CVE-2024-40980

In the Linux kernel, the following vulnerability has been resolved: drop_monitor: replace spin_lock by raw_spin_lock trace_drop_common() is called with preemption disabled, and it acquires a spin_lock. This is problematic for RT kernels because spin_locks are sleeping locks in this configuration, which causes the following splat: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 449, name: rcuc/47 preempt_count: 1, expected: 0 RCU nest depth: 2, expected: 2 5 locks held by rcuc/47/449: #0: ff1100086ec30a60 ((softirq_ctrl.lock)){+.+.}-{2:2}, at: __local_bh_disable_ip+0x105/0x210 #1: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: rt_spin_lock+0xbf/0x130 #2: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: __local_bh_disable_ip+0x11c/0x210 #3: ffffffffb394a160 (rcu_callback){....}-{0:0}, at: rcu_do_batch+0x360/0xc70 #4: ff1100086ee07520 (&data->lock){+.+.}-{2:2}, at: trace_drop_common.constprop.0+0xb5/0x290 irq event stamp: 139909 hardirqs last enabled at (139908): [<ffffffffb1df2b33>] _raw_spin_unlock_irqrestore+0x63/0x80 hardirqs last disabled at (139909): [<ffffffffb19bd03d>] trace_drop_common.constprop.0+0x26d/0x290 softirqs last enabled at (139892): [<ffffffffb07a1083>] __local_bh_enable_ip+0x103/0x170 softirqs last disabled at (139898): [<ffffffffb0909b33>] rcu_cpu_kthread+0x93/0x1f0 Preemption disabled at: [<ffffffffb1de786b>] rt_mutex_slowunlock+0xab/0x2e0 CPU: 47 PID: 449 Comm: rcuc/47 Not tainted 6.9.0-rc2-rt1+ #7 Hardware name: Dell Inc. PowerEdge R650/0Y2G81, BIOS 1.6.5 04/15/2022 Call Trace: <TASK> dump_stack_lvl+0x8c/0xd0 dump_stack+0x14/0x20 __might_resched+0x21e/0x2f0 rt_spin_lock+0x5e/0x130 ? trace_drop_common.constprop.0+0xb5/0x290 ? skb_queue_purge_reason.part.0+0x1bf/0x230 trace_drop_common.constprop.0+0xb5/0x290 ? preempt_count_sub+0x1c/0xd0 ? _raw_spin_unlock_irqrestore+0x4a/0x80 ? __pfx_trace_drop_common.constprop.0+0x10/0x10 ? rt_mutex_slowunlock+0x26a/0x2e0 ? skb_queue_purge_reason.part.0+0x1bf/0x230 ? __pfx_rt_mutex_slowunlock+0x10/0x10 ? skb_queue_purge_reason.part.0+0x1bf/0x230 trace_kfree_skb_hit+0x15/0x20 trace_kfree_skb+0xe9/0x150 kfree_skb_reason+0x7b/0x110 skb_queue_purge_reason.part.0+0x1bf/0x230 ? __pfx_skb_queue_purge_reason.part.0+0x10/0x10 ? mark_lock.part.0+0x8a/0x520 ... trace_drop_common() also disables interrupts, but this is a minor issue because we could easily replace it with a local_lock. Replace the spin_lock with raw_spin_lock to avoid sleeping in atomic context.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

clk: sunxi-ng: Unregister clocks/resets when unbinding

Currently, unbinding a CCU driver unmaps the device's MMIO region, while leaving its clocks/resets and their providers registered. This can cause a page fault later when some clock operation tries to perform MMIO. Fix this by separating the CCU initialization from the memory allocation, and then using a devres callback to unregister the clocks and resets.

This also fixes a memory leak of the struct ccu_reset, and uses the correct owner (the specific platform driver) for the clocks and resets.

Early OF clock providers are never unregistered, and limited error handling is possible, so they are mostly unchanged. The error reporting is made more consistent by moving the message inside of_sunxi_ccu_probe.(CVE-2021-47205)

In the Linux kernel, the following vulnerability has been resolved:

thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR

In some case, the GDDV returns a package with a buffer which has zero length. It causes that kmemdup() returns ZERO_SIZE_PTR (0x10).

Then the data_vault_read() got NULL point dereference problem when accessing the 0x10 value in data_vault.

[ 71.024560] BUG: kernel NULL pointer dereference, address: 0000000000000010

This patch uses ZERO_OR_NULL_PTR() for checking ZERO_SIZE_PTR or NULL value in data_vault.(CVE-2022-48703)

In the Linux kernel, the following vulnerability has been resolved:

net/smc: Avoid overwriting the copies of clcsock callback functions

The callback functions of clcsock will be saved and replaced during the fallback. But if the fallback happens more than once, then the copies of these callback functions will be overwritten incorrectly, resulting in a loop call issue:

clcsk->sk_error_report |- smc_fback_error_report() <------------------------------| |- smc_fback_forward_wakeup() | (loop) |- clcsock_callback() (incorrectly overwritten) | |- smc->clcsk_error_report() ------------------|

So this patch fixes the issue by saving these function pointers only once in the fallback and avoiding overwriting.(CVE-2022-48780)

In the Linux kernel, the following vulnerability has been resolved:

net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr

This node pointer is returned by of_find_compatible_node() with refcount incremented. Calling of_node_put() to aovid the refcount leak.(CVE-2022-48859)

In the Linux kernel, the following vulnerability has been resolved:

of: Fix double free in of_parse_phandle_with_args_map

In of_parse_phandle_with_args_map() the inner loop that iterates through the map entries calls of_node_put(new) to free the reference acquired by the previous iteration of the inner loop. This assumes that the value of "new" is NULL on the first iteration of the inner loop.

Make sure that this is true in all iterations of the outer loop by setting "new" to NULL after its value is assigned to "cur".

Extend the unittest to detect the double free and add an additional test case that actually triggers this path.(CVE-2023-52679)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_pipapo: do not free live element

Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo:

add_elem("00000000") timeout 100 ms ... add_elem("0000000X") timeout 100 ms del_elem("0000000X") <---------------- delete one that was just added ... add_elem("00005000") timeout 100 ms

1. nft_pipapo_remove() removes element 0000000X Then, KASAN shows a splat.

Looking at the remove function there is a chance that we will drop a rule that maps…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

clk: sunxi-ng: Unregister clocks/resets when unbinding

Currently, unbinding a CCU driver unmaps the device's MMIO region, while leaving its clocks/resets and their providers registered. This can cause a page fault later when some clock operation tries to perform MMIO. Fix this by separating the CCU initialization from the memory allocation, and then using a devres callback to unregister the clocks and resets.

This also fixes a memory leak of the struct ccu_reset, and uses the correct owner (the specific platform driver) for the clocks and resets.

Early OF clock providers are never unregistered, and limited error handling is possible, so they are mostly unchanged. The error reporting is made more consistent by moving the message inside of_sunxi_ccu_probe.(CVE-2021-47205)

In the Linux kernel, the following vulnerability has been resolved:

thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR

In some case, the GDDV returns a package with a buffer which has zero length. It causes that kmemdup() returns ZERO_SIZE_PTR (0x10).

Then the data_vault_read() got NULL point dereference problem when accessing the 0x10 value in data_vault.

[ 71.024560] BUG: kernel NULL pointer dereference, address: 0000000000000010

This patch uses ZERO_OR_NULL_PTR() for checking ZERO_SIZE_PTR or NULL value in data_vault.(CVE-2022-48703)

In the Linux kernel, the following vulnerability has been resolved:

net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr

This node pointer is returned by of_find_compatible_node() with refcount incremented. Calling of_node_put() to aovid the refcount leak.(CVE-2022-48859)

In the Linux kernel, the following vulnerability has been resolved:

of: Fix double free in of_parse_phandle_with_args_map

In of_parse_phandle_with_args_map() the inner loop that iterates through the map entries calls of_node_put(new) to free the reference acquired by the previous iteration of the inner loop. This assumes that the value of "new" is NULL on the first iteration of the inner loop.

Make sure that this is true in all iterations of the outer loop by setting "new" to NULL after its value is assigned to "cur".

Extend the unittest to detect the double free and add an additional test case that actually triggers this path.(CVE-2023-52679)

In the Linux kernel, the following vulnerability has been resolved:

media: gspca: cpia1: shift-out-of-bounds in set_flicker

Syzkaller reported the following issue: UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27 shift exponent 245 is too large for 32-bit type 'int'

When the value of the variable "sd->params.exposure.gain" exceeds the number of bits in an integer, a shift-out-of-bounds error is reported. It is triggered because the variable "currentexp" cannot be left-shifted by more than the number of bits in an integer. In order to avoid invalid range during left-shift, the conditional expression is added.(CVE-2023-52764)

In the Linux kernel, the following vulnerability has been resolved:

init/main.c: Fix potential static_command_line memory overflow

We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for static_command_line, but the strings copied into static_command_line are extra_command_line and command_line, rather than extra_command_line and boot_command_line.

When strlen(command_line) > strlen(boot_command_line), static_command_line will overflow.

This patch just recovers strlen(command_line) which was miss-consolidated with strlen(boot_command_line) in the commit f5c7310ac73e ("init/main: add checks for the return value of memblock_alloc*()")(CVE-2024-26988)

In the Linux kernel, the following…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Skip do PCI error slot reset during RAS recovery

Why: The PCI error slot reset maybe triggered after inject ue to UMC multi times, this caused system hang. [ 557.371857] amdgpu 0000:af:00.0: amdgpu: GPU reset succeeded, trying to resume [ 557.373718] [drm] PCIE GART of 512M enabled. [ 557.373722] [drm] PTB located at 0x0000031FED700000 [ 557.373788] [drm] VRAM is lost due to GPU reset! [ 557.373789] [drm] PSP is resuming... [ 557.547012] mlx5_core 0000:55:00.0: mlx5_pci_err_detected Device state = 1 pci_status: 0. Exit, result = 3, need reset [ 557.547067] [drm] PCI error: detected callback, state(1)!! [ 557.547069] [drm] No support for XGMI hive yet... [ 557.548125] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 0. Enter [ 557.607763] mlx5_core 0000:55:00.0: wait vital counter value 0x16b5b after 1 iterations [ 557.607777] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 1. Exit, err = 0, result = 5, recovered [ 557.610492] [drm] PCI error: slot reset callback!! ... [ 560.689382] amdgpu 0000:3f:00.0: amdgpu: GPU reset(2) succeeded! [ 560.689546] amdgpu 0000:5a:00.0: amdgpu: GPU reset(2) succeeded! [ 560.689562] general protection fault, probably for non-canonical address 0x5f080b54534f611f: 0000 [#1] SMP NOPTI [ 560.701008] CPU: 16 PID: 2361 Comm: kworker/u448:9 Tainted: G OE 5.15.0-91-generic #101-Ubuntu [ 560.712057] Hardware name: Microsoft C278A/C278A, BIOS C2789.5.BS.1C11.AG.1 11/08/2023 [ 560.720959] Workqueue: amdgpu-reset-hive amdgpu_ras_do_recovery [amdgpu] [ 560.728887] RIP: 0010:amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu] [ 560.736891] Code: ff 41 89 c6 e9 1b ff ff ff 44 0f b6 45 b0 e9 4f ff ff ff be 01 00 00 00 4c 89 e7 e8 76 c9 8b ff 44 0f b6 45 b0 e9 3c fd ff ff <48> 83 ba 18 02 00 00 00 0f 84 6a f8 ff ff 48 8d 7a 78 be 01 00 00 [ 560.757967] RSP: 0018:ffa0000032e53d80 EFLAGS: 00010202 [ 560.763848] RAX: ffa00000001dfd10 RBX: ffa0000000197090 RCX: ffa0000032e53db0 [ 560.771856] RDX: 5f080b54534f5f07 RSI: 0000000000000000 RDI: ff11000128100010 [ 560.779867] RBP: ffa0000032e53df0 R08: 0000000000000000 R09: ffffffffffe77f08 [ 560.787879] R10: 0000000000ffff0a R11: 0000000000000001 R12: 0000000000000000 [ 560.795889] R13: ffa0000032e53e00 R14: 0000000000000000 R15: 0000000000000000 [ 560.803889] FS: 0000000000000000(0000) GS:ff11007e7e800000(0000) knlGS:0000000000000000 [ 560.812973] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 560.819422] CR2: 000055a04c118e68 CR3: 0000000007410005 CR4: 0000000000771ee0 [ 560.827433] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 560.835433] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 560.843444] PKRU: 55555554 [ 560.846480] Call Trace: [ 560.849225] <TASK> [ 560.851580] ? show_trace_log_lvl+0x1d6/0x2ea [ 560.856488] ? show_trace_log_lvl+0x1d6/0x2ea [ 560.861379] ? amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu] [ 560.867778] ? show_regs.part.0+0x23/0x29 [ 560.872293] ? __die_body.cold+0x8/0xd [ 560.876502] ? die_addr+0x3e/0x60 [ 560.880238] ? exc_general_protection+0x1c5/0x410 [ 560.885532] ? asm_exc_general_protection+0x27/0x30 [ 560.891025] ? amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu] [ 560.898323] amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu] [ 560.904520] process_one_work+0x228/0x3d0 How: In RAS recovery, mode-1 reset is issued from RAS fatal error handling and expected all the nodes in a hive to be reset. no need to issue another mode-1 during this procedure.(CVE-2024-35931)

In the Linux kernel, the following vulnerability…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

clk: sunxi-ng: Unregister clocks/resets when unbinding

Currently, unbinding a CCU driver unmaps the device's MMIO region, while leaving its clocks/resets and their providers registered. This can cause a page fault later when some clock operation tries to perform MMIO. Fix this by separating the CCU initialization from the memory allocation, and then using a devres callback to unregister the clocks and resets.

