CVE-2024-39510

cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()

We got the following issue in a fuzz test of randomly issuing the restore command:

================================================================== BUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0xb41/0xb60 Read of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963

CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasan_report+0x93/0xc0 cachefiles_ondemand_daemon_read+0xb41/0xb60 vfs_read+0x169/0xb50 ksys_read+0xf5/0x1e0

Allocated by task 116: kmem_cache_alloc+0x140/0x3a0 cachefiles_lookup_cookie+0x140/0xcd0 fscache_cookie_state_machine+0x43c/0x1230 [...]

Freed by task 792: kmem_cache_free+0xfe/0x390 cachefiles_put_object+0x241/0x480 fscache_cookie_state_machine+0x5c8/0x1230 [...]

Following is the process that triggers the issue:

 mount  |   daemon_thread1    |    daemon_thread2

cachefiles_withdraw_cookie cachefiles_ondemand_clean_object(object) cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(&REQ_A->done)

        cachefiles_daemon_read
         cachefiles_ondemand_daemon_read
          REQ_A = cachefiles_ondemand_select_req
          msg->object_id = req->object->ondemand->ondemand_id
                              ------ restore ------
                              cachefiles_ondemand_restore
                              xas_for_each(&xas, req, ULONG_MAX)
                               xas_set_mark(&xas, CACHEFILES_REQ_NEW)

                              cachefiles_daemon_read
                               cachefiles_ondemand_daemon_read
                                REQ_A = cachefiles_ondemand_select_req
          copy_to_user(_buffer, msg, n)
           xa_erase(&cache->reqs, id)
           complete(&REQ_A->done)
          ------ close(fd) ------
          cachefiles_ondemand_fd_release
           cachefiles_put_object

cachefiles_put_object kmem_cache_free(cachefiles_object_jar, object) REQ_A->object->ondemand->ondemand_id // object UAF !!!

When we see the request within xa_lock, req->object must not have been freed yet, so grab the reference count of object before xa_unlock to avoid the above issue.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.28%Up 0.2 points since Jul 13, 2024

What each source reports

NVD Score used 7.8

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()

We got the following issue in a fuzz test of randomly issuing the restore command:

CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasan_report+0x93/0xc0 cachefiles_ondemand_daemon_read+0xb41/0xb60 vfs_read+0x169/0xb50 ksys_read+0xf5/0x1e0

Allocated by task 116: kmem_cache_alloc+0x140/0x3a0 cachefiles_lookup_cookie+0x140/0xcd0 fscache_cookie_state_machine+0x43c/0x1230 [...]

Freed by task 792: kmem_cache_free+0xfe/0x390 cachefiles_put_object+0x241/0x480 fscache_cookie_state_machine+0x5c8/0x1230 [...]

Following is the process that triggers the issue:

 mount  |   daemon_thread1    |    daemon_thread2

cachefiles_withdraw_cookie cachefiles_ondemand_clean_object(object) cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(&REQ_A->done)

        cachefiles_daemon_read
         cachefiles_ondemand_daemon_read
          REQ_A = cachefiles_ondemand_select_req
          msg->object_id = req->object->ondemand->ondemand_id
                              ------ restore ------
                              cachefiles_ondemand_restore
                              xas_for_each(&xas, req, ULONG_MAX)
                               xas_set_mark(&xas, CACHEFILES_REQ_NEW)

                              cachefiles_daemon_read
                               cachefiles_ondemand_daemon_read
                                REQ_A = cachefiles_ondemand_select_req
          copy_to_user(_buffer, msg, n)
           xa_erase(&cache->reqs, id)
           complete(&REQ_A->done)
          ------ close(fd) ------
          cachefiles_ondemand_fd_release
           cachefiles_put_object

cachefiles_put_object kmem_cache_free(cachefiles_object_jar, object) REQ_A->object->ondemand->ondemand_id // object UAF !!!

