CVE-2024-41058

cachefiles: fix slab-use-after-free in fscache_withdraw_volume()

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix slab-use-after-free in fscache_withdraw_volume()

We got the following issue in our fault injection stress test:

================================================================== BUG: KASAN: slab-use-after-free in fscache_withdraw_volume+0x2e1/0x370 Read of size 4 at addr ffff88810680be08 by task ondemand-04-dae/5798

CPU: 0 PID: 5798 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #565 Call Trace: kasan_check_range+0xf6/0x1b0 fscache_withdraw_volume+0x2e1/0x370 cachefiles_withdraw_volume+0x31/0x50 cachefiles_withdraw_cache+0x3ad/0x900 cachefiles_put_unbind_pincount+0x1f6/0x250 cachefiles_daemon_release+0x13b/0x290 __fput+0x204/0xa00 task_work_run+0x139/0x230

Allocated by task 5820: __kmalloc+0x1df/0x4b0 fscache_alloc_volume+0x70/0x600 __fscache_acquire_volume+0x1c/0x610 erofs_fscache_register_volume+0x96/0x1a0 erofs_fscache_register_fs+0x49a/0x690 erofs_fc_fill_super+0x6c0/0xcc0 vfs_get_super+0xa9/0x140 vfs_get_tree+0x8e/0x300 do_new_mount+0x28c/0x580 [...]

Freed by task 5820: kfree+0xf1/0x2c0 fscache_put_volume.part.0+0x5cb/0x9e0 erofs_fscache_unregister_fs+0x157/0x1b0 erofs_kill_sb+0xd9/0x1c0 deactivate_locked_super+0xa3/0x100 vfs_get_super+0x105/0x140 vfs_get_tree+0x8e/0x300 do_new_mount+0x28c/0x580 [...]

Following is the process that triggers the issue:

    mount failed         |         daemon exit

deactivate_locked_super cachefiles_daemon_release erofs_kill_sb erofs_fscache_unregister_fs fscache_relinquish_volume __fscache_relinquish_volume fscache_put_volume(fscache_volume, fscache_volume_put_relinquish) zero = __refcount_dec_and_test(&fscache_volume->ref, &ref); cachefiles_put_unbind_pincount cachefiles_daemon_unbind cachefiles_withdraw_cache cachefiles_withdraw_volumes list_del_init(&volume->cache_link) fscache_free_volume(fscache_volume) cache->ops->free_volume cachefiles_free_volume list_del_init(&cachefiles_volume->cache_link); kfree(fscache_volume) cachefiles_withdraw_volume fscache_withdraw_volume fscache_volume->n_accesses // fscache_volume UAF !!!

The fscache_volume in cache->volumes must not have been freed yet, but its reference count may be 0. So use the new fscache_try_get_volume() helper function try to get its reference count.

If the reference count of fscache_volume is 0, fscache_put_volume() is freeing it, so wait for it to be removed from cache->volumes.

If its reference count is not 0, call cachefiles_withdraw_volume() with reference count protection to avoid the above issue.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.28%Up 0.2 points since Jul 30, 2024

What each source reports

NVD Score used 7.8

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix slab-use-after-free in fscache_withdraw_volume()

We got the following issue in our fault injection stress test:

Freed by task 5820: kfree+0xf1/0x2c0 fscache_put_volume.part.0+0x5cb/0x9e0 erofs_fscache_unregister_fs+0x157/0x1b0 erofs_kill_sb+0xd9/0x1c0 deactivate_locked_super+0xa3/0x100 vfs_get_super+0x105/0x140 vfs_get_tree+0x8e/0x300 do_new_mount+0x28c/0x580 [...]

Following is the process that triggers the issue:

    mount failed         |         daemon exit

The fscache_volume in cache->volumes must not have been freed yet, but its reference count may be 0. So use the new fscache_try_get_volume() helper function try to get its reference count.

If the reference count of fscache_volume is 0, fscache_put_volume() is freeing it, so wait for it to be removed from cache->volumes.

If its reference count is not 0, call cachefiles_withdraw_volume() with reference count protection to avoid the above issue.

Record: CVE-2024-41058
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

CVE List No score

cachefiles: fix slab-use-after-free in fscache_withdraw_volume()

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix slab-use-after-free in fscache_withdraw_volume()

We got the following issue in our fault injection stress test:

Freed by task 5820: kfree+0xf1/0x2c0 fscache_put_volume.part.0+0x5cb/0x9e0 erofs_fscache_unregister_fs+0x157/0x1b0 erofs_kill_sb+0xd9/0x1c0 deactivate_locked_super+0xa3/0x100 vfs_get_super+0x105/0x140 vfs_get_tree+0x8e/0x300 do_new_mount+0x28c/0x580 [...]

