• SuperH RISC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• Virtio block driver;
• TPM device driver;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCPI message protocol;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Microsoft Hyper-V drivers;
• I2C subsystem;
• I3C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• NTB driver;
• Virtio pmem driver;
• NVME drivers;
• Parport drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Real Time Clock drivers;
• SCSI subsystem;
• SuperH / SH-Mobile drivers;
• QCOM SoC drivers;
• SPI subsystem;
• Direct Digital Synthesis drivers;
• USB Device Class drivers;
• USB Gadget drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Port Controller Manager driver;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• BTRFS file system;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• File systems infrastructure;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• Overlay file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• Timer subsystem;
• VLANs driver;
• LAPB network protocol;
• Network traffic control;
• Network sockets;
• TCP network protocol;
• Kernel init infrastructure;
• BPF subsystem;
• Kernel CPU control infrastructure;
• Perf events;
• Arbitrary resource management;
• Tracing infrastructure;
• Closures library;
• Memory management;
• 9P file system network protocol;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Ethernet bridge;
• CAN network layer;
• Networking core;
• DCCP (Datagram Congestion Control Protocol);
• IEEE802154.4 network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• IEEE 802.15.4 subsystem;
• Netfilter;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• SCTP protocol;
• Sun RPC protocol;
• TIPC protocol;
• Wireless networking;
• eXpress Data Path;
• XFRM subsystem;
• Key management;
• SELinux security module;
• FireWire sound drivers;
• AudioScience HPI driver;
• Amlogic Meson SoC drivers;
• USB sound devices;
• KVM core; (CVE-2024-56637, CVE-2024-56576, CVE-2024-47685, CVE-2024-56558, CVE-2024-47684, CVE-2024-50233, CVE-2024-50301, CVE-2024-49860, CVE-2021-47219, CVE-2024-56581, CVE-2024-57902, CVE-2024-49851, CVE-2024-50074, CVE-2025-21640, CVE-2023-52458, CVE-2024-50134, CVE-2024-47692, CVE-2024-46849,…