When we see the request within xa_lock, req->object must not have been freed yet, so grab the reference count of object before xa_unlock to avoid the above issue.

Record: CVE-2024-39510
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

CVE List No score

cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()

We got the following issue in a fuzz test of randomly issuing the restore command:

CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasan_report+0x93/0xc0 cachefiles_ondemand_daemon_read+0xb41/0xb60 vfs_read+0x169/0xb50 ksys_read+0xf5/0x1e0

Allocated by task 116: kmem_cache_alloc+0x140/0x3a0 cachefiles_lookup_cookie+0x140/0xcd0 fscache_cookie_state_machine+0x43c/0x1230 [...]

Freed by task 792: kmem_cache_free+0xfe/0x390 cachefiles_put_object+0x241/0x480 fscache_cookie_state_machine+0x5c8/0x1230 [...]

Following is the process that triggers the issue:

 mount  |   daemon_thread1    |    daemon_thread2

cachefiles_withdraw_cookie cachefiles_ondemand_clean_object(object) cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(&REQ_A->done)

        cachefiles_daemon_read
         cachefiles_ondemand_daemon_read
          REQ_A = cachefiles_ondemand_select_req
          msg->object_id = req->object->ondemand->ondemand_id
                              ------ restore ------
                              cachefiles_ondemand_restore
                              xas_for_each(&xas, req, ULONG_MAX)
                               xas_set_mark(&xas, CACHEFILES_REQ_NEW)

                              cachefiles_daemon_read
                               cachefiles_ondemand_daemon_read
                                REQ_A = cachefiles_ondemand_select_req
          copy_to_user(_buffer, msg, n)
           xa_erase(&cache->reqs, id)
           complete(&REQ_A->done)
          ------ close(fd) ------
          cachefiles_ondemand_fd_release
           cachefiles_put_object

cachefiles_put_object kmem_cache_free(cachefiles_object_jar, object) REQ_A->object->ondemand->ondemand_id // object UAF !!!

When we see the request within xa_lock, req->object must not have been freed yet, so grab the reference count of object before xa_unlock to avoid the above issue.

Record: CVE-2024-39510
Updated: 2026-11-02

EUVDEUVD-2024-38036 No score

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()

We got the following issue in a fuzz test of randomly issuing the restore command:

CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasan_report+0x93/0xc0 cachefiles_ondemand_daemon_read+0xb41/0xb60 vfs_read+0x169/0xb50 ksys_read+0xf5/0x1e0

Allocated by task 116: kmem_cache_alloc+0x140/0x3a0 cachefiles_lookup_cookie+0x140/0xcd0 fscache_cookie_state_machine+0x43c/0x1230 [...]

Freed by task 792: kmem_cache_free+0xfe/0x390 cachefiles_put_object+0x241/0x480 fscache_cookie_state_machine+0x5c8/0x1230 [...]

Following is the process that triggers the issue:

 mount  |   daemon_thread1    |    daemon_thread2

cachefiles_withdraw_cookie cachefiles_ondemand_clean_object(object) cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(&REQ_A->done)

        cachefiles_daemon_read
         cachefiles_ondemand_daemon_read
          REQ_A = cachefiles_ondemand_select_req
          msg->object_id = req->object->ondemand->ondemand_id
                              ------ restore ------
                              cachefiles_ondemand_restore
                              xas_for_each(&xas, req, ULONG_MAX)
                               xas_set_mark(&xas, CACHEFILES_REQ_NEW)

                              cachefiles_daemon_read
                               cachefiles_ondemand_daemon_read
                                REQ_A = cachefiles_ondemand_select_req
          copy_to_user(_buffer, msg, n)
           xa_erase(&cache->reqs, id)
           complete(&REQ_A->done)
          ------ close(fd) ------
          cachefiles_ondemand_fd_release
           cachefiles_put_object

cachefiles_put_object kmem_cache_free(cachefiles_object_jar, object) REQ_A->object->ondemand->ondemand_id // object UAF !!!