Following is the process that triggers the issue:

    mount failed         |         daemon exit

The fscache_volume in cache->volumes must not have been freed yet, but its reference count may be 0. So use the new fscache_try_get_volume() helper function try to get its reference count.

If the reference count of fscache_volume is 0, fscache_put_volume() is freeing it, so wait for it to be removed from cache->volumes.

If its reference count is not 0, call cachefiles_withdraw_volume() with reference count protection to avoid the above issue.

Record: CVE-2024-41058
Updated: 2026-11-02

EUVDEUVD-2024-38858 No score

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix slab-use-after-free in fscache_withdraw_volume()

We got the following issue in our fault injection stress test:

Freed by task 5820: kfree+0xf1/0x2c0 fscache_put_volume.part.0+0x5cb/0x9e0 erofs_fscache_unregister_fs+0x157/0x1b0 erofs_kill_sb+0xd9/0x1c0 deactivate_locked_super+0xa3/0x100 vfs_get_super+0x105/0x140 vfs_get_tree+0x8e/0x300 do_new_mount+0x28c/0x580 [...]

Following is the process that triggers the issue:

    mount failed         |         daemon exit

The fscache_volume in cache->volumes must not have been freed yet, but its reference count may be 0. So use the new fscache_try_get_volume() helper function try to get its reference count.

If the reference count of fscache_volume is 0, fscache_put_volume() is freeing it, so wait for it to be removed from cache->volumes.

If its reference count is not 0, call cachefiles_withdraw_volume() with reference count protection to avoid the above issue.

Record: EUVD-2024-38858
Updated: 2026-11-02

GitHub AdvisoriesGHSA-77q5-g293-rv7c 7.8

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use...

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix slab-use-after-free in fscache_withdraw_volume()

We got the following issue in our fault injection stress test:

Freed by task 5820: kfree+0xf1/0x2c0 fscache_put_volume.part.0+0x5cb/0x9e0 erofs_fscache_unregister_fs+0x157/0x1b0 erofs_kill_sb+0xd9/0x1c0 deactivate_locked_super+0xa3/0x100 vfs_get_super+0x105/0x140 vfs_get_tree+0x8e/0x300 do_new_mount+0x28c/0x580 [...]

Following is the process that triggers the issue:

    mount failed         |         daemon exit

The fscache_volume in cache->volumes must not have been freed yet, but its reference count may be 0. So use the new fscache_try_get_volume() helper function try to get its reference count.

If the reference count of fscache_volume is 0, fscache_put_volume() is freeing it, so wait for it to be removed from cache->volumes.

If its reference count is not 0, call cachefiles_withdraw_volume() with reference count protection to avoid the above issue.

Record: GHSA-77q5-g293-rv7c
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVBELL-CVE-2024-41058 7.8

Record: BELL-CVE-2024-41058
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-41058 7.8

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in fscache_withdraw_volume() We got the following issue in our fault injection stress test: ================================================================== BUG: KASAN: slab-use-after-free in fscache_withdraw_volume+0x2e1/0x370 Read of size 4 at addr ffff88810680be08 by task ondemand-04-dae/5798 CPU: 0 PID: 5798 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #565 Call Trace: kasan_check_range+0xf6/0x1b0 fscache_withdraw_volume+0x2e1/0x370 cachefiles_withdraw_volume+0x31/0x50 cachefiles_withdraw_cache+0x3ad/0x900 cachefiles_put_unbind_pincount+0x1f6/0x250 cachefiles_daemon_release+0x13b/0x290 __fput+0x204/0xa00 task_work_run+0x139/0x230 Allocated by task 5820: __kmalloc+0x1df/0x4b0 fscache_alloc_volume+0x70/0x600 __fscache_acquire_volume+0x1c/0x610 erofs_fscache_register_volume+0x96/0x1a0 erofs_fscache_register_fs+0x49a/0x690 erofs_fc_fill_super+0x6c0/0xcc0 vfs_get_super+0xa9/0x140 vfs_get_tree+0x8e/0x300 do_new_mount+0x28c/0x580 [...] Freed by task 5820: kfree+0xf1/0x2c0 fscache_put_volume.part.0+0x5cb/0x9e0 erofs_fscache_unregister_fs+0x157/0x1b0 erofs_kill_sb+0xd9/0x1c0 deactivate_locked_super+0xa3/0x100 vfs_get_super+0x105/0x140 vfs_get_tree+0x8e/0x300 do_new_mount+0x28c/0x580 [...] ================================================================== Following is the process that triggers the issue: mount failed | daemon exit ------------------------------------------------------------ deactivate_locked_super cachefiles_daemon_release erofs_kill_sb erofs_fscache_unregister_fs fscache_relinquish_volume __fscache_relinquish_volume fscache_put_volume(fscache_volume, fscache_volume_put_relinquish) zero = __refcount_dec_and_test(&fscache_volume->ref, &ref); cachefiles_put_unbind_pincount cachefiles_daemon_unbind cachefiles_withdraw_cache cachefiles_withdraw_volumes list_del_init(&volume->cache_link) fscache_free_volume(fscache_volume) cache->ops->free_volume cachefiles_free_volume list_del_init(&cachefiles_volume->cache_link); kfree(fscache_volume) cachefiles_withdraw_volume fscache_withdraw_volume fscache_volume->n_accesses // fscache_volume UAF !!! The fscache_volume in cache->volumes must not have been freed yet, but its reference count may be 0. So use the new fscache_try_get_volume() helper function try to get its reference count. If the reference count of fscache_volume is 0, fscache_put_volume() is freeing it, so wait for it to be removed from cache->volumes. If its reference count is not 0, call cachefiles_withdraw_volume() with reference count protection to avoid the above issue.