This also fixes a memory leak of the struct ccu_reset, and uses the correct owner (the specific platform driver) for the clocks and resets.

Early OF clock providers are never unregistered, and limited error handling is possible, so they are mostly unchanged. The error reporting is made more consistent by moving the message inside of_sunxi_ccu_probe.(CVE-2021-47205)

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Fix ia_size underflow

iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file size values an NFS client can send that is already larger than Linux can handle.

Currently decode_fattr4() dumps a full u64 value into ia_size. If that value happens to be larger than S64_MAX, then ia_size underflows. I'm about to fix up the NFSv3 behavior as well, so let's catch the underflow in the common code path: nfsd_setattr().(CVE-2022-48828)

In the Linux kernel, the following vulnerability has been resolved:

net: mvpp2: clear BM pool before initialization

Register value persist after booting the kernel using kexec which results in kernel panic. Thus clear the BM pool registers before initialisation to fix the issue.(CVE-2024-35837)

In the Linux kernel, the following vulnerability has been resolved:

drivers: core: synchronize really_probe() and dev_uevent()

Synchronize the dev->driver usage in really_probe() and dev_uevent(). These can run in different threads, what can result in the following race condition for dev->driver uninitialization:

Thread #1:

really_probe() { ... probe_failed: ... device_unbind_cleanup(dev) { ... dev->driver = NULL; // <= Failed probe sets dev->driver to NULL ... } ... }

Thread #2:

dev_uevent() { ... if (dev->driver) // If dev->driver is NULLed from really_probe() from here on, // after above check, the system crashes add_uevent_var(env, "DRIVER=%s", dev->driver->name); ... }

really_probe() holds the lock, already. So nothing needs to be done there. dev_uevent() is called with lock held, often, too. But not always. What implies that we can't add any locking in dev_uevent() itself. So fix this race by adding the lock to the non-protected path. This is the path where above race is observed:

dev_uevent+0x235/0x380 uevent_show+0x10c/0x1f0 <= Add lock here dev_attr_show+0x3a/0xa0 sysfs_kf_seq_show+0x17c/0x250 kernfs_seq_show+0x7c/0x90 seq_read_iter+0x2d7/0x940 kernfs_fop_read_iter+0xc6/0x310 vfs_read+0x5bc/0x6b0 ksys_read+0xeb/0x1b0 __x64_sys_read+0x42/0x50 x64_sys_call+0x27ad/0x2d30 do_syscall_64+0xcd/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Similar cases are reported by syzkaller in

https://syzkaller.appspot.com/bug?extid=ffa8143439596313a85a

But these are regarding the initialization of dev->driver

dev->driver = drv;

As this switches dev->driver to non-NULL these reports can be considered to be false-positives (which should be "fixed" by this commit, as well, though).

The same issue was reported and tried to be fixed back in 2015 in

https://lore.kernel.org/lkml/[email protected]/

already.(CVE-2024-39501)

In the Linux kernel, the following vulnerability has…

In the Linux kernel, the following vulnerability has been resolved: drop_monitor: replace spin_lock by raw_spin_lock trace_drop_common() is called with preemption disabled, and it acquires a spin_lock. This is problematic for RT kernels because spin_locks are sleeping locks in this configuration, which causes the following splat: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 449, name: rcuc/47 preempt_count: 1, expected: 0 RCU nest depth: 2, expected: 2 5 locks held by rcuc/47/449: #0: ff1100086ec30a60 ((softirq_ctrl.lock)){+.+.}-{2:2}, at: __local_bh_disable_ip+0x105/0x210 #1: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: rt_spin_lock+0xbf/0x130 #2: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: __local_bh_disable_ip+0x11c/0x210 #3: ffffffffb394a160 (rcu_callback){....}-{0:0}, at: rcu_do_batch+0x360/0xc70 #4: ff1100086ee07520 (&data->lock){+.+.}-{2:2}, at: trace_drop_common.constprop.0+0xb5/0x290 irq event stamp: 139909 hardirqs last enabled at (139908): [<ffffffffb1df2b33>] _raw_spin_unlock_irqrestore+0x63/0x80 hardirqs last disabled at (139909): [<ffffffffb19bd03d>] trace_drop_common.constprop.0+0x26d/0x290 softirqs last enabled at (139892): [<ffffffffb07a1083>] __local_bh_enable_ip+0x103/0x170 softirqs last disabled at (139898): [<ffffffffb0909b33>] rcu_cpu_kthread+0x93/0x1f0 Preemption disabled at: [<ffffffffb1de786b>] rt_mutex_slowunlock+0xab/0x2e0 CPU: 47 PID: 449 Comm: rcuc/47 Not tainted 6.9.0-rc2-rt1+ #7 Hardware name: Dell Inc. PowerEdge R650/0Y2G81, BIOS 1.6.5 04/15/2022 Call Trace: <TASK> dump_stack_lvl+0x8c/0xd0 dump_stack+0x14/0x20 __might_resched+0x21e/0x2f0 rt_spin_lock+0x5e/0x130 ? trace_drop_common.constprop.0+0xb5/0x290 ? skb_queue_purge_reason.part.0+0x1bf/0x230 trace_drop_common.constprop.0+0xb5/0x290 ? preempt_count_sub+0x1c/0xd0 ? _raw_spin_unlock_irqrestore+0x4a/0x80 ? __pfx_trace_drop_common.constprop.0+0x10/0x10 ? rt_mutex_slowunlock+0x26a/0x2e0 ? skb_queue_purge_reason.part.0+0x1bf/0x230 ? __pfx_rt_mutex_slowunlock+0x10/0x10 ? skb_queue_purge_reason.part.0+0x1bf/0x230 trace_kfree_skb_hit+0x15/0x20 trace_kfree_skb+0xe9/0x150 kfree_skb_reason+0x7b/0x110 skb_queue_purge_reason.part.0+0x1bf/0x230 ? __pfx_skb_queue_purge_reason.part.0+0x10/0x10 ? mark_lock.part.0+0x8a/0x520 ... trace_drop_common() also disables interrupts, but this is a minor issue because we could easily replace it with a local_lock. Replace the spin_lock with raw_spin_lock to avoid sleeping in atomic context.

• CVE-url: https://ubuntu.com/security/CVE-2024-26752
  • l2tp: pass correct message length to ip6_append_data
• CVE-url: https://ubuntu.com/security/CVE-2023-52527
  • ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
• CVE-url: https://ubuntu.com/security/CVE-2024-43882
  • exec: Fix ToCToU between perm check and set-uid/gid usage
• CVE-url: https://ubuntu.com/security/CVE-2022-48943
  • KVM: x86/mmu: make apf token non-zero to fix bug
• CVE-url: https://ubuntu.com/security/CVE-2024-38630
  • watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
• CVE-url: https://ubuntu.com/security/CVE-2024-44987
  • ipv6: prevent UAF in ip6_send_skb()
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48742
  • rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
• CVE-url: https://ubuntu.com/security/CVE-2024-44940
  • fou: remove warn in gue_gro_receive on unsupported protocol
• CVE-url: https://ubuntu.com/security/CVE-2024-41059
  • hfsplus: fix uninit-value in copy_name
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47576
  • scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
• CVE-url: https://ubuntu.com/security/CVE-2024-46673
  • scsi: aacraid: Fix double-free on probe failure
• CVE-url: https://ubuntu.com/security/CVE-2024-42271
  • net/iucv: fix use after free in iucv_sock_close()
• Bionic update: upstream stable patchset 2022-04-13 (LP: #1968932) // CVE- url: https://ubuntu.com/security/CVE-2022-48919
  • cifs: fix double free race when mount fails in cifs_get_root()
• CVE-url: https://ubuntu.com/security/CVE-2024-43858
  • jfs: Fix array-index-out-of-bounds in diFree
• CVE-url: https://ubuntu.com/security/CVE-2024-41071
  • wifi: mac80211: Avoid address calculations via out of bounds array indexing
• CVE-url: https://ubuntu.com/security/CVE-2024-42301
  • dev/parport: fix the array out-of-bounds risk
• CVE-url: https://ubuntu.com/security/CVE-2024-46674
  • usb: dwc3: st: fix probed platform device ref count on probe error path
• CVE-url: https://ubuntu.com/security/CVE-2024-43900
  • media: xc2028: avoid use-after-free in load_firmware_cb()
• CVE-url: https://ubuntu.com/security/CVE-2024-42284
  • tipc: Return non-zero value from tipc_udp_addr2str() on error
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47589
  • igbvf: fix double free in igbvf_probe
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47600
  • dm btree remove: fix use after free in rebalance_children()
• CVE-url: https://ubuntu.com/security/CVE-2024-44998
  • atm: idt77252: prevent use after free in dequeue_rx()
• CVE-url: https://ubuntu.com/security/CVE-2024-42280
  • mISDN: Fix a use after free in hfcmulti_tx()
• CVE-url: https://ubuntu.com/security/CVE-2024-42094
  • net/iucv: Avoid explicit cpumask var allocation on stack
• CVE-url: https://ubuntu.com/security/CVE-2024-39499
  • vmci: prevent speculation leaks by sanitizing event in event_deliver()
• CVE-url: https://ubuntu.com/security/CVE-2024-42105
  • nilfs2: fix inode number range checks
• CVE-url: https://ubuntu.com/security/CVE-2024-40988
  • drm/radeon: fix UBSAN warning in kv_dpm.c
• CVE-url: https://ubuntu.com/security/CVE-2024-40916
  • drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found
• CVE-url: https://ubuntu.com/security/CVE-2024-40904
  • USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
• CVE-url: https://ubuntu.com/security/CVE-2024-42106
  • inet_diag: Initialize pad field in struct…