When we see the request within xa_lock, req->object must not have been freed yet, so grab the reference count of object before xa_unlock to avoid the above issue.

Record: EUVD-2024-38036
Updated: 2026-11-02

GitHub AdvisoriesGHSA-77p5-68v4-943h 7.8

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use...

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()

We got the following issue in a fuzz test of randomly issuing the restore command:

CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasan_report+0x93/0xc0 cachefiles_ondemand_daemon_read+0xb41/0xb60 vfs_read+0x169/0xb50 ksys_read+0xf5/0x1e0

Allocated by task 116: kmem_cache_alloc+0x140/0x3a0 cachefiles_lookup_cookie+0x140/0xcd0 fscache_cookie_state_machine+0x43c/0x1230 [...]

Freed by task 792: kmem_cache_free+0xfe/0x390 cachefiles_put_object+0x241/0x480 fscache_cookie_state_machine+0x5c8/0x1230 [...]

Following is the process that triggers the issue:

 mount  |   daemon_thread1    |    daemon_thread2

cachefiles_withdraw_cookie cachefiles_ondemand_clean_object(object) cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(&REQ_A->done)

        cachefiles_daemon_read
         cachefiles_ondemand_daemon_read
          REQ_A = cachefiles_ondemand_select_req
          msg->object_id = req->object->ondemand->ondemand_id
                              ------ restore ------
                              cachefiles_ondemand_restore
                              xas_for_each(&xas, req, ULONG_MAX)
                               xas_set_mark(&xas, CACHEFILES_REQ_NEW)

                              cachefiles_daemon_read
                               cachefiles_ondemand_daemon_read
                                REQ_A = cachefiles_ondemand_select_req
          copy_to_user(_buffer, msg, n)
           xa_erase(&cache->reqs, id)
           complete(&REQ_A->done)
          ------ close(fd) ------
          cachefiles_ondemand_fd_release
           cachefiles_put_object

cachefiles_put_object kmem_cache_free(cachefiles_object_jar, object) REQ_A->object->ondemand->ondemand_id // object UAF !!!

When we see the request within xa_lock, req->object must not have been freed yet, so grab the reference count of object before xa_unlock to avoid the above issue.

Record: GHSA-77p5-68v4-943h
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVBELL-CVE-2024-39510 7.8

Record: BELL-CVE-2024-39510
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-39510 7.8

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() We got the following issue in a fuzz test of randomly issuing the restore command: ================================================================== BUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0xb41/0xb60 Read of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963 CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasan_report+0x93/0xc0 cachefiles_ondemand_daemon_read+0xb41/0xb60 vfs_read+0x169/0xb50 ksys_read+0xf5/0x1e0 Allocated by task 116: kmem_cache_alloc+0x140/0x3a0 cachefiles_lookup_cookie+0x140/0xcd0 fscache_cookie_state_machine+0x43c/0x1230 [...] Freed by task 792: kmem_cache_free+0xfe/0x390 cachefiles_put_object+0x241/0x480 fscache_cookie_state_machine+0x5c8/0x1230 [...] ================================================================== Following is the process that triggers the issue: mount | daemon_thread1 | daemon_thread2 ------------------------------------------------------------ cachefiles_withdraw_cookie cachefiles_ondemand_clean_object(object) cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(&REQ_A->done) cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req msg->object_id = req->object->ondemand->ondemand_id ------ restore ------ cachefiles_ondemand_restore xas_for_each(&xas, req, ULONG_MAX) xas_set_mark(&xas, CACHEFILES_REQ_NEW) cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req copy_to_user(_buffer, msg, n) xa_erase(&cache->reqs, id) complete(&REQ_A->done) ------ close(fd) ------ cachefiles_ondemand_fd_release cachefiles_put_object cachefiles_put_object kmem_cache_free(cachefiles_object_jar, object) REQ_A->object->ondemand->ondemand_id // object UAF !!! When we see the request within xa_lock, req->object must not have been freed yet, so grab the reference count of object before xa_unlock to avoid the above issue.