Record: DEBIAN-CVE-2024-41058
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 25 moreShow less

OSVOESA-2024-2076 8.2

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound

Raw packet from PF_PACKET socket ontop of an IPv6-backed ipvlan device will hit WARN_ON_ONCE() in sk_mc_loop() through sch_direct_xmit() path.

WARNING: CPU: 2 PID: 0 at net/core/sock.c:775 sk_mc_loop+0x2d/0x70 Modules linked in: sch_netem ipvlan rfkill cirrus drm_shmem_helper sg drm_kms_helper CPU: 2 PID: 0 Comm: swapper/2 Kdump: loaded Not tainted 6.9.0+ #279 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:sk_mc_loop+0x2d/0x70 Code: fa 0f 1f 44 00 00 65 0f b7 15 f7 96 a3 4f 31 c0 66 85 d2 75 26 48 85 ff 74 1c RSP: 0018:ffffa9584015cd78 EFLAGS: 00010212 RAX: 0000000000000011 RBX: ffff91e585793e00 RCX: 0000000002c6a001 RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffff91e589c0f000 RBP: ffff91e5855bd100 R08: 0000000000000000 R09: 3d00545216f43d00 R10: ffff91e584fdcc50 R11: 00000060dd8616f4 R12: ffff91e58132d000 R13: ffff91e584fdcc68 R14: ffff91e5869ce800 R15: ffff91e589c0f000 FS: 0000000000000000(0000) GS:ffff91e898100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f788f7c44c0 CR3: 0000000008e1a000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ? __warn (kernel/panic.c:693) ? sk_mc_loop (net/core/sock.c:760) ? report_bug (lib/bug.c:201 lib/bug.c:219) ? handle_bug (arch/x86/kernel/traps.c:239) ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) ? sk_mc_loop (net/core/sock.c:760) ip6_finish_output2 (net/ipv6/ip6_output.c:83 (discriminator 1)) ? nf_hook_slow (net/netfilter/core.c:626) ip6_finish_output (net/ipv6/ip6_output.c:222) ? __pfx_ip6_finish_output (net/ipv6/ip6_output.c:215) ipvlan_xmit_mode_l3 (drivers/net/ipvlan/ipvlan_core.c:602) ipvlan ipvlan_start_xmit (drivers/net/ipvlan/ipvlan_main.c:226) ipvlan dev_hard_start_xmit (net/core/dev.c:3594) sch_direct_xmit (net/sched/sch_generic.c:343) __qdisc_run (net/sched/sch_generic.c:416) net_tx_action (net/core/dev.c:5286) handle_softirqs (kernel/softirq.c:555) __irq_exit_rcu (kernel/softirq.c:589) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1043)

The warning triggers as this: packet_sendmsg packet_snd //skb->sk is packet sk __dev_queue_xmit __dev_xmit_skb //q->enqueue is not NULL __qdisc_run sch_direct_xmit dev_hard_start_xmit ipvlan_start_xmit ipvlan_xmit_mode_l3 //l3 mode ipvlan_process_outbound //vepa flag ipvlan_process_v6_outbound ip6_local_out __ip6_finish_output ip6_finish_output2 //multicast packet sk_mc_loop //sk->sk_family is AF_PACKET

Call ip{6}_local_out() with NULL sk in ipvlan as other tunnels to fix this.(CVE-2024-33621)