• CVE-url: https://ubuntu.com/security/CVE-2024-26752
  • l2tp: pass correct message length to ip6_append_data
• CVE-url: https://ubuntu.com/security/CVE-2023-52527
  • ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
• CVE-url: https://ubuntu.com/security/CVE-2024-43882
  • exec: Fix ToCToU between perm check and set-uid/gid usage
• CVE-url: https://ubuntu.com/security/CVE-2022-48943
  • KVM: x86/mmu: make apf token non-zero to fix bug
• CVE-url: https://ubuntu.com/security/CVE-2024-38630
  • watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
• CVE-url: https://ubuntu.com/security/CVE-2024-44987
  • ipv6: prevent UAF in ip6_send_skb()
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48742
  • rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
• CVE-url: https://ubuntu.com/security/CVE-2024-44940
  • fou: remove warn in gue_gro_receive on unsupported protocol
• CVE-url: https://ubuntu.com/security/CVE-2024-41059
  • hfsplus: fix uninit-value in copy_name
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47576
  • scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
• CVE-url: https://ubuntu.com/security/CVE-2024-46673
  • scsi: aacraid: Fix double-free on probe failure
• CVE-url: https://ubuntu.com/security/CVE-2024-42271
  • net/iucv: fix use after free in iucv_sock_close()
• Bionic update: upstream stable patchset 2022-04-13 (LP: #1968932) // CVE- url: https://ubuntu.com/security/CVE-2022-48919
  • cifs: fix double free race when mount fails in cifs_get_root()
• CVE-url: https://ubuntu.com/security/CVE-2024-43858
  • jfs: Fix array-index-out-of-bounds in diFree
• CVE-url: https://ubuntu.com/security/CVE-2024-41071
  • wifi: mac80211: Avoid address calculations via out of bounds array indexing
• CVE-url: https://ubuntu.com/security/CVE-2024-42301
  • dev/parport: fix the array out-of-bounds risk
• CVE-url: https://ubuntu.com/security/CVE-2024-46674
  • usb: dwc3: st: fix probed platform device ref count on probe error path
• CVE-url: https://ubuntu.com/security/CVE-2024-43900
  • media: xc2028: avoid use-after-free in load_firmware_cb()
• CVE-url: https://ubuntu.com/security/CVE-2024-42284
  • tipc: Return non-zero value from tipc_udp_addr2str() on error
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47589
  • igbvf: fix double free in igbvf_probe
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47600
  • dm btree remove: fix use after free in rebalance_children()
• CVE-url: https://ubuntu.com/security/CVE-2024-44998
  • atm: idt77252: prevent use after free in dequeue_rx()
• CVE-url: https://ubuntu.com/security/CVE-2024-42280
  • mISDN: Fix a use after free in hfcmulti_tx()
• CVE-url: https://ubuntu.com/security/CVE-2024-42094
  • net/iucv: Avoid explicit cpumask var allocation on stack
• CVE-url: https://ubuntu.com/security/CVE-2024-39499
  • vmci: prevent speculation leaks by sanitizing event in event_deliver()
• CVE-url: https://ubuntu.com/security/CVE-2024-42105
  • nilfs2: fix inode number range checks
• CVE-url: https://ubuntu.com/security/CVE-2024-40988
  • drm/radeon: fix UBSAN warning in kv_dpm.c
• CVE-url: https://ubuntu.com/security/CVE-2024-40916
  • drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found
• CVE-url: https://ubuntu.com/security/CVE-2024-40904
  • USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
• CVE-url: https://ubuntu.com/security/CVE-2024-42106
  • inet_diag: Initialize pad field in struct…

• CVE-url: https://ubuntu.com/security/CVE-2024-26752
  • l2tp: pass correct message length to ip6_append_data
• CVE-url: https://ubuntu.com/security/CVE-2021-47188
  • scsi: ufs: core: Improve SCSI abort handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26677
  • rxrpc: Fix delayed ACKs to not set the reference serial number
• CVE-url: https://ubuntu.com/security/CVE-2023-52527
  • ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
• CVE-url: https://ubuntu.com/security/CVE-2024-43882
  • exec: Fix ToCToU between perm check and set-uid/gid usage
• CVE-url: https://ubuntu.com/security/CVE-2022-48943
  • KVM: x86/mmu: make apf token non-zero to fix bug
• CVE-url: https://ubuntu.com/security/CVE-2024-38630
  • watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
• CVE-url: https://ubuntu.com/security/CVE-2024-44987
  • ipv6: prevent UAF in ip6_send_skb()
• CVE-url: https://ubuntu.com/security/CVE-2024-42285
  • RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
• CVE-url: https://ubuntu.com/security/CVE-2022-48733
  • btrfs: fix use-after-free after failure to create a snapshot
• CVE-url: https://ubuntu.com/security/CVE-2024-44940
  • fou: remove warn in gue_gro_receive on unsupported protocol
• CVE-url: https://ubuntu.com/security/CVE-2024-41059
  • hfsplus: fix uninit-value in copy_name
• CVE-url: https://ubuntu.com/security/CVE-2024-46673
  • scsi: aacraid: Fix double-free on probe failure
• CVE-url: https://ubuntu.com/security/CVE-2024-42313
  • media: venus: fix use after free in vdec_close
• CVE-url: https://ubuntu.com/security/CVE-2024-44999
  • gtp: pull network headers in gtp_dev_xmit()
• CVE-url: https://ubuntu.com/security/CVE-2024-42271
  • net/iucv: fix use after free in iucv_sock_close()
• CVE-url: https://ubuntu.com/security/CVE-2024-44942
  • f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
• CVE-url: https://ubuntu.com/security/CVE-2024-43858
  • jfs: Fix array-index-out-of-bounds in diFree
• CVE-url: https://ubuntu.com/security/CVE-2024-41071
  • wifi: mac80211: Avoid address calculations via out of bounds array indexing
• CVE-url: https://ubuntu.com/security/CVE-2024-42301
  • dev/parport: fix the array out-of-bounds risk
• CVE-url: https://ubuntu.com/security/CVE-2024-46674
  • usb: dwc3: st: fix probed platform device ref count on probe error path
• CVE-url: https://ubuntu.com/security/CVE-2024-43900
  • media: xc2028: avoid use-after-free in load_firmware_cb()
• CVE-url: https://ubuntu.com/security/CVE-2024-42284
  • tipc: Return non-zero value from tipc_udp_addr2str() on error
• CVE-url: https://ubuntu.com/security/CVE-2024-44998
  • atm: idt77252: prevent use after free in dequeue_rx()
• CVE-url: https://ubuntu.com/security/CVE-2024-42280
  • mISDN: Fix a use after free in hfcmulti_tx()
• CVE-url: https://ubuntu.com/security/CVE-2024-39503
  • netns: add pre_exit method to struct pernet_operations
  • netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
• CVE-url: https://ubuntu.com/security/CVE-2024-39499
  • vmci: prevent speculation leaks by sanitizing event in event_deliver()
• CVE-url: https://ubuntu.com/security/CVE-2024-40988
  • drm/radeon: fix UBSAN warning in kv_dpm.c
• CVE-url: https://ubuntu.com/security/CVE-2024-40916
  • drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found
• CVE-url: https://ubuntu.com/security/CVE-2024-40904
  • USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
• CVE-url: https://ubuntu.com/security/CVE-2024-39506
  • liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
• CVE-url: https://ubuntu.com/security/CVE-2024-42106
  • inet_diag: Initialize pad field in struct inet_diag_req_v2
• CVE-url:…

[ Ubuntu: 4.15.0-237.248 ]

• CVE-url: https://ubuntu.com/security/CVE-2024-26752
  • l2tp: pass correct message length to ip6_append_data
• CVE-url: https://ubuntu.com/security/CVE-2021-47188
  • scsi: ufs: core: Improve SCSI abort handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26677
  • rxrpc: Fix delayed ACKs to not set the reference serial number
• CVE-url: https://ubuntu.com/security/CVE-2023-52527
  • ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
• CVE-url: https://ubuntu.com/security/CVE-2024-43882
  • exec: Fix ToCToU between perm check and set-uid/gid usage
• CVE-url: https://ubuntu.com/security/CVE-2022-48943
  • KVM: x86/mmu: make apf token non-zero to fix bug
• CVE-url: https://ubuntu.com/security/CVE-2024-38630
  • watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
• CVE-url: https://ubuntu.com/security/CVE-2024-44987
  • ipv6: prevent UAF in ip6_send_skb()
• CVE-url: https://ubuntu.com/security/CVE-2024-42285
  • RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
• CVE-url: https://ubuntu.com/security/CVE-2022-48733
  • btrfs: fix use-after-free after failure to create a snapshot
• CVE-url: https://ubuntu.com/security/CVE-2024-44940
  • fou: remove warn in gue_gro_receive on unsupported protocol
• CVE-url: https://ubuntu.com/security/CVE-2024-41059
  • hfsplus: fix uninit-value in copy_name
• CVE-url: https://ubuntu.com/security/CVE-2024-46673
  • scsi: aacraid: Fix double-free on probe failure
• CVE-url: https://ubuntu.com/security/CVE-2024-42313
  • media: venus: fix use after free in vdec_close
• CVE-url: https://ubuntu.com/security/CVE-2024-44999
  • gtp: pull network headers in gtp_dev_xmit()
• CVE-url: https://ubuntu.com/security/CVE-2024-42271
  • net/iucv: fix use after free in iucv_sock_close()
• CVE-url: https://ubuntu.com/security/CVE-2024-44942
  • f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
• CVE-url: https://ubuntu.com/security/CVE-2024-43858
  • jfs: Fix array-index-out-of-bounds in diFree
• CVE-url: https://ubuntu.com/security/CVE-2024-41071
  • wifi: mac80211: Avoid address calculations via out of bounds array indexing
• CVE-url: https://ubuntu.com/security/CVE-2024-42301
  • dev/parport: fix the array out-of-bounds risk
• CVE-url: https://ubuntu.com/security/CVE-2024-46674
  • usb: dwc3: st: fix probed platform device ref count on probe error path
• CVE-url: https://ubuntu.com/security/CVE-2024-43900
  • media: xc2028: avoid use-after-free in load_firmware_cb()
• CVE-url: https://ubuntu.com/security/CVE-2024-42284
  • tipc: Return non-zero value from tipc_udp_addr2str() on error
• CVE-url: https://ubuntu.com/security/CVE-2024-44998
  • atm: idt77252: prevent use after free in dequeue_rx()
• CVE-url: https://ubuntu.com/security/CVE-2024-42280
  • mISDN: Fix a use after free in hfcmulti_tx()
• CVE-url: https://ubuntu.com/security/CVE-2024-39503
  • netns: add pre_exit method to struct pernet_operations
  • netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
• CVE-url: https://ubuntu.com/security/CVE-2024-39499
  • vmci: prevent speculation leaks by sanitizing event in event_deliver()
• CVE-url: https://ubuntu.com/security/CVE-2024-40988
  • drm/radeon: fix UBSAN warning in kv_dpm.c
• CVE-url: https://ubuntu.com/security/CVE-2024-40916
  • drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found
• CVE-url: https://ubuntu.com/security/CVE-2024-40904
  • USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
• CVE-url: https://ubuntu.com/security/CVE-2024-39506
  • liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
• CVE-url: https://ubuntu.com/security/CVE-2024-42106
  • inet_diag: Initialize pad field in struct inet_diag_req_v2 …

• CVE-url: https://ubuntu.com/security/CVE-2024-26752
  • l2tp: pass correct message length to ip6_append_data
• CVE-url: https://ubuntu.com/security/CVE-2021-47188
  • scsi: ufs: core: Improve SCSI abort handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26677
  • rxrpc: Fix delayed ACKs to not set the reference serial number
• CVE-url: https://ubuntu.com/security/CVE-2023-52527
  • ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
• CVE-url: https://ubuntu.com/security/CVE-2024-43882
  • exec: Fix ToCToU between perm check and set-uid/gid usage
• CVE-url: https://ubuntu.com/security/CVE-2022-48943
  • KVM: x86/mmu: make apf token non-zero to fix bug
• CVE-url: https://ubuntu.com/security/CVE-2024-38630
  • watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
• CVE-url: https://ubuntu.com/security/CVE-2024-44987
  • ipv6: prevent UAF in ip6_send_skb()
• CVE-url: https://ubuntu.com/security/CVE-2024-42285
  • RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
• CVE-url: https://ubuntu.com/security/CVE-2022-48733
  • btrfs: fix use-after-free after failure to create a snapshot
• CVE-url: https://ubuntu.com/security/CVE-2024-44940
  • fou: remove warn in gue_gro_receive on unsupported protocol
• CVE-url: https://ubuntu.com/security/CVE-2024-41059
  • hfsplus: fix uninit-value in copy_name
• CVE-url: https://ubuntu.com/security/CVE-2024-46673
  • scsi: aacraid: Fix double-free on probe failure
• CVE-url: https://ubuntu.com/security/CVE-2024-42313
  • media: venus: fix use after free in vdec_close
• CVE-url: https://ubuntu.com/security/CVE-2024-44999
  • gtp: pull network headers in gtp_dev_xmit()
• CVE-url: https://ubuntu.com/security/CVE-2024-42271
  • net/iucv: fix use after free in iucv_sock_close()
• CVE-url: https://ubuntu.com/security/CVE-2024-44942
  • f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
• CVE-url: https://ubuntu.com/security/CVE-2024-43858
  • jfs: Fix array-index-out-of-bounds in diFree
• CVE-url: https://ubuntu.com/security/CVE-2024-41071
  • wifi: mac80211: Avoid address calculations via out of bounds array indexing
• CVE-url: https://ubuntu.com/security/CVE-2024-42301
  • dev/parport: fix the array out-of-bounds risk
• CVE-url: https://ubuntu.com/security/CVE-2024-46674
  • usb: dwc3: st: fix probed platform device ref count on probe error path
• CVE-url: https://ubuntu.com/security/CVE-2024-43900
  • media: xc2028: avoid use-after-free in load_firmware_cb()
• CVE-url: https://ubuntu.com/security/CVE-2024-42284
  • tipc: Return non-zero value from tipc_udp_addr2str() on error
• CVE-url: https://ubuntu.com/security/CVE-2024-44998
  • atm: idt77252: prevent use after free in dequeue_rx()
• CVE-url: https://ubuntu.com/security/CVE-2024-42280
  • mISDN: Fix a use after free in hfcmulti_tx()
• CVE-url: https://ubuntu.com/security/CVE-2024-39503
  • netns: add pre_exit method to struct pernet_operations
  • netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
• CVE-url: https://ubuntu.com/security/CVE-2024-39499
  • vmci: prevent speculation leaks by sanitizing event in event_deliver()
• CVE-url: https://ubuntu.com/security/CVE-2024-40988
  • drm/radeon: fix UBSAN warning in kv_dpm.c
• CVE-url: https://ubuntu.com/security/CVE-2024-40916
  • drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found
• CVE-url: https://ubuntu.com/security/CVE-2024-40904
  • USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
• CVE-url: https://ubuntu.com/security/CVE-2024-39506
  • liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
• CVE-url: https://ubuntu.com/security/CVE-2024-42106
  • inet_diag: Initialize pad field in struct inet_diag_req_v2
• CVE-url:…

• gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully {CVE-2022-48660}
• ipv4: check for NULL idev in ip_route_use_hint() {CVE-2024-36008}
• KEYS: trusted: Do not use WARN when encode fails {CVE-2024-36975}
• Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027}
• xhci: Fix null pointer dereference when host dies {CVE-2023-52898}
• sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
• blk-mq: fix IO hang from sbitmap wakeup race {CVE-2024-26671}
• net: openvswitch: fix flow memory leak in ovs_flow_cmd_new {CVE-2023-52977}
• gpiolib: fix memory leak in gpiochip_setup_dev() {CVE-2022-48975}
• HID: betop: check shape of output reports {CVE-2023-53015}
• mm/swapfile: add cond_resched() in get_swap_pages() {CVE-2023-52932}
• HV: hv_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-52937}
• drm/i915: Fix a memory leak with reused mmap_offset {CVE-2023-53002}
• ptdma: pt_core_execute_cmd() should use spinlock {CVE-2023-53013}
• RDMA/core: Fix ib block iterator counter overflow {CVE-2023-53026}
• Bluetooth: hci_conn: Fix memory leaks {CVE-2023-53018}
• scsi: target: pscsi: Fix bio_put() for error case {CVE-2024-26760}
• sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}
• pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
• cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}
• ALSA: hda/cs8409: Fix possible NULL dereference {CVE-2024-50160}
• nbd: don't allow reconnect after disconnect {CVE-2025-21731}
• openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
• ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
• ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}
• net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
• wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
• ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
• ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping {CVE-2025-40121}
• i40e: Fix macvlan leak by synchronizing access to mac_filter_hash {CVE-2024-50041}
• net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() {CVE-2024-50000}
• bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}
• xsk: check IFF_UP earlier in Tx path {CVE-2023-53240}
• firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
• virtgpu: don't reset on shutdown {CVE-2025-38064}
• xen/netfront: fix crash when removing device {CVE-2022-48969}
• mptcp: do not fallback when OoO is present {CVE-2024-50185}
• can: j1939: add missing calls in NETDEV_UNREGISTER notification handler {CVE-2025-39925}
• netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160}
• xfs: fix use-after-free in xattr node block inactivation {CVE-2026-43053}
• ext4: fix racy may inline data check in dio write {CVE-2023-52786}
• drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini {CVE-2023-52738}
• macsec: fix UAF bug for real_dev {CVE-2022-49390}
• drm/i915/gem: Fix Virtual Memory mapping boundaries calculation {CVE-2024-42259}
• mm/shmem: disable PMD-sized page cache if needed {CVE-2024-42241}
• driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
• udmabuf: fix memory leak on last export_udmabuf() error path {CVE-2024-56712}
• ALSA: control: Avoid WARN() for symlink errors {CVE-2024-56657}
• mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM {CVE-2024-56611}
• eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}
• net: annotate data-races around sk->sk_{data_ready,write_space} {CVE-2026-23302}
• udmabuf: change folios array from kmalloc to kvmalloc {CVE-2024-56544}
• RDMA/mlx5: Move events notifier registration to be after device registration {CVE-2024-53224}
• dlm: fix possible lkb_resource…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-44947: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454).
• CVE-2024-36936: Touch soft lockup during memory accept (bsc#1225773).
• CVE-2022-48706: Do proper cleanup if IFCVF init fails (bsc#1225524).
• CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).
• CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
• CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).
• CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
• CVE-2024-43893: Check uartclk for zero to avoid divide by zero (bsc#1229759).
• CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
• CVE-2024-43900: Avoid use-after-free in load_firmware_cb() (bsc#1229756).
• CVE-2024-44938: Fix shift-out-of-bounds in dbDiscardAG (bsc#1229792).
• CVE-2024-44939: fix null ptr deref in dtInsertEntry (bsc#1229820).
• CVE-2024-41087: Fix double free on error (CVE-2024-41087,bsc#1228466).
• CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
• CVE-2024-43902: Add null checker before passing variables (bsc#1229767).
• CVE-2024-43904: Add null checks for 'stream' and 'plane' before dereferencing (bsc#1229768)
• CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
• CVE-2024-43884: Add error handling to pair_device() (bsc#1229739)
• CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
• CVE-2022-48920: Get rid of warning on transaction commit when using flushoncommit (bsc#1229658).
• CVE-2023-52906: Fix warning during failed attribute validation (bsc#1229527).
• CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
• CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
• CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
• CVE-2022-48912: Fix use-after-free in __nf_register_net_hook() (bsc#1229641)
• CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
• CVE-2022-48906: Correctly set DATA_FIN timeout when number of retransmits is large (bsc#1229605)
• CVE-2024-42155: Wipe copies of protected- and secure-keys (bsc#1228733).
• CVE-2024-42156: Wipe copies of clear-key structures on failure (bsc#1228722).
• CVE-2023-52899: Add exception protection processing for vd in axi_chan_handle_err function (bsc#1229569).
• CVE-2024-42158: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
• CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
• CVE-2024-43873: Always initialize seqpacket_allow (bsc#1229488)
• CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
• CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
• CVE-2021-47106: Fix use-after-free in nft_set_catchall_destroy() (bsc#1220962)
• CVE-2021-47517: Fix panic when interrupt coaleceing is set via ethtool (bsc#1225428).
• CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
• CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
• CVE-2024-27079: Fix NULL domain on device release (bsc#1223742).
• CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
• CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
• CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
• CVE-2024-43819: Reject memory region operations for ucontrol VMs (bsc#1229290 git-fixes).
• CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
• CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
• CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
• CVE-2024-27016: Validate pppoe header (bsc#1223807).
• CVE-2024-35945: Prevent nullptr exceptions on ISR (bsc#1224639).
• CVE-2023-52581: Fix memleak when more than 255…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-44947: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454).
• CVE-2024-36936: Touch soft lockup during memory accept (bsc#1225773).
• CVE-2022-48706: Do proper cleanup if IFCVF init fails (bsc#1225524).
• CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).
• CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
• CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).
• CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
• CVE-2024-43893: Check uartclk for zero to avoid divide by zero (bsc#1229759).
• CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
• CVE-2024-43900: Avoid use-after-free in load_firmware_cb() (bsc#1229756).
• CVE-2024-44938: Fix shift-out-of-bounds in dbDiscardAG (bsc#1229792).
• CVE-2024-44939: Fix null ptr deref in dtInsertEntry (bsc#1229820).
• CVE-2024-41087: Fix double free on error (bsc#1228466).
• CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
• CVE-2024-43902: Add null checker before passing variables (bsc#1229767).
• CVE-2024-43904: Add null checks for 'stream' and 'plane' before dereferencing (bsc#1229768)
• CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
• CVE-2024-43884: Add error handling to pair_device() (bsc#1229739)
• CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
• CVE-2022-48920: Get rid of warning on transaction commit when using flushoncommit (bsc#1229658).
• CVE-2023-52906: Fix warning during failed attribute validation (bsc#1229527).
• CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
• CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
• CVE-2024-26812: struct virqfd kABI workaround (bsc#1222808).
• CVE-2022-48912: Fix use-after-free in __nf_register_net_hook() (bsc#1229641)
• CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
• CVE-2022-48906: Correctly set DATA_FIN timeout when number of retransmits is large (bsc#1229605)
• CVE-2024-42155: Wipe copies of protected- and secure-keys (bsc#1228733).
• CVE-2024-42156: Wipe copies of clear-key structures on failure (bsc#1228722).
• CVE-2023-52899: Add exception protection processing for vd in axi_chan_handle_err function (bsc#1229569).
• CVE-2024-42158: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
• CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
• CVE-2024-43873: Always initialize seqpacket_allow (bsc#1229488)
• CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
• CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
• CVE-2021-47106: Fix use-after-free in nft_set_catchall_destroy() (bsc#1220962)
• CVE-2021-47517: Fix panic when interrupt coaleceing is set via ethtool (bsc#1225428).
• CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
• CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
• CVE-2024-27079: Fix NULL domain on device release (bsc#1223742).
• CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
• CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
• CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
• CVE-2024-43819: Reject memory region operations for ucontrol VMs (bsc#1229290).
• CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
• CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
• CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
• CVE-2024-27016: Validate pppoe header (bsc#1223807).
• CVE-2024-35945: Prevent nullptr exceptions on ISR (bsc#1224639).
• CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-44947: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454).
• CVE-2024-36936: Touch soft lockup during memory accept (bsc#1225773).
• CVE-2022-48706: Do proper cleanup if IFCVF init fails (bsc#1225524).
• CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).
• CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
• CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).
• CVE-2024-36270: Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (bsc#1226798)
• CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
• CVE-2024-43893: Check uartclk for zero to avoid divide by zero (bsc#1229759).
• CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
• CVE-2024-43900: Avoid use-after-free in load_firmware_cb() (bsc#1229756).
• CVE-2024-44938: Fix shift-out-of-bounds in dbDiscardAG (bsc#1229792).
• CVE-2024-44939: Fix null ptr deref in dtInsertEntry (bsc#1229820).
• CVE-2024-41087: Fix double free on error (CVE-2024-41087,bsc#1228466).
• CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
• CVE-2024-43902: Add null checker before passing variables (bsc#1229767).
• CVE-2024-43904: Add null checks for 'stream' and 'plane' before dereferencing (bsc#1229768)
• CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
• CVE-2024-43884: Add error handling to pair_device() (bsc#1229739)
• CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
• CVE-2022-48920: Get rid of warning on transaction commit when using flushoncommit (bsc#1229658).
• CVE-2023-52906: Fix warning during failed attribute validation (bsc#1229527).
• CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
• CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
• CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
• CVE-2022-48912: Fix use-after-free in __nf_register_net_hook() (bsc#1229641)
• CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
• CVE-2022-48906: Correctly set DATA_FIN timeout when number of retransmits is large (bsc#1229605)
• CVE-2024-42155: Wipe copies of protected- and secure-keys (bsc#1228733).
• CVE-2024-42156: Wipe copies of clear-key structures on failure (bsc#1228722).
• CVE-2023-52899: Add exception protection processing for vd in axi_chan_handle_err function (bsc#1229569).
• CVE-2024-42158: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
• CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
• CVE-2024-43873: Always initialize seqpacket_allow (bsc#1229488)
• CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
• CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
• CVE-2021-47106: Fix use-after-free in nft_set_catchall_destroy() (bsc#1220962)
• CVE-2021-47517: Fix panic when interrupt coaleceing is set via ethtool (bsc#1225428).
• CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
• CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
• CVE-2024-27079: Fix NULL domain on device release (bsc#1223742).
• CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
• CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
• CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
• CVE-2024-43819: Reject memory region operations for ucontrol VMs (bsc#1229290 git-fixes).
• CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
• CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
• CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
• CVE-2024-27016: Validate pppoe header (bsc#1223807). -…