Record: DEBIAN-CVE-2024-39510
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 14 moreShow less

OSVUBUNTU-CVE-2024-39510 7.8

Record: UBUNTU-CVE-2024-39510
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV No score

cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()

We got the following issue in a fuzz test of randomly issuing the restore command:

CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasan_report+0x93/0xc0 cachefiles_ondemand_daemon_read+0xb41/0xb60 vfs_read+0x169/0xb50 ksys_read+0xf5/0x1e0

Allocated by task 116: kmem_cache_alloc+0x140/0x3a0 cachefiles_lookup_cookie+0x140/0xcd0 fscache_cookie_state_machine+0x43c/0x1230 [...]

Freed by task 792: kmem_cache_free+0xfe/0x390 cachefiles_put_object+0x241/0x480 fscache_cookie_state_machine+0x5c8/0x1230 [...]

Following is the process that triggers the issue:

 mount  |   daemon_thread1    |    daemon_thread2

cachefiles_withdraw_cookie cachefiles_ondemand_clean_object(object) cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(&REQ_A->done)

        cachefiles_daemon_read
         cachefiles_ondemand_daemon_read
          REQ_A = cachefiles_ondemand_select_req
          msg->object_id = req->object->ondemand->ondemand_id
                              ------ restore ------
                              cachefiles_ondemand_restore
                              xas_for_each(&xas, req, ULONG_MAX)
                               xas_set_mark(&xas, CACHEFILES_REQ_NEW)

                              cachefiles_daemon_read
                               cachefiles_ondemand_daemon_read
                                REQ_A = cachefiles_ondemand_select_req
          copy_to_user(_buffer, msg, n)
           xa_erase(&cache->reqs, id)
           complete(&REQ_A->done)
          ------ close(fd) ------
          cachefiles_ondemand_fd_release
           cachefiles_put_object

cachefiles_put_object kmem_cache_free(cachefiles_object_jar, object) REQ_A->object->ondemand->ondemand_id // object UAF !!!

When we see the request within xa_lock, req->object must not have been freed yet, so grab the reference count of object before xa_unlock to avoid the above issue.

Record: CVE-2024-39510
Updated: 2026-11-02

OSVSUSE-SU-2024:3194-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
CVE-2024-43911: Fix NULL dereference at band check in starting tx ba session (bsc#1229827).
CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
CVE-2024-36270: Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (bsc#1226798)
CVE-2024-36881: Reset ptes when close() for wr-protected ones (bsc#1225718).
CVE-2024-42316: Fix div-by-zero in vmpressure_calc_level() (bsc#1229353).
CVE-2024-43855: Fix deadlock between mddev_suspend and flush bio (bsc#1229342,).
CVE-2024-43864: Fix CT entry update leaks of modify header context (bsc#1229496)
CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
CVE-2024-42109: Unconditionally flush pending work before notifier (bsc#1228505)
CVE-2024-41084: Avoid null pointer dereference in region lookup (bsc#1228472)
CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
CVE-2024-27079: Add kABI workaround patch (bsc#1223742).
CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26809: Release elements in clone only from destroy path (bsc#1222633).
CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).
CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).
CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).
CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).
CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)
CVE-2024-27433: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
CVE-2024-40920: Fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
CVE-2024-40921: Pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
CVE-2024-36979: Fix vlan use-after-free (bsc#1226604).
CVE-2024-26590: Fix inconsistent per-file compression format (bsc#1220252,).
CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).
CVE-2024-42270: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404)
CVE-2024-42269: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402)
CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383) -…