In the Linux kernel, the following vulnerability has been resolved:

f2fs: compress: don't allow unaligned truncation on released compress inode

f2fs image may be corrupted after below testcase:

mkfs.f2fs -O extra_attr,compression -f /dev/vdb
mount /dev/vdb /mnt/f2fs
touch /mnt/f2fs/file
f2fs_io setflags compression /mnt/f2fs/file
dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=4
f2fs_io release_cblocks /mnt/f2fs/file
truncate -s 8192 /mnt/f2fs/file
umount /mnt/f2fs
fsck.f2fs /dev/vdb

[ASSERT] (fsck_chk_inode_blk:1256) --> ino: 0x5 has i_blocks: 0x00000002, but has 0x3 blocks [FSCK] valid_block_count matching with CP [Fail] [0x4, 0x5] [FSCK] other corrupted bugs …

Record: OESA-2024-2076
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

OSVRHSA-2024:9315 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2024:9315
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-41058 7.8

Record: UBUNTU-CVE-2024-41058
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2025-1738671431 No score

kernel: Fix of 43 CVEs

smb: client: fix use-after-free of signing key {CVE-2024-53179}
smb: client: stop flooding dmesg in smb2_calc_signature() {CVE-2024-53179}
smb3: fix oops in calculating shash_setkey {CVE-2024-53179}
cifs: return correct error in ->calc_signature() {CVE-2024-53179}
cifs: secmech: use shash_desc directly, remove sdesc {CVE-2024-53179}
cifs: replace kfree() with kfree_sensitive() for sensitive data {CVE-2024-53179}
xsk: fix OOB map writes when deleting elements {CVE-2024-56614}
hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer {CVE-2024-53103}
scsi: sg: Fix slab-use-after-free read in sg_release() {CVE-2024-56631}
EDAC/igen6: Avoid segmentation fault on module unload {CVE-2024-56708}
acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl {CVE-2024-56662}
net: inet: do not leave a dangling sk pointer in inet_create() {CVE-2024-56601}
initramfs: avoid filename buffer overrun {CVE-2024-53142}
ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() {CVE-2024-56604}
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() {CVE-2024-53156}
Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() {CVE-2024-56605}
Bluetooth: msft: fix slab-use-after-free in msft_do_close() {CVE-2024-36012}
Bluetooth: Fix support for Read Local Supported Codecs V2 {CVE-2024-36012}
Bluetooth: hci_codec: Fix leaking content of local_codecs {CVE-2024-36012}
blk-cgroup: Fix UAF in blkcg_unpin_online() {CVE-2024-56672}
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() {CVE-2024-56602}
net: inet6: do not leave a dangling sk pointer in inet6_create() {CVE-2024-56600}
NFSv4.0: Fix a use-after-free problem in the asynchronous open() {CVE-2024-53173}
net: af_can: do not leave a dangling sk pointer in can_create() {CVE-2024-56603}
drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 {CVE-2023-52818}
bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
ceph: prevent use-after-free in encode_cap_msg() {CVE-2024-26689}
drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' {CVE-2024-56608}
netfilter: ipset: add missing range check in bitmap_ip_uadt {CVE-2024-53141}
HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit {CVE-2023-52519}
tipc: Fix use-after-free of kernel socket in cleanup_bearer(). {CVE-2024-56642}
cifs: Fix buffer overflow when parsing NFS reparse points {CVE-2024-49996}
Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
PM / devfreq: Fix buffer overflow in trans_stat_show {CVE-2023-52614}
PM / devfreq: Rework freq_table to be local to devfreq struct {CVE-2023-52614}
cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() {CVE-2024-41057}
cachefiles: fix slab-use-after-free in fscache_withdraw_volume() {CVE-2024-41058}
[ELSCVE-37480] netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume() {CVE-2024-41058}
memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
Bluetooth: ISO: Fix UAF on iso_sock_timeout {CVE-2024-50124}
Bluetooth: SCO: Fix UAF on sco_sock_timeout {CVE-2024-50125}
Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout {CVE-2024-50125}
Bluetooth: Consolidate code around sk_alloc into a helper function {CVE-2024-50125}
smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() {CVE-2024-35861}
gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() {CVE-2024-26754}
smb: client: fix potential UAF in cifs_stats_proc_write() {CVE-2024-35868}
smb: client: fix potential UAF in cifs_debug_files_proc_show() {CVE-2024-35868}
vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans {CVE-2024-50264}
net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT {CVE-2024-53057}
wifi:…

Record: CLSA-2025-1738671431
Updated: 2026-11-02

OSV No score

cachefiles: fix slab-use-after-free in fscache_withdraw_volume()

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix slab-use-after-free in fscache_withdraw_volume()

We got the following issue in our fault injection stress test:

Freed by task 5820: kfree+0xf1/0x2c0 fscache_put_volume.part.0+0x5cb/0x9e0 erofs_fscache_unregister_fs+0x157/0x1b0 erofs_kill_sb+0xd9/0x1c0 deactivate_locked_super+0xa3/0x100 vfs_get_super+0x105/0x140 vfs_get_tree+0x8e/0x300 do_new_mount+0x28c/0x580 [...]

