CVE-2024-49967

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Add NULL pointer check for kzalloc

[Why & How] Check return pointer of kzalloc before using it.(CVE-2024-42122)

In the Linux kernel, the following vulnerability has been resolved:

mm: gup: stop abusing try_grab_folio

A kernel warning was reported when pinning folio in CMA memory when launching SEV virtual machine. The splat looks like:

[ 464.325306] WARNING: CPU: 13 PID: 6734 at mm/gup.c:1313 __get_user_pages+0x423/0x520 [ 464.325464] CPU: 13 PID: 6734 Comm: qemu-kvm Kdump: loaded Not tainted 6.6.33+ #6 [ 464.325477] RIP: 0010:__get_user_pages+0x423/0x520 [ 464.325515] Call Trace: [ 464.325520] <TASK> [ 464.325523] ? __get_user_pages+0x423/0x520 [ 464.325528] ? __warn+0x81/0x130 [ 464.325536] ? __get_user_pages+0x423/0x520 [ 464.325541] ? report_bug+0x171/0x1a0 [ 464.325549] ? handle_bug+0x3c/0x70 [ 464.325554] ? exc_invalid_op+0x17/0x70 [ 464.325558] ? asm_exc_invalid_op+0x1a/0x20 [ 464.325567] ? __get_user_pages+0x423/0x520 [ 464.325575] __gup_longterm_locked+0x212/0x7a0 [ 464.325583] internal_get_user_pages_fast+0xfb/0x190 [ 464.325590] pin_user_pages_fast+0x47/0x60 [ 464.325598] sev_pin_memory+0xca/0x170 [kvm_amd] [ 464.325616] sev_mem_enc_register_region+0x81/0x130 [kvm_amd]

Per the analysis done by yangge, when starting the SEV virtual machine, it will call pin_user_pages_fast(..., FOLL_LONGTERM, ...) to pin the memory. But the page is in CMA area, so fast GUP will fail then fallback to the slow path due to the longterm pinnalbe check in try_grab_folio().

The slow path will try to pin the pages then migrate them out of CMA area. But the slow path also uses try_grab_folio() to pin the page, it will also fail due to the same check then the above warning is triggered.

In addition, the try_grab_folio() is supposed to be used in fast path and it elevates folio refcount by using add ref unless zero. We are guaranteed to have at least one stable reference in slow path, so the simple atomic add could be used. The performance difference should be trivial, but the misuse may be confusing and misleading.

Redefined try_grab_folio() to try_grab_folio_fast(), and try_grab_page() to try_grab_folio(), and use them in the proper paths. This solves both the abuse and the kernel warning.

The proper naming makes their usecase more clear and should prevent from abusing in the future.

peterx said:

: The user will see the pin fails, for gpu-slow it further triggers the WARN : right below that failure (as in the original report): : : folio = try_grab_folio(page, page_increm - 1, : foll_flags); : if (WARN_ON_ONCE(!folio)) { <------------------------ here : /* : * Release the 1st page ref if the : * folio is problematic, fail hard. : */ : gup_put_folio(page_folio(page), 1, : foll_flags); : ret = -EFAULT; : goto out; : }

[1] https://lore.kernel.org/linux-mm/1719478388-31917-1-git-send-email-yangge1116@126.com/

[shy828301@gmail.com: fix implicit declaration of function try_grab_folio_fast] Link: https://lkml.kernel.org/r/CAHbLzkowMSso-4Nufc9hcMehQsK9PNz3OSu-+eniU-2Mm-xjhA@mail.gmail.com(CVE-2024-44943)

In the Linux kernel, the following vulnerability has been resolved:

serial: sc16is7xx: fix TX fifo corruption

Sometimes, when a packet is received on channel A at almost the same time as a packet is about to be transmitted on channel B, we observe with a logic analyzer that the received packet on channel A is transmitted on channel B. In other words, the Tx buffer data on channel B is corrupted with data from channel A.

The problem appeared since commit…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: single: fix potential NULL dereference in pcs_get_function()

pinmux_generic_get_function() can return NULL and the pointer 'function' was dereferenced without checking against NULL. Add checking of pointer 'function' in pcs_get_function().