Record: SUSE-SU-2024:3194-1
Updated: 2026-11-02

OSVSUSE-SU-2024:3195-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
CVE-2024-43911: Fix NULL dereference at band check in starting tx ba session (bsc#1229827).
CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
CVE-2024-36881: Fix reset ptes when close() for wr-protected (bsc#1225718).
CVE-2024-42316: Fix div-by-zero in vmpressure_calc_level() (bsc#1229353).
CVE-2024-43855: Fix deadlock between mddev_suspend and flush bio (bsc#1229342).
CVE-2024-43864: Fix CT entry update leaks of modify header context (bsc#1229496).
CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
CVE-2024-42109: Unconditionally flush pending work before notifier (bsc#1228505).
CVE-2024-41084: Avoid null pointer dereference in region lookup (bsc#1228472).
CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
CVE-2024-27079: Fix NULL domain on device release (bsc#1223742).
CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26809: Release elements in clone only from destroy path (bsc#1222633).
CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).
CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).
CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).
CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).
CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)
CVE-2024-27433: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
CVE-2024-40920: Fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
CVE-2024-40921: Pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
CVE-2024-36979: Fix vlan use-after-free (bsc#1226604).
CVE-2024-26590: Fix inconsistent per-file compression format (bsc#1220252).
CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).
CVE-2024-42270: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404).
CVE-2024-42269: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402).
CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383)
CVE-2024-42312: Always initialize i_uid/i_gid (bsc#1229357)
CVE-2024-43854: Initialize integrity buffer to zero…

Record: SUSE-SU-2024:3195-1
Updated: 2026-11-02

OSVSUSE-SU-2024:3383-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-43911: wifi: mac80211: fix NULL dereference at band check in starting tx ba session (bsc#1229827).
CVE-2024-43899: drm/amd/display: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
CVE-2024-43880: kabi: lib: objagg: Put back removed metod in struct objagg_ops (bsc#1229481).
CVE-2024-43866: net/mlx5: Always drain health in shutdown callback (bsc#1229495).
CVE-2024-43864: net/mlx5e: Fix CT entry update leaks of modify header context (bsc#1229496).
CVE-2024-43855: md: fix deadlock between mddev_suspend and flush bio (bsc#1229342).
CVE-2024-43854: block: initialize integrity buffer to zero before writing it to media (bsc#1229345)
CVE-2024-43850: soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove (bsc#1229316).
CVE-2024-43839: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).
CVE-2024-43837: bpf: Fix updating attached freplace prog in prog_array map (bsc#1229297).
CVE-2024-43834: xdp: fix invalid wait context of page_pool_destroy() (bsc#1229314)
CVE-2024-43831: media: mediatek: vcodec: Handle invalid decoder vsi (bsc#1229309).
CVE-2024-43821: scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315).
CVE-2024-42322: ipvs: properly dereference pe in ip_vs_add_service (bsc#1229347)
CVE-2024-42318: landlock: Do not lose track of restrictions on cred_transfer (bsc#1229351).
CVE-2024-42316: mm/mglru: fix div-by-zero in vmpressure_calc_level() (bsc#1229353).
CVE-2024-42312: sysctl: always initialize i_uid/i_gid (bsc#1229357)
CVE-2024-42308: Update DRM patch reference (bsc#1229411)
CVE-2024-42301: dev/parport: fix the array out-of-bounds risk (bsc#1229407).
CVE-2024-42295: nilfs2: handle inconsistent state in nilfs_btnode_create_block() (bsc#1229370).
CVE-2024-42291: ice: Add a per-VF limit on number of FDIR filters (bsc#1229374).
CVE-2024-42290: irqchip/imx-irqsteer: Handle runtime power management correctly (bsc#1229379).
CVE-2024-42284: tipc: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
CVE-2024-42283: net: nexthop: Initialize all fields in dumped nexthops (bsc#1229383)
CVE-2024-42281: bpf: Fix a segment issue when downgrading gso_size (bsc#1229386).
CVE-2024-42277: iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
CVE-2024-42270: netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404).
CVE-2024-42269: netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402).
CVE-2024-42268: net/mlx5: Fix missing lock on sync reset reload (bsc#1229391).
CVE-2024-42247: wireguard: allowedips: avoid unaligned 64-bit memory accesses (bsc#1228988).
CVE-2024-42246: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).
CVE-2024-42245: Revert 'sched/fair: Make sure to try to detach at least one movable task' (bsc#1228978).
CVE-2024-42241: mm/shmem: disable PMD-sized page cache if needed (bsc#1228986).
CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list (bsc#1228723).
CVE-2024-42162: gve: Account for stopped queues when reading NIC stats (bsc#1228706).
CVE-2024-42161: bpf: avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756).
CVE-2024-42159: scsi: mpi3mr: fix sanitise num_phys (bsc#1228754).
CVE-2024-42158: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
CVE-2024-42157: s390/pkey: Wipe sensitive data on failure (bsc#1228727).
CVE-2024-42156: s390/pkey: Wipe copies of clear-key structures on failure (bsc#1228722).
CVE-2024-42155: s390/pkey: Wipe copies of protected- and secure-keys (bsc#1228733).
CVE-2024-42148: bnx2x: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).
CVE-2024-42145:…