Following is the process that triggers the issue:

    mount failed         |         daemon exit

The fscache_volume in cache->volumes must not have been freed yet, but its reference count may be 0. So use the new fscache_try_get_volume() helper function try to get its reference count.

If the reference count of fscache_volume is 0, fscache_put_volume() is freeing it, so wait for it to be removed from cache->volumes.

If its reference count is not 0, call cachefiles_withdraw_volume() with reference count protection to avoid the above issue.

Record: CVE-2024-41058
Updated: 2026-11-02

OSVMGASA-2024-0277 No score

Updated kernel, kmod-xtables-addons & kmod-virtualbox packages fix security vulnerabilities

Upstream kernel version 6.6.43 fix bugs and vulnerabilities. The kmod-virtualbox and kmod-xtables-addons packages have been updated to work with this new kernel. For information about the vulnerabilities see the links.

Record: MGASA-2024-0277
Updated: 2026-11-02

OSVMGASA-2024-0278 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.6.43 fix bugs and vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2024-0278
Updated: 2026-11-02

OSVSUSE-SU-2024:2894-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
CVE-2021-47186: tipc: check for null after calling kmemdup (bsc#1222702).
CVE-2021-47546: Kabi fix for ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571)
CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len (bsc#1226555).
CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071)
CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869)
CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
CVE-2023-52812: drm/amd: check num of link levels when update pcie param (bsc#1225564).
CVE-2023-52857: drm/mediatek: Fix coverity issue with unintentional integer overflow (bsc#1225581).
CVE-2023-52863: hwmon: (axi-fan-control) Fix possible NULL pointer dereference (bsc#1225586).
CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
CVE-2024-26633: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (bsc#1221647).
CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2 (bsc#1221656).
CVE-2024-26636: llc: make llc_ui_sendmsg() more robust against bonding changes (bsc#1221659).
CVE-2024-26641: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() (bsc#1221654).
CVE-2024-26661: drm/amd/display: Add NULL test for 'timing generator' in (bsc#1222323)
CVE-2024-26663: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (bsc#1222326).
CVE-2024-26665: tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328).
CVE-2024-26802: stmmac: Clear variable when destroying workqueue (bsc#1222799).
CVE-2024-26863: hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021).
CVE-2024-26961: mac802154: fix llsec key resources release in mac802154_llsec_key_del (bsc#1223652).
CVE-2024-27015: netfilter: flowtable: incorrect pppoe tuple (bsc#1223806).
CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
CVE-2024-27025: nbd: null check for nla_nest_start (bsc#1223778)
CVE-2024-27065: netfilter: nf_tables: do not compare internal table flags on updates (bsc#1223836).
CVE-2024-27402: phonet/pep: fix racy skb_queue_empty() use (bsc#1224414).
CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ…

Record: SUSE-SU-2024:2894-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2939-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958).
CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
CVE-2021-47186: tipc: check for null after calling kmemdup (bsc#1222702).
CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
CVE-2021-47546: ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571).
CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len. (bsc#1226555).
CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071).
CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869).
CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
CVE-2023-52787: blk-mq: make…

Record: SUSE-SU-2024:2939-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2947-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
CVE-2021-47186: ipc: check for null after calling kmemdup (bsc#1222702).
CVE-2021-47546: Kabi fix for ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571)
CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len (bsc#1226555).
CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071)
CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869)
CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
CVE-2023-52812: drm/amd: check num of link levels when update pcie param (bsc#1225564).
CVE-2023-52857: drm/mediatek: Fix coverity issue with unintentional integer overflow (bsc#1225581).
CVE-2023-52863: hwmon: (axi-fan-control) Fix possible NULL pointer dereference (bsc#1225586).
CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
CVE-2024-26633: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (bsc#1221647).
CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2 (bsc#1221656).
CVE-2024-26636: llc: make llc_ui_sendmsg() more robust against bonding changes (bsc#1221659).
CVE-2024-26641: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() (bsc#1221654).
CVE-2024-26661: drm/amd/display: Add NULL test for 'timing generator' in (bsc#1222323)
CVE-2024-26663: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (bsc#1222326).
CVE-2024-26665: tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328).
CVE-2024-26802: stmmac: Clear variable when destroying workqueue (bsc#1222799).
CVE-2024-26863: hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021).
CVE-2024-26961: mac802154: fix llsec key resources release in mac802154_llsec_key_del (bsc#1223652).
CVE-2024-27015: netfilter: flowtable: incorrect pppoe tuple (bsc#1223806).
CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
CVE-2024-27025: nbd: null check for nla_nest_start (bsc#1223778)
CVE-2024-27065: netfilter: nf_tables: do not compare internal table flags on updates (bsc#1223836).
CVE-2024-27402: phonet/pep: fix racy skb_queue_empty() use (bsc#1224414).
CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ…