Found by code review.(CVE-2024-46685)

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Mark XDomain as unplugged when router is removed

I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another host connected with enabled paths we hang in tearing them down. This is due to fact that the Thunderbolt networking driver also tries to cleanup the paths and ends up blocking in tb_disconnect_xdomain_paths() waiting for the domain lock.

However, at this point we already cleaned the paths in tb_stop() so there is really no need for tb_disconnect_xdomain_paths() to do that anymore. Furthermore it already checks if the XDomain is unplugged and bails out early so take advantage of that and mark the XDomain as unplugged when we remove the parent router.(CVE-2024-46702)

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]

[WHY & HOW] num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets - 1].

This fixes an OVERRUN issue reported by Coverity.(CVE-2024-46815)

In the Linux kernel, the following vulnerability has been resolved: vfs: fix race between evice_inodes() and find_inode()&iput() Hi, all Recently I noticed a bug[1] in btrfs, after digged it into and I believe it'a race in vfs. Let's assume there's a inode (ie ino 261) with i_count 1 is called by iput(), and there's a concurrent thread calling generic_shutdown_super(). cpu0: cpu1: iput() // i_count is 1 ->spin_lock(inode) ->dec i_count to 0 ->iput_final() generic_shutdown_super() ->__inode_add_lru() ->evict_inodes() // cause some reason[2] ->if (atomic_read(inode->i_count)) continue; // return before // inode 261 passed the above check // list_lru_add_obj() // and then schedule out ->spin_unlock() // note here: the inode 261 // was still at sb list and hash list, // and I_FREEING|I_WILL_FREE was not been set btrfs_iget() // after some function calls ->find_inode() // found the above inode 261 ->spin_lock(inode) // check I_FREEING|I_WILL_FREE // and passed ->__iget() ->spin_unlock(inode) // schedule back ->spin_lock(inode) // check (I_NEW|I_FREEING|I_WILL_FREE) flags, // passed and set I_FREEING iput() ->spin_unlock(inode) ->spin_lock(inode) ->evict() // dec i_count to 0 ->iput_final() ->spin_unlock() ->evict() Now, we have two threads simultaneously evicting the same inode, which may trigger the BUG(inode->i_state & I_CLEAR) statement both within clear_inode() and iput(). To fix the bug, recheck the inode->i_count after holding i_lock. Because in the most scenarios, the first check is valid, and the overhead of spin_lock() can be reduced. If there is any misunderstanding, please let me know, thanks. [1]: https://lore.kernel.org/linux-btrfs/000000000000eabe1d0619c48986@google.com/ [2]: The reason might be 1. SB_ACTIVE was removed or 2. mapping_shrinkable() return false when I reproduced the bug.(CVE-2024-47679)

In the Linux…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: single: fix potential NULL dereference in pcs_get_function()

pinmux_generic_get_function() can return NULL and the pointer 'function' was dereferenced without checking against NULL. Add checking of pointer 'function' in pcs_get_function().

Found by code review.(CVE-2024-46685)

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Mark XDomain as unplugged when router is removed

I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another host connected with enabled paths we hang in tearing them down. This is due to fact that the Thunderbolt networking driver also tries to cleanup the paths and ends up blocking in tb_disconnect_xdomain_paths() waiting for the domain lock.

However, at this point we already cleaned the paths in tb_stop() so there is really no need for tb_disconnect_xdomain_paths() to do that anymore. Furthermore it already checks if the XDomain is unplugged and bails out early so take advantage of that and mark the XDomain as unplugged when we remove the parent router.(CVE-2024-46702)

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]

[WHY & HOW] num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets - 1].