Record: SUSE-SU-2024:3383-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20044-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 kernel was updated to receive various security bugfixes.

This release includes the first live patch.

The following security bugs were fixed:

CVE-2023-52489: mm/sparsemem: fix race in accessing memory_section->usage (bsc#1221326).
CVE-2023-52581: netfilter: nf_tables: fix memleak when more than 255 elements expired (bsc#1220877).
CVE-2023-52859: perf: hisi: Fix use-after-free when register pmu fails (bsc#1225582).
CVE-2023-52889: apparmor: Fix null pointer deref when receiving skb during sock creation (bsc#1229287,).
CVE-2024-26590: erofs: fix inconsistent per-file compression format (bsc#1220252).
CVE-2024-26631: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
CVE-2024-26668: netfilter: nft_limit: reject configurations that cause integer overflow (bsc#1222335).
CVE-2024-26669: kABI fix for net/sched: flower: Fix chain template offload (bsc#1222350).
CVE-2024-26677: blacklist.conf: Add e7870cf13d20 ("rxrpc: Fix delayed ACKs to not set the reference serial number") (bsc#1222387)
CVE-2024-26735: ipv6: sr: fix possible use-after-free and null-ptr-deref (bsc#1222372).
CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26809: netfilter: nft_set_pipapo: release elements in clone only from destroy path (bsc#1222633).
CVE-2024-26812: kABI: vfio: struct virqfd kABI workaround (bsc#1222808).
CVE-2024-26835: netfilter: nf_tables: set dormant flag on hook register failure (bsc#1222967).
CVE-2024-26837: net: bridge: switchdev: Skip MDB replays of deferred events on offload (bsc#1222973).
CVE-2024-26851: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (bsc#1223074)
CVE-2024-27010: net/sched: Fix mirred deadlock on device recursion (bsc#1223720).
CVE-2024-27011: netfilter: nf_tables: fix memleak in map from abort path (bsc#1223803).
CVE-2024-27024: net/rds: fix WARNING in rds_conn_connect_if_down (bsc#1223777).
CVE-2024-27079: iommu/vt-d: Fix NULL domain on device release (bsc#1223742).
CVE-2024-27403: kabi: restore const specifier in flow_offload_route_init() (bsc#1224415).
CVE-2024-27433: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
CVE-2024-35897: netfilter: nf_tables: discard table flag update with pending basechain deletion (bsc#1224510).
CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
CVE-2024-36286: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
CVE-2024-36489: tls: fix missing memory barrier in tls_init (bsc#1226874)
CVE-2024-36881: mm/userfaultfd: reset ptes when close() for wr-protected ones (bsc#1225718).
CVE-2024-36929: net: core: reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).
CVE-2024-36933: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).
CVE-2024-36979: net: bridge: mst: fix vlan use-after-free syzbot reported a suspicious rcu usage[1] in bridge's mst code. (bsc#1226604).
CVE-2024-38662: selftests/bpf: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
CVE-2024-39489: ipv6: sr: fix memleak in seg6_hmac_init_algo (bsc#1227623)
CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).
CVE-2024-40905: ipv6: fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
CVE-2024-40909: bpf: Fix a potential use-after-free in bpf_link_free() (bsc#1227798).
CVE-2024-40920: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
CVE-2024-40921: net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
CVE-2024-40938: landlock: fix d_parent…