Record: SUSE-SU-2024:2947-1
Updated: 2026-11-02

OSVSUSE-SU-2024:3194-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
CVE-2024-43911: Fix NULL dereference at band check in starting tx ba session (bsc#1229827).
CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
CVE-2024-36270: Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (bsc#1226798)
CVE-2024-36881: Reset ptes when close() for wr-protected ones (bsc#1225718).
CVE-2024-42316: Fix div-by-zero in vmpressure_calc_level() (bsc#1229353).
CVE-2024-43855: Fix deadlock between mddev_suspend and flush bio (bsc#1229342,).
CVE-2024-43864: Fix CT entry update leaks of modify header context (bsc#1229496)
CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
CVE-2024-42109: Unconditionally flush pending work before notifier (bsc#1228505)
CVE-2024-41084: Avoid null pointer dereference in region lookup (bsc#1228472)
CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
CVE-2024-27079: Add kABI workaround patch (bsc#1223742).
CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26809: Release elements in clone only from destroy path (bsc#1222633).
CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).
CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).
CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).
CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).
CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)
CVE-2024-27433: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
CVE-2024-40920: Fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
CVE-2024-40921: Pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
CVE-2024-36979: Fix vlan use-after-free (bsc#1226604).
CVE-2024-26590: Fix inconsistent per-file compression format (bsc#1220252,).
CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).
CVE-2024-42270: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404)
CVE-2024-42269: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402)
CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383) -…

Record: SUSE-SU-2024:3194-1
Updated: 2026-11-02

OSVSUSE-SU-2024:3195-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
CVE-2024-43911: Fix NULL dereference at band check in starting tx ba session (bsc#1229827).
CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
CVE-2024-36881: Fix reset ptes when close() for wr-protected (bsc#1225718).
CVE-2024-42316: Fix div-by-zero in vmpressure_calc_level() (bsc#1229353).
CVE-2024-43855: Fix deadlock between mddev_suspend and flush bio (bsc#1229342).
CVE-2024-43864: Fix CT entry update leaks of modify header context (bsc#1229496).
CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
CVE-2024-42109: Unconditionally flush pending work before notifier (bsc#1228505).
CVE-2024-41084: Avoid null pointer dereference in region lookup (bsc#1228472).
CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
CVE-2024-27079: Fix NULL domain on device release (bsc#1223742).
CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26809: Release elements in clone only from destroy path (bsc#1222633).
CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).
CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).
CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).
CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).
CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)
CVE-2024-27433: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
CVE-2024-40920: Fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
CVE-2024-40921: Pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
CVE-2024-36979: Fix vlan use-after-free (bsc#1226604).
CVE-2024-26590: Fix inconsistent per-file compression format (bsc#1220252).
CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).
CVE-2024-42270: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404).
CVE-2024-42269: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402).
CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383)
CVE-2024-42312: Always initialize i_uid/i_gid (bsc#1229357)
CVE-2024-43854: Initialize integrity buffer to zero…