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
• CVE-2024-49948: net: add more sanity checks to qdisc_pkt_len_init() (bsc#1232161).
• CVE-2024-49978: gso: fix udp gso fraglist segmentation after pull from frag_list (bsc#1232101).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
• CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
• CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53187: io_uring: check for overflows in io_pin_pages (bsc#1234947).
• CVE-2024-53203: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() (bsc#1235001).
• CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
• CVE-2024-56600: net: inet6: do not leave a dangling sk pointer in inet6_create() (bsc#1235217).
• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235230).
• CVE-2024-56608: drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' (bsc#1235487).
• CVE-2024-56610: kcsan: Turn report_filterlist_lock into a raw_spinlock (bsc#1235390).
• CVE-2024-56633: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (bsc#1235485).
• CVE-2024-56650: netfilter: x_tables: fix LED ID check in led_tg_check() (bsc#1235430).
• CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
• CVE-2024-56665: bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog (bsc#1235489).
• CVE-2024-56679: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c (bsc#1235498).
• CVE-2024-56693: brd: defer automatic disk creation until module initialization succeeds (bsc#1235418).
• CVE-2024-56707: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c (bsc#1235545).
• CVE-2024-56715: ionic: Fix netdev notifier unregister on failure (bsc#1235612).
• CVE-2024-56725: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c (bsc#1235578).
• CVE-2024-56726: octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c (bsc#1235582).
• CVE-2024-56727: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c (bsc#1235583).
• CVE-2024-56728: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c (bsc#1235656).
• CVE-2024-56763: tracing: Prevent bad count for tracing_cpumask_write (bsc#1235638).
• CVE-2024-57802: netrom: check buffer length before accessing it (bsc#1235941).
• CVE-2024-57882: mptcp: fix TCP options overflow. (bsc#1235914).
• CVE-2024-57884: mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (bsc#1235948).
• CVE-2024-57917: topology: Keep the cpumask unchanged when printing cpumap (bsc#1236127).
• CVE-2024-57931: selinux: ignore unknown extended permissions (bsc#1236192).
• CVE-2024-57938: net/sctp: Prevent autoclose integer overflow in sctp_association_init() (bsc#1236182).
• CVE-2024-57946: virtio-blk: do not keep queue frozen during system suspend (bsc#1236247).
• CVE-2025-21652: ipvlan: Fix use-after-free in ipvlan_get_iflink() (bsc#1236160).
• CVE-2025-21653: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute (bsc#1236161).
• CVE-2025-21655: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (bsc#1236163).
• CVE-2025-21663: net: stmmac: dwmac-tegra: Read iommu stream id from device tree (bsc#1236260).
• CVE-2025-21664: dm thin: make get_first_thin use rcu-safe list first function (bsc#1236262).
• CVE-2025-21665: filemap: avoid…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56568: iommu/arm-smmu: Defer probe of clients after smmu device bound (bsc#1235032).
• CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
• CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
• CVE-2024-56720: bpf, sockmap: Several fixes to bpf_msg_pop_data (bsc#1235592).
• CVE-2024-57882: mptcp: fix TCP options overflow. (bsc#1235914).
• CVE-2024-57994: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() (bsc#1237901).
• CVE-2025-21636: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy (bsc#1236113).
• CVE-2025-21637: sctp: sysctl: udp_port: avoid using current->nsproxy (bsc#1236114).
• CVE-2025-21638: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115).
• CVE-2025-21639: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122).
• CVE-2025-21640: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123).
• CVE-2025-21647: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133).
• CVE-2025-21665: filemap: avoid truncating 64-bit offset to 32 bits (bsc#1236684).
• CVE-2025-21666: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] (bsc#1236680).
• CVE-2025-21667: iomap: avoid avoid truncating 64-bit offset to 32 bits (bsc#1236681).
• CVE-2025-21668: pmdomain: imx8mp-blk-ctrl: add missing loop break condition (bsc#1236682).
• CVE-2025-21669: vsock/virtio: discard packets if the transport changes (bsc#1236683).
• CVE-2025-21670: vsock/bpf: return early if transport is not assigned (bsc#1236685).
• CVE-2025-21673: smb: client: fix double free of TCP_Server_Info::hostname (bsc#1236689).
• CVE-2025-21675: net/mlx5: Clear port select structure when fail to create (bsc#1236694).
• CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236700).
• CVE-2025-21681: openvswitch: fix lockup on tx to unregistering netdev with carrier (bsc#1236702).
• CVE-2025-21687: vfio/platform: check the bounds of read/write syscalls (bsc#1237045).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
• CVE-2025-21700: net: sched:…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56568: iommu/arm-smmu: Defer probe of clients after smmu device bound (bsc#1235032).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
• CVE-2024-56720: bpf, sockmap: Several fixes to bpf_msg_pop_data (bsc#1235592).
• CVE-2024-57994: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() (bsc#1237901).
• CVE-2025-21636: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy (bsc#1236113).
• CVE-2025-21637: sctp: sysctl: udp_port: avoid using current->nsproxy (bsc#1236114).
• CVE-2025-21638: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115).
• CVE-2025-21639: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122).
• CVE-2025-21640: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123).
• CVE-2025-21647: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133).
• CVE-2025-21665: filemap: avoid truncating 64-bit offset to 32 bits (bsc#1236684).
• CVE-2025-21667: iomap: avoid avoid truncating 64-bit offset to 32 bits (bsc#1236681).
• CVE-2025-21668: pmdomain: imx8mp-blk-ctrl: add missing loop break condition (bsc#1236682).
• CVE-2025-21673: smb: client: fix double free of TCP_Server_Info::hostname (bsc#1236689).
• CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236700).
• CVE-2025-21681: openvswitch: fix lockup on tx to unregistering netdev with carrier (bsc#1236702).
• CVE-2025-21687: vfio/platform: check the bounds of read/write syscalls (bsc#1237045).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
• CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
• CVE-2025-21728: bpf: Send signals asynchronously if !preemptible (bsc#1237879).
• CVE-2025-21705: mptcp: handle fastopen disconnect correctly (bsc#1238525).
• CVE-2025-21715: net: davicom: fix UAF in dm9000_drv_remove (bsc#1237889).
• CVE-2025-21716: vxlan: Fix uninit-value in vxlan_vnifilter_dump() (bsc#1237891).
• CVE-2025-21719: ipmr: do not call mr_mfc_uses_dev() for unres entries (bsc#1238860).
• CVE-2025-21724: iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() (bsc#1238863).
• CVE-2025-21725: smb: client: fix oops due to unset link speed (bsc#1238877). -…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
• CVE-2024-56720: bpf, sockmap: Several fixes to bpf_msg_pop_data (bsc#1235592).
• CVE-2024-57994: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() (bsc#1237901).
• CVE-2025-21636: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy (bsc#1236113).
• CVE-2025-21637: sctp: sysctl: udp_port: avoid using current->nsproxy (bsc#1236114).
• CVE-2025-21638: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115).
• CVE-2025-21639: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122).
• CVE-2025-21640: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123).
• CVE-2025-21647: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133).
• CVE-2025-21665: filemap: avoid truncating 64-bit offset to 32 bits (bsc#1236684).
• CVE-2025-21667: iomap: avoid avoid truncating 64-bit offset to 32 bits (bsc#1236681).
• CVE-2025-21668: pmdomain: imx8mp-blk-ctrl: add missing loop break condition (bsc#1236682).
• CVE-2025-21673: smb: client: fix double free of TCP_Server_Info::hostname (bsc#1236689).
• CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236700).
• CVE-2025-21681: openvswitch: fix lockup on tx to unregistering netdev with carrier (bsc#1236702).
• CVE-2025-21687: vfio/platform: check the bounds of read/write syscalls (bsc#1237045).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
• CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
• CVE-2025-21705: mptcp: handle fastopen disconnect correctly (bsc#1238525).
• CVE-2025-21715: net: davicom: fix UAF in dm9000_drv_remove (bsc#1237889).
• CVE-2025-21716: vxlan: Fix uninit-value in vxlan_vnifilter_dump() (bsc#1237891).
• CVE-2025-21719: ipmr: do not call mr_mfc_uses_dev() for unres entries (bsc#1238860).
• CVE-2025-21724: iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() (bsc#1238863).
• CVE-2025-21725: smb: client: fix oops due to unset link speed (bsc#1238877).
• CVE-2025-21728: bpf: Send signals asynchronously if !preemptible (bsc#1237879).
• CVE-2025-21767: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
• CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
• CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
• CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
• CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
• CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
• CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
• CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
• CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
• CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
• CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Drivers core;
• Null block device driver;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EFI core;
• FPGA Framework;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Mailbox framework;
• Media drivers;
• Microchip PCI driver;
• VMware VMCI Driver;
• Network drivers;
• PCI subsystem;
• x86 platform drivers;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Sonic Silicon Backplane drivers;
• Greybus lights staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Watchdog drivers;
• 9P distributed file system;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• Network file system server daemon;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• Tracing file system;
• Tracing infrastructure;
• io_uring subsystem;
• Core kernel;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Memory management;
• 9P file system network protocol;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Network traffic control;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• AppArmor security module;
• Integrity Measurement Architecture(IMA) framework;
• Landlock security;
• Linux Security Modules (LSM) Framework;
• SELinux security module;
• Simplified Mandatory Access Control Kernel framework;
• ALSA framework;
• HD-audio driver;
• SOF drivers;
• KVM core; (CVE-2024-40911, CVE-2024-37356, CVE-2024-40935, CVE-2024-40944, CVE-2024-41003, CVE-2024-40990, CVE-2024-40952, CVE-2024-40940, CVE-2024-40930, CVE-2024-40985, CVE-2024-40941, CVE-2024-38630, CVE-2024-39466, CVE-2024-40933, CVE-2024-38624, CVE-2024-40924, CVE-2024-40945, CVE-2024-40899, CVE-2024-38622, CVE-2024-40979, CVE-2024-36484, CVE-2024-41004, CVE-2024-39474, CVE-2022-48772, CVE-2024-36244, CVE-2024-38664, CVE-2024-40925, CVE-2024-40980, CVE-2024-39480, CVE-2024-36270, CVE-2024-40936, CVE-2024-40904, CVE-2024-38635, CVE-2024-40927, CVE-2024-36481, CVE-2024-40929, CVE-2024-40958, CVE-2024-36978, CVE-2024-40992, CVE-2024-40908, CVE-2024-39504, CVE-2024-41001, CVE-2024-40967, CVE-2023-52884, CVE-2024-40997, CVE-2024-40903, CVE-2024-40913, CVE-2024-34030, CVE-2024-39473, CVE-2024-40966, CVE-2024-40951, CVE-2024-40902, CVE-2024-40982, CVE-2024-40923, CVE-2024-39467, CVE-2024-40910, CVE-2024-40909, CVE-2024-39463,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Drivers core;
• Null block device driver;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EFI core;
• FPGA Framework;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Mailbox framework;
• Media drivers;
• Microchip PCI driver;
• VMware VMCI Driver;
• Network drivers;
• PCI subsystem;
• x86 platform drivers;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Sonic Silicon Backplane drivers;
• Greybus lights staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Watchdog drivers;
• 9P distributed file system;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• Network file system server daemon;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• Tracing file system;
• IOMMU subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• Core kernel;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Memory management;
• 9P file system network protocol;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Network traffic control;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• AppArmor security module;
• Integrity Measurement Architecture(IMA) framework;
• Landlock security;
• Linux Security Modules (LSM) Framework;
• SELinux security module;
• Simplified Mandatory Access Control Kernel framework;
• ALSA framework;
• HD-audio driver;
• SOF drivers;
• KVM core; (CVE-2024-40978, CVE-2024-39504, CVE-2024-39483, CVE-2024-36478, CVE-2024-40928, CVE-2024-36971, CVE-2024-40947, CVE-2024-31076, CVE-2024-40934, CVE-2024-40909, CVE-2024-40962, CVE-2024-38635, CVE-2024-38632, CVE-2024-40912, CVE-2024-40967, CVE-2024-39492, CVE-2024-40974, CVE-2024-39466, CVE-2024-40939, CVE-2024-40988, CVE-2024-40951, CVE-2024-41005, CVE-2024-40968, CVE-2024-39493, CVE-2024-40949, CVE-2022-48772, CVE-2024-40944, CVE-2024-40998, CVE-2024-39490, CVE-2024-39467, CVE-2024-42078, CVE-2024-40953, CVE-2024-40990, CVE-2024-40902, CVE-2024-39461, CVE-2024-39301, CVE-2024-36978, CVE-2024-39475, CVE-2024-39496, CVE-2024-40901, CVE-2024-40985, CVE-2024-33621, CVE-2024-38663, CVE-2024-39497, CVE-2024-40937, CVE-2024-40941, CVE-2024-40987, CVE-2024-40918, CVE-2024-32936, CVE-2024-40999, CVE-2024-40938, CVE-2024-39488, CVE-2024-39510, CVE-2024-40924, CVE-2024-38661, CVE-2024-40989, CVE-2024-39509,…