This fixes an OVERRUN issue reported by Coverity.(CVE-2024-46815)

In the Linux kernel, the following vulnerability has been resolved: vfs: fix race between evice_inodes() and find_inode()&iput() Hi, all Recently I noticed a bug[1] in btrfs, after digged it into and I believe it'a race in vfs. Let's assume there's a inode (ie ino 261) with i_count 1 is called by iput(), and there's a concurrent thread calling generic_shutdown_super(). cpu0: cpu1: iput() // i_count is 1 ->spin_lock(inode) ->dec i_count to 0 ->iput_final() generic_shutdown_super() ->__inode_add_lru() ->evict_inodes() // cause some reason[2] ->if (atomic_read(inode->i_count)) continue; // return before // inode 261 passed the above check // list_lru_add_obj() // and then schedule out ->spin_unlock() // note here: the inode 261 // was still at sb list and hash list, // and I_FREEING|I_WILL_FREE was not been set btrfs_iget() // after some function calls ->find_inode() // found the above inode 261 ->spin_lock(inode) // check I_FREEING|I_WILL_FREE // and passed ->__iget() ->spin_unlock(inode) // schedule back ->spin_lock(inode) // check (I_NEW|I_FREEING|I_WILL_FREE) flags, // passed and set I_FREEING iput() ->spin_unlock(inode) ->spin_lock(inode) ->evict() // dec i_count to 0 ->iput_final() ->spin_unlock() ->evict() Now, we have two threads simultaneously evicting the same inode, which may trigger the BUG(inode->i_state & I_CLEAR) statement both within clear_inode() and iput(). To fix the bug, recheck the inode->i_count after holding i_lock. Because in the most scenarios, the first check is valid, and the overhead of spin_lock() can be reduced. If there is any misunderstanding, please let me know, thanks. [1]: https://lore.kernel.org/linux-btrfs/000000000000eabe1d0619c48986@google.com/ [2]: The reason might be 1. SB_ACTIVE was removed or 2. mapping_shrinkable() return false when I reproduced the bug.(CVE-2024-47679)

In the Linux…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: single: fix potential NULL dereference in pcs_get_function()

pinmux_generic_get_function() can return NULL and the pointer 'function' was dereferenced without checking against NULL. Add checking of pointer 'function' in pcs_get_function().

Found by code review.(CVE-2024-46685)

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Mark XDomain as unplugged when router is removed

I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another host connected with enabled paths we hang in tearing them down. This is due to fact that the Thunderbolt networking driver also tries to cleanup the paths and ends up blocking in tb_disconnect_xdomain_paths() waiting for the domain lock.

However, at this point we already cleaned the paths in tb_stop() so there is really no need for tb_disconnect_xdomain_paths() to do that anymore. Furthermore it already checks if the XDomain is unplugged and bails out early so take advantage of that and mark the XDomain as unplugged when we remove the parent router.(CVE-2024-46702)

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]

[WHY & HOW] num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets - 1].

This fixes an OVERRUN issue reported by Coverity.(CVE-2024-46815)

In the Linux kernel, the following vulnerability has been resolved: vfs: fix race between evice_inodes() and find_inode()&iput() Hi, all Recently I noticed a bug[1] in btrfs, after digged it into and I believe it'a race in vfs. Let's assume there's a inode (ie ino 261) with i_count 1 is called by iput(), and there's a concurrent thread calling generic_shutdown_super(). cpu0: cpu1: iput() // i_count is 1 ->spin_lock(inode) ->dec i_count to 0 ->iput_final() generic_shutdown_super() ->__inode_add_lru() ->evict_inodes() // cause some reason[2] ->if (atomic_read(inode->i_count)) continue; // return before // inode 261 passed the above check // list_lru_add_obj() // and then schedule out ->spin_unlock() // note here: the inode 261 // was still at sb list and hash list, // and I_FREEING|I_WILL_FREE was not been set btrfs_iget() // after some function calls ->find_inode() // found the above inode 261 ->spin_lock(inode) // check I_FREEING|I_WILL_FREE // and passed ->__iget() ->spin_unlock(inode) // schedule back ->spin_lock(inode) // check (I_NEW|I_FREEING|I_WILL_FREE) flags, // passed and set I_FREEING iput() ->spin_unlock(inode) ->spin_lock(inode) ->evict() // dec i_count to 0 ->iput_final() ->spin_unlock() ->evict() Now, we have two threads simultaneously evicting the same inode, which may trigger the BUG(inode->i_state & I_CLEAR) statement both within clear_inode() and iput(). To fix the bug, recheck the inode->i_count after holding i_lock. Because in the most scenarios, the first check is valid, and the overhead of spin_lock() can be reduced. If there is any misunderstanding, please let me know, thanks. [1]: https://lore.kernel.org/linux-btrfs/000000000000eabe1d0619c48986@google.com/ [2]: The reason might be 1. SB_ACTIVE was removed or 2. mapping_shrinkable() return false when I reproduced the bug.(CVE-2024-47679)