Record: SUSE-SU-2024:3195-1
Updated: 2026-11-02

OSVSUSE-SU-2024:3383-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-43911: wifi: mac80211: fix NULL dereference at band check in starting tx ba session (bsc#1229827).
CVE-2024-43899: drm/amd/display: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
CVE-2024-43880: kabi: lib: objagg: Put back removed metod in struct objagg_ops (bsc#1229481).
CVE-2024-43866: net/mlx5: Always drain health in shutdown callback (bsc#1229495).
CVE-2024-43864: net/mlx5e: Fix CT entry update leaks of modify header context (bsc#1229496).
CVE-2024-43855: md: fix deadlock between mddev_suspend and flush bio (bsc#1229342).
CVE-2024-43854: block: initialize integrity buffer to zero before writing it to media (bsc#1229345)
CVE-2024-43850: soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove (bsc#1229316).
CVE-2024-43839: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).
CVE-2024-43837: bpf: Fix updating attached freplace prog in prog_array map (bsc#1229297).
CVE-2024-43834: xdp: fix invalid wait context of page_pool_destroy() (bsc#1229314)
CVE-2024-43831: media: mediatek: vcodec: Handle invalid decoder vsi (bsc#1229309).
CVE-2024-43821: scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315).
CVE-2024-42322: ipvs: properly dereference pe in ip_vs_add_service (bsc#1229347)
CVE-2024-42318: landlock: Do not lose track of restrictions on cred_transfer (bsc#1229351).
CVE-2024-42316: mm/mglru: fix div-by-zero in vmpressure_calc_level() (bsc#1229353).
CVE-2024-42312: sysctl: always initialize i_uid/i_gid (bsc#1229357)
CVE-2024-42308: Update DRM patch reference (bsc#1229411)
CVE-2024-42301: dev/parport: fix the array out-of-bounds risk (bsc#1229407).
CVE-2024-42295: nilfs2: handle inconsistent state in nilfs_btnode_create_block() (bsc#1229370).
CVE-2024-42291: ice: Add a per-VF limit on number of FDIR filters (bsc#1229374).
CVE-2024-42290: irqchip/imx-irqsteer: Handle runtime power management correctly (bsc#1229379).
CVE-2024-42284: tipc: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
CVE-2024-42283: net: nexthop: Initialize all fields in dumped nexthops (bsc#1229383)
CVE-2024-42281: bpf: Fix a segment issue when downgrading gso_size (bsc#1229386).
CVE-2024-42277: iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
CVE-2024-42270: netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404).
CVE-2024-42269: netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402).
CVE-2024-42268: net/mlx5: Fix missing lock on sync reset reload (bsc#1229391).
CVE-2024-42247: wireguard: allowedips: avoid unaligned 64-bit memory accesses (bsc#1228988).
CVE-2024-42246: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).
CVE-2024-42245: Revert 'sched/fair: Make sure to try to detach at least one movable task' (bsc#1228978).
CVE-2024-42241: mm/shmem: disable PMD-sized page cache if needed (bsc#1228986).
CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list (bsc#1228723).
CVE-2024-42162: gve: Account for stopped queues when reading NIC stats (bsc#1228706).
CVE-2024-42161: bpf: avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756).
CVE-2024-42159: scsi: mpi3mr: fix sanitise num_phys (bsc#1228754).
CVE-2024-42158: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
CVE-2024-42157: s390/pkey: Wipe sensitive data on failure (bsc#1228727).
CVE-2024-42156: s390/pkey: Wipe copies of clear-key structures on failure (bsc#1228722).
CVE-2024-42155: s390/pkey: Wipe copies of protected- and secure-keys (bsc#1228733).
CVE-2024-42148: bnx2x: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).
CVE-2024-42145:…

Record: SUSE-SU-2024:3383-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20044-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 kernel was updated to receive various security bugfixes.

This release includes the first live patch.

The following security bugs were fixed:

CVE-2023-52489: mm/sparsemem: fix race in accessing memory_section->usage (bsc#1221326).
CVE-2023-52581: netfilter: nf_tables: fix memleak when more than 255 elements expired (bsc#1220877).
CVE-2023-52859: perf: hisi: Fix use-after-free when register pmu fails (bsc#1225582).
CVE-2023-52889: apparmor: Fix null pointer deref when receiving skb during sock creation (bsc#1229287,).
CVE-2024-26590: erofs: fix inconsistent per-file compression format (bsc#1220252).
CVE-2024-26631: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
CVE-2024-26668: netfilter: nft_limit: reject configurations that cause integer overflow (bsc#1222335).
CVE-2024-26669: kABI fix for net/sched: flower: Fix chain template offload (bsc#1222350).
CVE-2024-26677: blacklist.conf: Add e7870cf13d20 ("rxrpc: Fix delayed ACKs to not set the reference serial number") (bsc#1222387)
CVE-2024-26735: ipv6: sr: fix possible use-after-free and null-ptr-deref (bsc#1222372).
CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26809: netfilter: nft_set_pipapo: release elements in clone only from destroy path (bsc#1222633).
CVE-2024-26812: kABI: vfio: struct virqfd kABI workaround (bsc#1222808).
CVE-2024-26835: netfilter: nf_tables: set dormant flag on hook register failure (bsc#1222967).
CVE-2024-26837: net: bridge: switchdev: Skip MDB replays of deferred events on offload (bsc#1222973).
CVE-2024-26851: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (bsc#1223074)
CVE-2024-27010: net/sched: Fix mirred deadlock on device recursion (bsc#1223720).
CVE-2024-27011: netfilter: nf_tables: fix memleak in map from abort path (bsc#1223803).
CVE-2024-27024: net/rds: fix WARNING in rds_conn_connect_if_down (bsc#1223777).
CVE-2024-27079: iommu/vt-d: Fix NULL domain on device release (bsc#1223742).
CVE-2024-27403: kabi: restore const specifier in flow_offload_route_init() (bsc#1224415).
CVE-2024-27433: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
CVE-2024-35897: netfilter: nf_tables: discard table flag update with pending basechain deletion (bsc#1224510).
CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
CVE-2024-36286: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
CVE-2024-36489: tls: fix missing memory barrier in tls_init (bsc#1226874)
CVE-2024-36881: mm/userfaultfd: reset ptes when close() for wr-protected ones (bsc#1225718).
CVE-2024-36929: net: core: reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).
CVE-2024-36933: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).
CVE-2024-36979: net: bridge: mst: fix vlan use-after-free syzbot reported a suspicious rcu usage[1] in bridge's mst code. (bsc#1226604).
CVE-2024-38662: selftests/bpf: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
CVE-2024-39489: ipv6: sr: fix memleak in seg6_hmac_init_algo (bsc#1227623)
CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).
CVE-2024-40905: ipv6: fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
CVE-2024-40909: bpf: Fix a potential use-after-free in bpf_link_free() (bsc#1227798).
CVE-2024-40920: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
CVE-2024-40921: net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
CVE-2024-40938: landlock: fix d_parent…