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Pin controllers subsystem;
• S/390 drivers;
• SCSI drivers;
• USB subsystem;
• JFFS2 file system;
• JFS file system;
• File systems infrastructure;
• NILFS2 file system;
• IOMMU subsystem;
• Sun RPC protocol;
• Netfilter;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• NET/ROM layer;
• Network traffic control;
• SoC Audio for Freescale CPUs drivers; (CVE-2024-40905, CVE-2024-41095, CVE-2024-41035, CVE-2024-36974, CVE-2024-40959, CVE-2024-40978, CVE-2024-42236, CVE-2024-40963, CVE-2024-40916, CVE-2024-41006, CVE-2024-39495, CVE-2023-52803, CVE-2024-42070, CVE-2024-41041, CVE-2024-42157, CVE-2024-36894, CVE-2024-42153, CVE-2024-42127, CVE-2024-42224, CVE-2024-40932, CVE-2024-42105, CVE-2024-40968, CVE-2024-41044, CVE-2024-41046, CVE-2023-52887, CVE-2024-42094, CVE-2024-40960, CVE-2024-41007, CVE-2024-40961, CVE-2024-39487, CVE-2024-39502, CVE-2024-42086, CVE-2024-36978, CVE-2024-39503, CVE-2024-41049, CVE-2024-42090, CVE-2024-42232, CVE-2024-39499, CVE-2024-40902, CVE-2024-37078, CVE-2024-39501, CVE-2024-42119, CVE-2024-40901, CVE-2024-42101, CVE-2024-42104, CVE-2024-42145, CVE-2024-41097, CVE-2024-40942, CVE-2024-41034, CVE-2024-40904, CVE-2024-41089, CVE-2024-42084, CVE-2024-42093, CVE-2024-40945, CVE-2024-40958, CVE-2024-42124, CVE-2024-40987, CVE-2024-40912, CVE-2024-39506, CVE-2024-40941, CVE-2024-39509, CVE-2024-40974, CVE-2024-39505, CVE-2024-42115, CVE-2024-40988, CVE-2024-40995, CVE-2024-42097, CVE-2024-41087, CVE-2024-42106, CVE-2024-40984, CVE-2024-40981, CVE-2024-42102, CVE-2024-42148, CVE-2024-42154, CVE-2024-42096, CVE-2024-40934, CVE-2024-40980, CVE-2024-42076, CVE-2024-40943, CVE-2024-42092, CVE-2024-42089, CVE-2024-42223, CVE-2024-38619, CVE-2024-42087, CVE-2024-39469)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Pin controllers subsystem;
• S/390 drivers;
• SCSI drivers;
• USB subsystem;
• JFFS2 file system;
• JFS file system;
• File systems infrastructure;
• NILFS2 file system;
• IOMMU subsystem;
• Sun RPC protocol;
• Netfilter;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• NET/ROM layer;
• Network traffic control;
• SoC Audio for Freescale CPUs drivers; (CVE-2024-40941, CVE-2024-42086, CVE-2024-41097, CVE-2024-40958, CVE-2024-41089, CVE-2024-40942, CVE-2024-40968, CVE-2024-40934, CVE-2024-40902, CVE-2024-42124, CVE-2023-52887, CVE-2024-42115, CVE-2024-41041, CVE-2024-39501, CVE-2024-40932, CVE-2024-42102, CVE-2024-40960, CVE-2024-39487, CVE-2024-39503, CVE-2024-40945, CVE-2024-40959, CVE-2024-40987, CVE-2024-40995, CVE-2024-40988, CVE-2024-42084, CVE-2024-40943, CVE-2024-42070, CVE-2024-40904, CVE-2024-41049, CVE-2024-41046, CVE-2024-39502, CVE-2024-42097, CVE-2024-42090, CVE-2024-42236, CVE-2024-42223, CVE-2024-42094, CVE-2024-41007, CVE-2024-42105, CVE-2024-41035, CVE-2024-41087, CVE-2024-42157, CVE-2024-39495, CVE-2024-36894, CVE-2024-40916, CVE-2024-39469, CVE-2024-40974, CVE-2024-42153, CVE-2024-36974, CVE-2024-42096, CVE-2024-42232, CVE-2024-40980, CVE-2024-41034, CVE-2024-42087, CVE-2024-42093, CVE-2024-41095, CVE-2024-42145, CVE-2024-42148, CVE-2023-52803, CVE-2024-39499, CVE-2024-42104, CVE-2024-42224, CVE-2024-37078, CVE-2024-42092, CVE-2024-39505, CVE-2024-38619, CVE-2024-42106, CVE-2024-40978, CVE-2024-41044, CVE-2024-42089, CVE-2024-40981, CVE-2024-42154, CVE-2024-36978, CVE-2024-42076, CVE-2024-40984, CVE-2024-42127, CVE-2024-42119, CVE-2024-40961, CVE-2024-39509, CVE-2024-42101, CVE-2024-40901, CVE-2024-40963, CVE-2024-40905, CVE-2024-39506, CVE-2024-40912, CVE-2024-41006)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Pin controllers subsystem;
• S/390 drivers;
• SCSI drivers;
• USB subsystem;
• JFFS2 file system;
• JFS file system;
• File systems infrastructure;
• NILFS2 file system;
• IOMMU subsystem;
• Sun RPC protocol;
• Netfilter;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• NET/ROM layer;
• Network traffic control;
• SoC Audio for Freescale CPUs drivers; (CVE-2024-42094, CVE-2024-42154, CVE-2024-42101, CVE-2024-40995, CVE-2024-40959, CVE-2024-42076, CVE-2024-40961, CVE-2024-42096, CVE-2024-42092, CVE-2024-39501, CVE-2024-41046, CVE-2024-42087, CVE-2024-39502, CVE-2024-42090, CVE-2024-40974, CVE-2024-40942, CVE-2024-39509, CVE-2024-40934, CVE-2024-42148, CVE-2024-42127, CVE-2024-42115, CVE-2024-39505, CVE-2024-36978, CVE-2024-39503, CVE-2024-40912, CVE-2024-41034, CVE-2024-42119, CVE-2024-41006, CVE-2024-40902, CVE-2024-40968, CVE-2024-39499, CVE-2024-42093, CVE-2024-40941, CVE-2024-42106, CVE-2024-42145, CVE-2024-41097, CVE-2024-36974, CVE-2024-41044, CVE-2024-39495, CVE-2024-40981, CVE-2024-40987, CVE-2024-42232, CVE-2024-40905, CVE-2024-39506, CVE-2024-42153, CVE-2024-41007, CVE-2024-40978, CVE-2024-40960, CVE-2023-52887, CVE-2024-41087, CVE-2024-41049, CVE-2024-42086, CVE-2024-40958, CVE-2024-40980, CVE-2024-42084, CVE-2024-42224, CVE-2024-39487, CVE-2024-40943, CVE-2024-40984, CVE-2024-41095, CVE-2024-41035, CVE-2024-41089, CVE-2024-36894, CVE-2024-42104, CVE-2024-40988, CVE-2024-42105, CVE-2024-39469, CVE-2024-40901, CVE-2024-40963, CVE-2024-42097, CVE-2024-42089, CVE-2024-42124, CVE-2024-42223, CVE-2023-52803, CVE-2024-42070, CVE-2024-42157, CVE-2024-42102, CVE-2024-40916, CVE-2024-40904, CVE-2024-41041, CVE-2024-40932, CVE-2024-40945, CVE-2024-38619, CVE-2024-37078, CVE-2024-42236)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Pin controllers subsystem;
• S/390 drivers;
• SCSI drivers;
• USB subsystem;
• JFFS2 file system;
• JFS file system;
• File systems infrastructure;
• NILFS2 file system;
• IOMMU subsystem;
• Sun RPC protocol;
• Netfilter;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• NET/ROM layer;
• Network traffic control;
• SoC Audio for Freescale CPUs drivers; (CVE-2024-41034, CVE-2024-40984, CVE-2024-40987, CVE-2024-42119, CVE-2024-42224, CVE-2024-42101, CVE-2024-42096, CVE-2024-41095, CVE-2024-42087, CVE-2024-42104, CVE-2024-42148, CVE-2024-39495, CVE-2024-40980, CVE-2024-42223, CVE-2024-40961, CVE-2024-40988, CVE-2024-42127, CVE-2024-42090, CVE-2024-42236, CVE-2024-40995, CVE-2024-41007, CVE-2024-40968, CVE-2024-40901, CVE-2024-42097, CVE-2024-41041, CVE-2024-36974, CVE-2024-42115, CVE-2024-40978, CVE-2024-38619, CVE-2024-41049, CVE-2024-41035, CVE-2024-41044, CVE-2024-42154, CVE-2024-39499, CVE-2024-42070, CVE-2024-40959, CVE-2024-39487, CVE-2024-42157, CVE-2024-40916, CVE-2024-42076, CVE-2024-41087, CVE-2024-42094, CVE-2024-42124, CVE-2024-40905, CVE-2024-42145, CVE-2024-40963, CVE-2024-36894, CVE-2024-40942, CVE-2024-42092, CVE-2024-42153, CVE-2024-41089, CVE-2024-40912, CVE-2023-52887, CVE-2024-40934, CVE-2024-41006, CVE-2024-39501, CVE-2024-42084, CVE-2024-39506, CVE-2024-39509, CVE-2024-40943, CVE-2024-42106, CVE-2024-42093, CVE-2024-40902, CVE-2024-42086, CVE-2024-40958, CVE-2024-39502, CVE-2024-42232, CVE-2024-42089, CVE-2024-37078, CVE-2024-39469, CVE-2024-41046, CVE-2024-42102, CVE-2024-40974, CVE-2024-39505, CVE-2024-40960, CVE-2024-42105, CVE-2024-40932, CVE-2024-40904, CVE-2024-40981, CVE-2024-39503, CVE-2024-41097, CVE-2024-40941, CVE-2024-36978, CVE-2023-52803, CVE-2024-40945)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Pin controllers subsystem;
• S/390 drivers;
• SCSI drivers;
• USB subsystem;
• JFFS2 file system;
• JFS file system;
• File systems infrastructure;
• NILFS2 file system;
• IOMMU subsystem;
• Sun RPC protocol;
• Netfilter;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• NET/ROM layer;
• Network traffic control;
• SoC Audio for Freescale CPUs drivers; (CVE-2024-40916, CVE-2024-41035, CVE-2024-39469, CVE-2024-39499, CVE-2024-36978, CVE-2024-42092, CVE-2024-42087, CVE-2024-42102, CVE-2024-40978, CVE-2024-40902, CVE-2024-36974, CVE-2024-42096, CVE-2024-40974, CVE-2024-40904, CVE-2024-40905, CVE-2024-42153, CVE-2024-42106, CVE-2024-42070, CVE-2024-41097, CVE-2024-42090, CVE-2024-42105, CVE-2024-42104, CVE-2024-39502, CVE-2024-41089, CVE-2024-40945, CVE-2024-38619, CVE-2024-40961, CVE-2024-42127, CVE-2024-39487, CVE-2024-40988, CVE-2024-41044, CVE-2024-42236, CVE-2024-40942, CVE-2024-39506, CVE-2024-39509, CVE-2024-39503, CVE-2024-40934, CVE-2024-40959, CVE-2024-42101, CVE-2024-40960, CVE-2024-40968, CVE-2024-41087, CVE-2023-52803, CVE-2024-40987, CVE-2024-40943, CVE-2024-42089, CVE-2023-52887, CVE-2024-37078, CVE-2024-42148, CVE-2024-36894, CVE-2024-42097, CVE-2024-41006, CVE-2024-40984, CVE-2024-40963, CVE-2024-42223, CVE-2024-40912, CVE-2024-42086, CVE-2024-41049, CVE-2024-42157, CVE-2024-41034, CVE-2024-42145, CVE-2024-42124, CVE-2024-40995, CVE-2024-42224, CVE-2024-40981, CVE-2024-41095, CVE-2024-40901, CVE-2024-42115, CVE-2024-41041, CVE-2024-41007, CVE-2024-39505, CVE-2024-40932, CVE-2024-39495, CVE-2024-40980, CVE-2024-42084, CVE-2024-41046, CVE-2024-42119, CVE-2024-42076, CVE-2024-42232, CVE-2024-39501, CVE-2024-40958, CVE-2024-40941, CVE-2024-42093, CVE-2024-42094, CVE-2024-42154)