In the Linux…

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• firmware_loader: Block path traversal {CVE-2024-47742}
• ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950}
• ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
• driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
• ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• smack: tcp: ipv4, fix incorrect labeling {CVE-2024-47659}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• ALSA: asihpi: Fix potential OOB array access {CVE-2024-50007}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• drm/amd/display: Fix index out of bounds in degamma hardware format translation {CVE-2024-49894}
• ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
• ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
• bna: adjust 'name' buf size of bna_tcb and bna_ccb structures {CVE-2024-43839}

• driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
• net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}
• memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• tipc: guard against string buffer overrun {CVE-2024-49995}
• ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
• ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
• ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• padata: Fix possible divide-by-0 panic in padata_mt_helper() {CVE-2024-43889}
• hwmon: (coretemp) Check for null before removing sysfs attrs {CVE-2022-49010}
• drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error {CVE-2024-47697}
• wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
• ipv6: avoid use-after-free in ip6_fragment() {CVE-2022-48956}
• netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
• drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
• slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• firmware_loader: Block path traversal {CVE-2024-47742}
• ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
• tcp: drop the hash_32() part from the index calculation {CVE-2022-1012}
• tcp: increase source port perturb table to 2^16 {CVE-2022-1012}
• tcp: dynamically allocate the perturb table used by source ports {CVE-2022-1012}
• net: dccp: fix kernel crash on module load {CVE-2022-1012}
• net: dccp: initialize (addr,port) listening hashtable {CVE-2022-1012}
• tcp: add small random increments to the source port {CVE-2022-1012}
• tcp: resalt the secret every 10 seconds {CVE-2022-1012}
• tcp: use different parts of the port_offset for index and offset {CVE-2022-1012}
• secure_seq: use the 64 bits of the siphash for port offset calculation {CVE-2022-1012}
• Revert "[ELSCVE-6395] secure_seq: use the 64 bits of the siphash for port offset calculation" {CVE-2022-1012}
• tcp: add some entropy in __inet_hash_connect() {CVE-2022-1012}
• tcp: change source port randomizarion at connect() time {CVE-2022-1012}
• esp: limit skb_page_frag_refill use to a single page {CVE-2022-27666}
• drm/vmwgfx: Fix stale file descriptors on failed usercopy {CVE-2022-22942}
• drm/i915: Fix the GT fence revocation runtime PM logic {CVE-2022-0330}
• PM: runtime: Add pm_runtime_get_if_active() {CVE-2022-0330}
• PM-runtime: add tracepoints for usage_count changes {CVE-2022-0330}
• fget: clarify and improve __fget_files() implementation {CVE-2021-4083}
• proc/fd: In proc_fd_link use fget_task {CVE-2021-4083}
• kcmp: In kcmp_epoll_target use fget_task {CVE-2021-4083}
• file: Rename __fcheck_files to files_lookup_fd_raw {CVE-2021-4083}
• bpf: In bpf_task_fd_query use fget_task {CVE-2021-4083}
• fget: check that the fd still exists after getting a ref to it {CVE-2021-4083}
• Revert "[ELSCVE-2732] fget: check that the fd still exists after getting a ref to it" {CVE-2021-4083}
• file: Replace fcheck_files with files_lookup_fd_rcu {CVE-2021-4083}
• file: Factor files_lookup_fd_locked out of fcheck_files {CVE-2021-4083}
• vfs, fdtable: Add fget_task helper {CVE-2021-4083}

• driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
• net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}
• memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• tipc: guard against string buffer overrun {CVE-2024-49995}
• ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
• ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
• ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• padata: Fix possible divide-by-0 panic in padata_mt_helper() {CVE-2024-43889}
• hwmon: (coretemp) Check for null before removing sysfs attrs {CVE-2022-49010}
• drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error {CVE-2024-47697}
• wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
• ipv6: avoid use-after-free in ip6_fragment() {CVE-2022-48956}
• netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
• drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
• slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• firmware_loader: Block path traversal {CVE-2024-47742}
• ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
• tcp: drop the hash_32() part from the index calculation {CVE-2022-1012}
• tcp: increase source port perturb table to 2^16 {CVE-2022-1012}
• tcp: dynamically allocate the perturb table used by source ports {CVE-2022-1012}
• net: dccp: fix kernel crash on module load {CVE-2022-1012}
• net: dccp: initialize (addr,port) listening hashtable {CVE-2022-1012}
• tcp: add small random increments to the source port {CVE-2022-1012}
• tcp: resalt the secret every 10 seconds {CVE-2022-1012}
• tcp: use different parts of the port_offset for index and offset {CVE-2022-1012}
• secure_seq: use the 64 bits of the siphash for port offset calculation {CVE-2022-1012}
• Revert "[ELSCVE-6395] secure_seq: use the 64 bits of the siphash for port offset calculation" {CVE-2022-1012}
• tcp: add some entropy in __inet_hash_connect() {CVE-2022-1012}
• tcp: change source port randomizarion at connect() time {CVE-2022-1012}
• esp: limit skb_page_frag_refill use to a single page {CVE-2022-27666}
• drm/vmwgfx: Fix stale file descriptors on failed usercopy {CVE-2022-22942}
• PM-runtime: add tracepoints for usage_count changes {CVE-2022-0330}
• fget: clarify and improve __fget_files() implementation {CVE-2021-4083}
• proc/fd: In proc_fd_link use fget_task {CVE-2021-4083}
• kcmp: In kcmp_epoll_target use fget_task {CVE-2021-4083}
• file: Rename __fcheck_files to files_lookup_fd_raw {CVE-2021-4083}
• fget: check that the fd still exists after getting a ref to it {CVE-2021-4083}
• Revert "[ELSCVE-2732] fget: check that the fd still exists after getting a ref to it" {CVE-2021-4083}
• file: Replace fcheck_files with files_lookup_fd_rcu {CVE-2021-4083}
• file: Factor files_lookup_fd_locked out of fcheck_files {CVE-2021-4083}

• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
• ext4: fix slab-use-after-free in ext4_split_extent_at() {CVE-2024-49884}
• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
• drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX {CVE-2024-46871}
• Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950}
• Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit {CVE-2024-49950}
• driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
• padata: Fix possible divide-by-0 panic in padata_mt_helper() {CVE-2024-43889}
• wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
• net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• tipc: guard against string buffer overrun {CVE-2024-49995}
• ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
• ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
• ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
• drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error {CVE-2024-47697}
• slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
• net: delete "register" keyword {CVE-2024-50033}
• drm/amd/display: fix double free issue during amdgpu module unload {CVE-2024-49989}
• drm/amd/display: Fix index out of bounds in degamma hardware format translation {CVE-2024-49894}
• drm/amd/display: Fix index out of bounds in DCN30 color transformation {CVE-2024-49969}
• drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
• drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation {CVE-2024-49895}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
• net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change {CVE-2021-47624}