Record: SUSE-SU-2025:20044-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20047-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52489: mm/sparsemem: fix race in accessing memory_section->usage (bsc#1221326).
CVE-2023-52581: netfilter: nf_tables: fix memleak when more than 255 elements expired (bsc#1220877).
CVE-2023-52859: perf: hisi: Fix use-after-free when register pmu fails (bsc#1225582).
CVE-2023-52889: apparmor: Fix null pointer deref when receiving skb during sock creation (bsc#1229287).
CVE-2024-26590: erofs: fix inconsistent per-file compression format (bsc#1220252).
CVE-2024-26631: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
CVE-2024-26668: netfilter: nft_limit: reject configurations that cause integer overflow (bsc#1222335).
CVE-2024-26669: kABI fix for net/sched: flower: Fix chain template offload (bsc#1222350).
CVE-2024-26677: Blacklist e7870cf13d20 (" Fix delayed ACKs to not set the reference serial number") (bsc#1222387)
CVE-2024-26735: ipv6: sr: fix possible use-after-free and null-ptr-deref (bsc#1222372).
CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26809: netfilter: nft_set_pipapo: release elements in clone only from destroy path (bsc#1222633).
CVE-2024-26812: kABI: vfio: struct virqfd kABI workaround (bsc#1222808).
CVE-2024-26835: netfilter: nf_tables: set dormant flag on hook register failure (bsc#1222967).
CVE-2024-26837: net: bridge: switchdev: race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).
CVE-2024-26851: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (bsc#1223074)
CVE-2024-27010: net/sched: Fix mirred deadlock on device recursion (bsc#1223720).
CVE-2024-27011: netfilter: nf_tables: fix memleak in map from abort path (bsc#1223803).
CVE-2024-27024: net/rds: fix WARNING in rds_conn_connect_if_down (bsc#1223777).
CVE-2024-27079: iommu/vt-d: Fix NULL domain on device release (bsc#1223742).
CVE-2024-27403: kabi: restore const specifier in flow_offload_route_init() (bsc#1224415).
CVE-2024-27433: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).
CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
CVE-2024-35897: netfilter: nf_tables: discard table flag update with pending basechain deletion (bsc#1224510).
CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
CVE-2024-36286: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
CVE-2024-36489: tls: fix missing memory barrier in tls_init (bsc#1226874)
CVE-2024-36881: mm/userfaultfd: Fix reset ptes when close() for wr-protected (bsc#1225718).
CVE-2024-36929: net: core: reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).
CVE-2024-36933: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).
CVE-2024-36979: net: bridge: mst: fix vlan use-after-free (bsc#1226604).
CVE-2024-38662: selftests/bpf: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
CVE-2024-39489: ipv6: sr: fix memleak in seg6_hmac_init_algo (bsc#1227623)
CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).
CVE-2024-40905: ipv6: fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
CVE-2024-40909: bpf: Fix a potential use-after-free in bpf_link_free() (bsc#1227798).
CVE-2024-40920: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (bsc#1227781).
CVE-2024-40921: net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).
CVE-2024-40938: landlock: fix d_parent walk (bsc#1227840).
CVE-2024-40939: net: wwan: iosm: Fix tainted…

Record: SUSE-SU-2025:20047-1
Updated: 2026-11-02

OSVUSN-7089-1 No score

linux, linux-gcp-6.8, linux-hwe-6.8 vulnerabilities

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741)