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Drivers core;
• Null block device driver;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EFI core;
• FPGA Framework;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Mailbox framework;
• Media drivers;
• Microchip PCI driver;
• VMware VMCI Driver;
• Network drivers;
• PCI subsystem;
• x86 platform drivers;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Sonic Silicon Backplane drivers;
• Greybus lights staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Watchdog drivers;
• 9P distributed file system;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• Network file system server daemon;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• Tracing file system;
• IOMMU subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• Core kernel;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Memory management;
• 9P file system network protocol;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Network traffic control;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• AppArmor security module;
• Integrity Measurement Architecture(IMA) framework;
• Landlock security;
• Linux Security Modules (LSM) Framework;
• SELinux security module;
• Simplified Mandatory Access Control Kernel framework;
• ALSA framework;
• HD-audio driver;
• SOF drivers;
• KVM core; (CVE-2024-36270, CVE-2024-38627, CVE-2024-39508, CVE-2024-41001, CVE-2024-38634, CVE-2024-40979, CVE-2024-40903, CVE-2024-34030, CVE-2024-38621, CVE-2024-34027, CVE-2024-39504, CVE-2024-38385, CVE-2024-36288, CVE-2024-39301, CVE-2024-38628, CVE-2024-42270, CVE-2024-39507, CVE-2024-36286, CVE-2024-40960, CVE-2024-36479, CVE-2024-41002, CVE-2024-36974, CVE-2024-40943, CVE-2024-40976, CVE-2024-38662, CVE-2024-40995, CVE-2024-39497, CVE-2024-31076, CVE-2024-39371, CVE-2024-40983, CVE-2024-40985, CVE-2024-38618, CVE-2024-40914, CVE-2024-40989, CVE-2024-40973, CVE-2024-38663, CVE-2024-39463, CVE-2024-38633, CVE-2024-36978, CVE-2024-40970, CVE-2024-40932, CVE-2024-39480, CVE-2024-39471, CVE-2024-40962, CVE-2024-40986, CVE-2024-40937, CVE-2024-39469, CVE-2024-40904, CVE-2024-39466, CVE-2024-38388, CVE-2024-39494, CVE-2024-41004, CVE-2024-38381, CVE-2022-48772, CVE-2024-33847, CVE-2024-40969, CVE-2024-40957,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Drivers core;
• Null block device driver;
• Character device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EFI core;
• FPGA Framework;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Mailbox framework;
• Media drivers;
• Microchip PCI driver;
• VMware VMCI Driver;
• Network drivers;
• PCI subsystem;
• x86 platform drivers;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Sonic Silicon Backplane drivers;
• Greybus lights staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Watchdog drivers;
• 9P distributed file system;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• Network file system server daemon;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• Tracing file system;
• IOMMU subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• Core kernel;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Memory management;
• 9P file system network protocol;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Network traffic control;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• AppArmor security module;
• Integrity Measurement Architecture(IMA) framework;
• Landlock security;
• Linux Security Modules (LSM) Framework;
• SELinux security module;
• Simplified Mandatory Access Control Kernel framework;
• ALSA framework;
• HD-audio driver;
• SOF drivers;
• KVM core; (CVE-2024-40963, CVE-2024-40994, CVE-2024-36481, CVE-2024-39301, CVE-2024-38390, CVE-2024-40976, CVE-2024-40934, CVE-2024-40902, CVE-2024-40916, CVE-2024-39298, CVE-2024-38659, CVE-2024-38384, CVE-2024-38635, CVE-2024-39494, CVE-2024-40926, CVE-2024-40956, CVE-2024-40948, CVE-2024-40920, CVE-2024-38624, CVE-2024-39498, CVE-2024-38780, CVE-2024-39503, CVE-2024-40919, CVE-2024-39505, CVE-2024-40988, CVE-2024-36972, CVE-2024-36974, CVE-2024-39495, CVE-2024-40992, CVE-2024-36015, CVE-2024-38618, CVE-2024-39478, CVE-2024-40975, CVE-2024-39507, CVE-2024-39479, CVE-2024-39291, CVE-2024-40925, CVE-2024-39493, CVE-2024-41005, CVE-2024-40932, CVE-2024-39467, CVE-2024-40973, CVE-2024-38634, CVE-2024-34027, CVE-2024-39462, CVE-2024-40949, CVE-2024-40908, CVE-2024-40929, CVE-2024-38662, CVE-2024-39489, CVE-2024-40953, CVE-2024-38306, CVE-2024-40915, CVE-2024-39470, CVE-2024-40969, CVE-2024-31076, CVE-2024-38663, CVE-2024-38629,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Drivers core;
• Null block device driver;
• Character device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EFI core;
• FPGA Framework;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Mailbox framework;
• Media drivers;
• Microchip PCI driver;
• VMware VMCI Driver;
• Network drivers;
• PCI subsystem;
• x86 platform drivers;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Sonic Silicon Backplane drivers;
• Greybus lights staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Watchdog drivers;
• 9P distributed file system;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• Network file system server daemon;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• Tracing file system;
• IOMMU subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• Core kernel;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Memory management;
• 9P file system network protocol;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Network traffic control;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• AppArmor security module;
• Integrity Measurement Architecture(IMA) framework;
• Landlock security;
• Linux Security Modules (LSM) Framework;
• SELinux security module;
• Simplified Mandatory Access Control Kernel framework;
• ALSA framework;
• HD-audio driver;
• SOF drivers;
• KVM core; (CVE-2024-39465, CVE-2024-39492, CVE-2024-40976, CVE-2024-40956, CVE-2024-39480, CVE-2024-39467, CVE-2024-39478, CVE-2024-39489, CVE-2024-41003, CVE-2024-39510, CVE-2024-39498, CVE-2024-40994, CVE-2024-40937, CVE-2024-39488, CVE-2024-40990, CVE-2024-40955, CVE-2024-40905, CVE-2024-39496, CVE-2024-36478, CVE-2024-40920, CVE-2024-40954, CVE-2024-32936, CVE-2024-40919, CVE-2024-40947, CVE-2024-40975, CVE-2024-39481, CVE-2024-40983, CVE-2024-39276, CVE-2024-37026, CVE-2024-40980, CVE-2022-48772, CVE-2024-39470, CVE-2024-40951, CVE-2024-40927, CVE-2024-38635, CVE-2024-40974, CVE-2024-39468, CVE-2024-38384, CVE-2024-37354, CVE-2024-40992, CVE-2024-40934, CVE-2024-40925, CVE-2024-40935, CVE-2024-39473, CVE-2024-40910, CVE-2024-40979, CVE-2024-39501, CVE-2024-38628, CVE-2024-39298, CVE-2024-40909, CVE-2024-38629, CVE-2024-41000, CVE-2024-40989, CVE-2024-40924, CVE-2024-40943, CVE-2024-41006, CVE-2024-38621, CVE-2024-39462,…

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• SuperH RISC architecture;
• x86 architecture;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Media drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• Pin controllers subsystem;
• S/390 drivers;
• SCSI drivers;
• USB subsystem;
• GFS2 file system;
• JFFS2 file system;
• JFS file system;
• File systems infrastructure;
• NILFS2 file system;
• IOMMU subsystem;
• Sun RPC protocol;
• Netfilter;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• NET/ROM layer;
• Network traffic control;
• HD-audio driver;
• SoC Audio for Freescale CPUs drivers; (CVE-2024-42154, CVE-2024-42093, CVE-2024-42096, CVE-2024-40984, CVE-2024-39502, CVE-2024-36901, CVE-2024-41044, CVE-2024-40961, CVE-2024-40981, CVE-2024-42236, CVE-2024-42232, CVE-2024-41041, CVE-2024-40958, CVE-2024-40905, CVE-2024-42084, CVE-2024-40934, CVE-2024-42124, CVE-2024-39505, CVE-2024-39506, CVE-2024-39501, CVE-2021-46926, CVE-2024-40941, CVE-2024-42145, CVE-2024-41089, CVE-2024-40932, CVE-2024-42224, CVE-2024-41097, CVE-2024-40959, CVE-2024-42157, CVE-2024-39469, CVE-2024-39499, CVE-2024-40974, CVE-2024-42094, CVE-2024-36894, CVE-2024-42087, CVE-2024-42104, CVE-2023-52803, CVE-2024-41034, CVE-2024-40995, CVE-2023-52629, CVE-2024-40912, CVE-2024-39484, CVE-2024-41006, CVE-2023-52760, CVE-2024-41095, CVE-2024-41046, CVE-2024-42070, CVE-2023-52887, CVE-2024-40960, CVE-2024-41007, CVE-2024-40901, CVE-2024-42119, CVE-2024-40987, CVE-2024-42148, CVE-2024-41049, CVE-2024-40963, CVE-2024-41087, CVE-2024-42223, CVE-2024-42090, CVE-2024-42105, CVE-2024-42089, CVE-2024-40916, CVE-2024-40942, CVE-2024-40978, CVE-2024-40902, CVE-2024-26921, CVE-2024-39495, CVE-2024-40943, CVE-2024-36978, CVE-2024-26929, CVE-2024-40988, CVE-2024-39503, CVE-2024-42101, CVE-2024-40904, CVE-2024-42086, CVE-2024-42106, CVE-2024-26830, CVE-2024-41035, CVE-2024-42153, CVE-2024-39509, CVE-2024-37078, CVE-2024-42076, CVE-2024-36974, CVE-2024-40980, CVE-2024-40945, CVE-2024-39487, CVE-2024-42092, CVE-2024-38619, CVE-2024-42127, CVE-2024-40968, CVE-2024-42115, CVE-2024-42102, CVE-2024-42097)