Record: SUSE-SU-2025:20044-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20047-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52489: mm/sparsemem: fix race in accessing memory_section->usage (bsc#1221326).
CVE-2023-52581: netfilter: nf_tables: fix memleak when more than 255 elements expired (bsc#1220877).
CVE-2023-52859: perf: hisi: Fix use-after-free when register pmu fails (bsc#1225582).
CVE-2023-52889: apparmor: Fix null pointer deref when receiving skb during sock creation (bsc#1229287).
CVE-2024-26590: erofs: fix inconsistent per-file compression format (bsc#1220252).
CVE-2024-26631: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
CVE-2024-26668: netfilter: nft_limit: reject configurations that cause integer overflow (bsc#1222335).
CVE-2024-26669: kABI fix for net/sched: flower: Fix chain template offload (bsc#1222350).
CVE-2024-26677: Blacklist e7870cf13d20 (" Fix delayed ACKs to not set the reference serial number") (bsc#1222387)
CVE-2024-26735: ipv6: sr: fix possible use-after-free and null-ptr-deref (bsc#1222372).
CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26809: netfilter: nft_set_pipapo: release elements in clone only from destroy path (bsc#1222633).
CVE-2024-26812: kABI: vfio: struct virqfd kABI workaround (bsc#1222808).
CVE-2024-26835: netfilter: nf_tables: set dormant flag on hook register failure (bsc#1222967).
CVE-2024-26837: net: bridge: switchdev: race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).
CVE-2024-26851: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (bsc#1223074)
CVE-2024-27010: net/sched: Fix mirred deadlock on device recursion (bsc#1223720).
CVE-2024-27011: netfilter: nf_tables: fix memleak in map from abort path (bsc#1223803).
CVE-2024-27024: net/rds: fix WARNING in rds_conn_connect_if_down (bsc#1223777).
CVE-2024-27079: iommu/vt-d: Fix NULL domain on device release (bsc#1223742).
CVE-2024-27403: kabi: restore const specifier in flow_offload_route_init() (bsc#1224415).
CVE-2024-27433: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
CVE-2024-35897: netfilter: nf_tables: discard table flag update with pending basechain deletion (bsc#1224510).
CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
CVE-2024-36286: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
CVE-2024-36489: tls: fix missing memory barrier in tls_init (bsc#1226874)
CVE-2024-36881: mm/userfaultfd: Fix reset ptes when close() for wr-protected (bsc#1225718).
CVE-2024-36929: net: core: reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).
CVE-2024-36933: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).
CVE-2024-36979: net: bridge: mst: fix vlan use-after-free (bsc#1226604).
CVE-2024-38662: selftests/bpf: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
CVE-2024-39489: ipv6: sr: fix memleak in seg6_hmac_init_algo (bsc#1227623)
CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).
CVE-2024-40905: ipv6: fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
CVE-2024-40909: bpf: Fix a potential use-after-free in bpf_link_free() (bsc#1227798).
CVE-2024-40920: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
CVE-2024-40921: net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
CVE-2024-40938: landlock: fix d_parent walk (bsc#1227840).
CVE-2024-40939: net: wwan: iosm: Fix tainted…

Record: SUSE-SU-2025:20047-1
Updated: 2026-11-02

OSVUSN-6999-1 No score

linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-lowlatency, linux-oem-6.8, linux-oracle vulnerabilities

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)