• CVE-url: https://ubuntu.com/security/CVE-2024-44946
  • kcm: Serialise kcm_sendmsg() for the same socket.
• CVE-url: https://ubuntu.com/security/CVE-2024-42292
  • kobject_uevent: Fix OOB access within zap_modalias_env()
• CVE-url: https://ubuntu.com/security/CVE-2024-41042
  • netfilter: nf_tables: prefer nft_chain_validate
• CVE-url: https://ubuntu.com/security/CVE-2024-42265
  • protect the fetch of ->fd[fd] in do_dup2() from mispredictions
• CVE-url: https://ubuntu.com/security/CVE-2024-50036
  • net: do not delay dst_entries_add() in dst_release()
• CVE-url: https://ubuntu.com/security/CVE-2024-47663
  • staging: iio: frequency: ad9833: Load clock using clock framework
  • staging: iio: frequency: ad9834: Validate frequency parameter value
• CVE-url: https://ubuntu.com/security/CVE-2024-47669
  • nilfs2: fix state management in error path of log writing function
• CVE-url: https://ubuntu.com/security/CVE-2023-52918
  • media: pci: cx23885: check cx23885_vdev_init() return
• CVE-url: https://ubuntu.com/security/CVE-2024-44960
  • usb: gadget: core: Check for unset descriptor
• CVE-url: https://ubuntu.com/security/CVE-2024-42297
  • f2fs: fix to don't dirty inode for readonly filesystem
• CVE-url: https://ubuntu.com/security/CVE-2024-46750
  • PCI: Add missing bridge lock to pci_bus_lock()
• CVE-url: https://ubuntu.com/security/CVE-2024-46676
  • nfc: pn533: Add poll mod list filling check
• CVE-url: https://ubuntu.com/security/CVE-2024-46761
  • pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
• CVE-url: https://ubuntu.com/security/CVE-2024-46755
  • wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
• CVE-url: https://ubuntu.com/security/CVE-2024-46679
  • ethtool: check device is present when getting link settings
• CVE-url: https://ubuntu.com/security/CVE-2024-46721
  • apparmor: fix possible NULL pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-46685
  • pinctrl: single: fix potential NULL dereference in pcs_get_function()
• CVE-url: https://ubuntu.com/security/CVE-2024-44947
  • fuse: Initialize beyond-EOF page contents before setting uptodate
• CVE-url: https://ubuntu.com/security/CVE-2024-46675
  • usb: dwc3: core: Prevent USB core invalid event buffer address access
• CVE-url: https://ubuntu.com/security/CVE-2024-43893
  • serial: core: check uartclk for zero to avoid divide by zero
• CVE-url: https://ubuntu.com/security/CVE-2024-45021
  • memcg_write_event_control(): fix a user-triggerable oops
• CVE-url: https://ubuntu.com/security/CVE-2024-46677
  • gtp: fix a potential NULL pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-43861
  • net: usb: qmi_wwan: fix memory leak for not ip packets
• CVE-url: https://ubuntu.com/security/CVE-2024-41063
  • Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
• CVE-url: https://ubuntu.com/security/CVE-2024-45006
  • xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
• CVE-url: https://ubuntu.com/security/CVE-2024-43853
  • cgroup/cpuset: Prevent UAF in proc_cpuset_show()
• CVE-url: https://ubuntu.com/security/CVE-2024-42310
  • drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
• CVE-url: https://ubuntu.com/security/CVE-2024-42311
  • hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
• CVE-url: https://ubuntu.com/security/CVE-2024-41012
  • filelock: Remove locks reliably when fcntl/close race is detected
• CVE-url: https://ubuntu.com/security/CVE-2024-45028
  • mmc: mmc_test: Fix NULL dereference on allocation failure
• CVE-url: https://ubuntu.com/security/CVE-2024-43860
  • remoteproc: imx_rproc: Skip over memory region when node value is NULL
• CVE-url: https://ubuntu.com/security/CVE-2024-43914
  • md/raid5: avoid BUG_ON() while continue…