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• M68K architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Accessibility subsystem;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Pin controllers subsystem;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• eCrypt file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFFS2 file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• IOMMU subsystem;
• Memory management;
• Netfilter;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• Multipath TCP;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Network traffic control;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• ALSA framework;
• SoC Audio for Freescale CPUs drivers;
• Kirkwood ASoC drivers; (CVE-2024-40961, CVE-2024-38597, CVE-2024-39468, CVE-2024-36978, CVE-2024-42161, CVE-2024-38573, CVE-2024-40905, CVE-2024-42094, CVE-2024-36894, CVE-2024-40914, CVE-2024-40956, CVE-2024-42106, CVE-2024-38610, CVE-2024-39506, CVE-2024-42098, CVE-2024-42232, CVE-2024-38590, CVE-2024-39488, CVE-2024-42127, CVE-2024-41006, CVE-2024-42131, CVE-2024-41005, CVE-2024-40963, CVE-2024-38559, CVE-2024-42130, CVE-2024-37078, CVE-2024-42082, CVE-2024-40984, CVE-2024-38560, CVE-2024-42090, CVE-2024-33621, CVE-2024-40974, CVE-2024-42115, CVE-2024-40971, CVE-2024-40943, CVE-2024-38627, CVE-2024-38548, CVE-2024-40934, CVE-2024-38579, CVE-2024-38558, CVE-2024-39495, CVE-2023-52884, CVE-2024-42225, CVE-2024-38659, CVE-2024-40927, CVE-2024-40967, CVE-2024-38624, CVE-2024-38583, CVE-2024-41047, CVE-2024-38623, CVE-2024-39509, CVE-2024-36971, CVE-2024-42120, CVE-2024-38589, CVE-2024-36270, CVE-2024-42105, CVE-2024-36032, CVE-2024-42101, CVE-2024-40908,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• M68K architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Accessibility subsystem;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Pin controllers subsystem;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• eCrypt file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFFS2 file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• IOMMU subsystem;
• Memory management;
• Netfilter;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• Multipath TCP;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Network traffic control;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• ALSA framework;
• SoC Audio for Freescale CPUs drivers;
• Kirkwood ASoC drivers; (CVE-2024-42140, CVE-2024-38580, CVE-2024-38555, CVE-2024-38591, CVE-2024-40942, CVE-2024-42130, CVE-2024-41095, CVE-2024-40994, CVE-2024-39469, CVE-2024-38610, CVE-2024-42097, CVE-2024-42137, CVE-2024-31076, CVE-2024-38552, CVE-2024-36489, CVE-2024-40983, CVE-2024-40908, CVE-2024-39493, CVE-2024-40970, CVE-2024-40901, CVE-2024-38567, CVE-2024-38599, CVE-2024-38605, CVE-2024-42119, CVE-2024-38590, CVE-2024-38558, CVE-2023-52884, CVE-2024-41000, CVE-2024-42101, CVE-2024-40943, CVE-2024-39507, CVE-2024-42115, CVE-2024-40968, CVE-2024-42095, CVE-2024-41034, CVE-2024-38618, CVE-2024-38633, CVE-2024-40904, CVE-2024-42070, CVE-2024-38583, CVE-2024-39471, CVE-2024-38578, CVE-2024-38637, CVE-2024-40987, CVE-2024-39506, CVE-2024-39482, CVE-2024-42124, CVE-2024-40981, CVE-2024-35927, CVE-2022-48772, CVE-2024-38588, CVE-2023-52887, CVE-2024-40941, CVE-2024-34027, CVE-2024-38627, CVE-2024-42106, CVE-2024-40927, CVE-2024-38559, CVE-2024-39499,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• M68K architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Accessibility subsystem;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Pin controllers subsystem;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• eCrypt file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFFS2 file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• IOMMU subsystem;
• Memory management;
• Netfilter;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• Multipath TCP;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Network traffic control;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• ALSA framework;
• SoC Audio for Freescale CPUs drivers;
• Kirkwood ASoC drivers; (CVE-2024-42105, CVE-2024-41002, CVE-2024-38558, CVE-2023-52887, CVE-2024-39487, CVE-2024-39276, CVE-2024-42077, CVE-2024-39493, CVE-2024-40934, CVE-2024-39277, CVE-2024-42087, CVE-2024-38598, CVE-2024-38618, CVE-2024-40981, CVE-2024-42127, CVE-2024-38607, CVE-2024-38586, CVE-2024-40901, CVE-2024-40916, CVE-2024-42247, CVE-2024-42093, CVE-2024-36489, CVE-2024-38615, CVE-2024-42120, CVE-2024-38567, CVE-2024-40957, CVE-2024-39501, CVE-2024-42140, CVE-2024-33621, CVE-2024-38573, CVE-2023-52884, CVE-2024-39468, CVE-2024-41092, CVE-2024-40931, CVE-2024-42145, CVE-2024-39490, CVE-2024-38555, CVE-2024-42086, CVE-2024-38597, CVE-2024-40956, CVE-2024-42223, CVE-2024-36894, CVE-2024-40961, CVE-2024-42076, CVE-2024-40994, CVE-2024-38619, CVE-2024-39467, CVE-2024-39466, CVE-2022-48772, CVE-2024-39507, CVE-2024-40914, CVE-2024-41046, CVE-2024-42094, CVE-2024-38591, CVE-2024-42098, CVE-2024-41027, CVE-2024-41040, CVE-2024-41089, CVE-2024-40945,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Drivers core;
• Null block device driver;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EFI core;
• FPGA Framework;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Mailbox framework;
• Media drivers;
• Microchip PCI driver;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• PCI subsystem;
• x86 platform drivers;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Sonic Silicon Backplane drivers;
• Greybus lights staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Watchdog drivers;
• 9P distributed file system;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• Network file system server daemon;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• Tracing file system;
• IOMMU subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• Core kernel;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Memory management;
• 9P file system network protocol;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Network traffic control;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• AppArmor security module;
• Integrity Measurement Architecture(IMA) framework;
• Landlock security;
• Linux Security Modules (LSM) Framework;
• SELinux security module;
• Simplified Mandatory Access Control Kernel framework;
• ALSA framework;
• HD-audio driver;
• SOF drivers;
• KVM core; (CVE-2024-38623, CVE-2024-38662, CVE-2024-39484, CVE-2024-42148, CVE-2024-39493, CVE-2024-38637, CVE-2024-40962, CVE-2024-36281, CVE-2024-40922, CVE-2024-40958, CVE-2024-40920, CVE-2024-40986, CVE-2024-40929, CVE-2024-40967, CVE-2024-39296, CVE-2024-40900, CVE-2024-40995, CVE-2024-40974, CVE-2024-40942, CVE-2024-39464, CVE-2024-40916, CVE-2024-40952, CVE-2024-40997, CVE-2024-41004, CVE-2024-40970, CVE-2024-40911, CVE-2024-40972, CVE-2024-36477, CVE-2024-40996, CVE-2024-40988, CVE-2024-38619, CVE-2024-40998, CVE-2024-38627, CVE-2024-36971, CVE-2024-37021, CVE-2024-40989, CVE-2024-40947, CVE-2024-40957, CVE-2024-39508, CVE-2024-41005, CVE-2024-40931, CVE-2024-34777, CVE-2024-38633, CVE-2024-38663, CVE-2024-36288, CVE-2024-40955, CVE-2024-40973, CVE-2024-39483, CVE-2024-38388, CVE-2024-40976, CVE-2024-38622, CVE-2024-40915, CVE-2024-38661, CVE-2024-38306,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• M68K architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Accessibility subsystem;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Pin controllers subsystem;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• eCrypt file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFFS2 file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• IOMMU subsystem;
• Memory management;
• Netfilter;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• Multipath TCP;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Network traffic control;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• ALSA framework;
• SoC Audio for Freescale CPUs drivers;
• Kirkwood ASoC drivers; (CVE-2024-38613, CVE-2024-42096, CVE-2024-40908, CVE-2024-42137, CVE-2024-38590, CVE-2024-41044, CVE-2024-39480, CVE-2024-39469, CVE-2024-39471, CVE-2024-42089, CVE-2024-38588, CVE-2024-41092, CVE-2024-42120, CVE-2024-40901, CVE-2024-40981, CVE-2024-42127, CVE-2024-40932, CVE-2024-39475, CVE-2024-40957, CVE-2024-39501, CVE-2024-42090, CVE-2024-40904, CVE-2024-40978, CVE-2022-48772, CVE-2024-40934, CVE-2024-38548, CVE-2024-41005, CVE-2024-36489, CVE-2024-36978, CVE-2024-38573, CVE-2024-42106, CVE-2024-42104, CVE-2024-42085, CVE-2024-38621, CVE-2024-42098, CVE-2024-38662, CVE-2024-38587, CVE-2024-41089, CVE-2024-42095, CVE-2024-40916, CVE-2024-39487, CVE-2024-42229, CVE-2023-52884, CVE-2024-40974, CVE-2024-40980, CVE-2024-42225, CVE-2024-39502, CVE-2024-37356, CVE-2024-39488, CVE-2024-40912, CVE-2024-39507, CVE-2024-38591, CVE-2024-31076, CVE-2024-40984, CVE-2024-39500, CVE-2024-38582, CVE-2024-34027, CVE-2024-36270, CVE-2024-42076,…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• M68K architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Accessibility subsystem;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Pin controllers subsystem;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• eCrypt file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFFS2 file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• IOMMU subsystem;
• Memory management;
• Netfilter;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• Multipath TCP;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Network traffic control;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• ALSA framework;
• SoC Audio for Freescale CPUs drivers;
• Kirkwood ASoC drivers; (CVE-2024-42076, CVE-2024-40994, CVE-2024-40932, CVE-2024-41000, CVE-2024-42224, CVE-2024-38633, CVE-2024-40954, CVE-2024-36270, CVE-2024-38623, CVE-2024-38549, CVE-2024-42225, CVE-2024-42085, CVE-2024-42157, CVE-2024-42229, CVE-2024-42109, CVE-2024-41040, CVE-2024-38607, CVE-2024-39493, CVE-2024-38546, CVE-2024-41046, CVE-2024-38567, CVE-2024-42092, CVE-2024-39501, CVE-2024-41005, CVE-2024-42223, CVE-2024-39480, CVE-2024-38571, CVE-2024-41048, CVE-2024-38605, CVE-2024-42094, CVE-2024-38598, CVE-2024-38559, CVE-2024-38558, CVE-2024-40931, CVE-2024-40942, CVE-2024-39495, CVE-2024-40981, CVE-2024-40911, CVE-2024-42148, CVE-2024-33621, CVE-2024-39502, CVE-2024-41095, CVE-2024-40960, CVE-2024-36286, CVE-2024-42232, CVE-2024-42130, CVE-2024-42154, CVE-2024-41087, CVE-2024-41004, CVE-2024-39277, CVE-2024-38560, CVE-2024-36978, CVE-2024-42089, CVE-2024-37356, CVE-2024-38547, CVE-2024-38381, CVE-2024-36015, CVE-2024-38548, CVE-2024-42120,…

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741)

Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde discovered that an untrusted hypervisor could inject malicious #VC interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw is known as WeSee. A local attacker in control of the hypervisor could use this to expose sensitive information or possibly execute arbitrary code in the trusted execution environment. (CVE-2024-25742)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• M68K architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• SuperH RISC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Accessibility subsystem;
• ACPI drivers;
• Android drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• FireWire subsystem;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• EEPROM drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• PTP clock framework;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI drivers;
• Freescale SoC…

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Drivers core;
• Null block device driver;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EFI core;
• FPGA Framework;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Mailbox framework;
• Media drivers;
• Microchip PCI driver;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• PCI subsystem;
• x86 platform drivers;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Sonic Silicon Backplane drivers;
• Greybus lights staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Watchdog drivers;
• 9P distributed file system;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• Network file system server daemon;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• Tracing file system;
• IOMMU subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• Core kernel;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Memory management;
• 9P file system network protocol;
• Amateur Radio drivers;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Networking core;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Network traffic control;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• AppArmor security module;
• Integrity Measurement Architecture(IMA) framework;
• Landlock security;
• Linux Security Modules (LSM) Framework;
• SELinux security module;
• Simplified Mandatory Access Control Kernel framework;
• ALSA framework;
• HD-audio driver;
• SOF drivers;
• KVM core; (CVE-2024-39498, CVE-2024-33847, CVE-2024-39510, CVE-2024-39462, CVE-2024-40930, CVE-2024-38634, CVE-2024-40962, CVE-2024-37078, CVE-2024-39371, CVE-2024-40972, CVE-2024-41002, CVE-2024-40920, CVE-2024-40982, CVE-2024-40915, CVE-2024-40942, CVE-2024-42154, CVE-2024-40937, CVE-2024-40967, CVE-2024-40909, CVE-2024-36244, CVE-2024-33619, CVE-2024-39277, CVE-2024-40900, CVE-2024-38661, CVE-2024-40974, CVE-2024-38618, CVE-2024-32936, CVE-2024-40906, CVE-2024-40919, CVE-2024-39470, CVE-2024-38390, CVE-2024-40966, CVE-2024-39467, CVE-2024-40938, CVE-2024-39471, CVE-2024-39485, CVE-2024-39495, CVE-2024-39492, CVE-2024-39475, CVE-2024-40953, CVE-2024-40939, CVE-2024-39493, CVE-2024-38637, CVE-2024-40945, CVE-2024-41006, CVE-2024-39461, CVE-2024-40948, CVE-2024-40916, CVE-2024-40925, CVE-2024-40956, CVE-2024-40970, CVE-2024-40912, CVE-2024-33621, CVE-2024-40989,…