• CVE-url: https://ubuntu.com/security/CVE-2024-44946
  • kcm: Serialise kcm_sendmsg() for the same socket.
• CVE-url: https://ubuntu.com/security/CVE-2024-42292
  • kobject_uevent: Fix OOB access within zap_modalias_env()
• CVE-url: https://ubuntu.com/security/CVE-2024-41042
  • netfilter: nf_tables: prefer nft_chain_validate
• CVE-url: https://ubuntu.com/security/CVE-2024-42265
  • protect the fetch of ->fd[fd] in do_dup2() from mispredictions
• CVE-url: https://ubuntu.com/security/CVE-2024-50036
  • net: do not delay dst_entries_add() in dst_release()
• CVE-url: https://ubuntu.com/security/CVE-2024-47663
  • staging: iio: frequency: ad9833: Load clock using clock framework
  • staging: iio: frequency: ad9834: Validate frequency parameter value
• CVE-url: https://ubuntu.com/security/CVE-2024-47669
  • nilfs2: fix state management in error path of log writing function
• CVE-url: https://ubuntu.com/security/CVE-2023-52918
  • media: pci: cx23885: check cx23885_vdev_init() return
• CVE-url: https://ubuntu.com/security/CVE-2024-44960
  • usb: gadget: core: Check for unset descriptor
• CVE-url: https://ubuntu.com/security/CVE-2024-42297
  • f2fs: fix to don't dirty inode for readonly filesystem
• CVE-url: https://ubuntu.com/security/CVE-2024-46750
  • PCI: Add missing bridge lock to pci_bus_lock()
• CVE-url: https://ubuntu.com/security/CVE-2024-46676
  • nfc: pn533: Add poll mod list filling check
• CVE-url: https://ubuntu.com/security/CVE-2024-46761
  • pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
• CVE-url: https://ubuntu.com/security/CVE-2024-46755
  • wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
• CVE-url: https://ubuntu.com/security/CVE-2024-46679
  • ethtool: check device is present when getting link settings
• CVE-url: https://ubuntu.com/security/CVE-2024-46721
  • apparmor: fix possible NULL pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-46685
  • pinctrl: single: fix potential NULL dereference in pcs_get_function()
• CVE-url: https://ubuntu.com/security/CVE-2024-44947
  • fuse: Initialize beyond-EOF page contents before setting uptodate
• CVE-url: https://ubuntu.com/security/CVE-2024-46675
  • usb: dwc3: core: Prevent USB core invalid event buffer address access
• CVE-url: https://ubuntu.com/security/CVE-2024-43893
  • serial: core: check uartclk for zero to avoid divide by zero
• CVE-url: https://ubuntu.com/security/CVE-2024-45021
  • memcg_write_event_control(): fix a user-triggerable oops
• CVE-url: https://ubuntu.com/security/CVE-2024-46677
  • gtp: fix a potential NULL pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-43861
  • net: usb: qmi_wwan: fix memory leak for not ip packets
• CVE-url: https://ubuntu.com/security/CVE-2024-41063
  • Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
• CVE-url: https://ubuntu.com/security/CVE-2024-45006
  • xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
• CVE-url: https://ubuntu.com/security/CVE-2024-43853
  • cgroup/cpuset: Prevent UAF in proc_cpuset_show()
• CVE-url: https://ubuntu.com/security/CVE-2024-42310
  • drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
• CVE-url: https://ubuntu.com/security/CVE-2024-42311
  • hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
• CVE-url: https://ubuntu.com/security/CVE-2024-41012
  • filelock: Remove locks reliably when fcntl/close race is detected
• CVE-url: https://ubuntu.com/security/CVE-2024-45028
  • mmc: mmc_test: Fix NULL dereference on allocation failure
• CVE-url: https://ubuntu.com/security/CVE-2024-43860
  • remoteproc: imx_rproc: Skip over memory region when node value is NULL
• CVE-url: https://ubuntu.com/security/CVE-2024-43914
  • md/raid5: avoid BUG_ON() while continue…

• CVE-url: https://ubuntu.com/security/CVE-2024-42265
  • protect the fetch of ->fd[fd] in do_dup2() from mispredictions
• CVE-url: https://ubuntu.com/security/CVE-2024-47669
  • nilfs2: fix state management in error path of log writing function
• CVE-url: https://ubuntu.com/security/CVE-2023-52918
  • media: pci: cx23885: check cx23885_vdev_init() return
• CVE-url: https://ubuntu.com/security/CVE-2024-46750
  • PCI: Add missing bridge lock to pci_bus_lock()
• CVE-url: https://ubuntu.com/security/CVE-2024-46676
  • nfc: pn533: Add poll mod list filling check
• CVE-url: https://ubuntu.com/security/CVE-2024-46755
  • wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
• CVE-url: https://ubuntu.com/security/CVE-2024-46721
  • apparmor: fix possible NULL pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-44947
  • fuse: Initialize beyond-EOF page contents before setting uptodate
• CVE-url: https://ubuntu.com/security/CVE-2024-46675
  • usb: dwc3: core: Prevent USB core invalid event buffer address access
• CVE-url: https://ubuntu.com/security/CVE-2024-43893
  • serial: core: check uartclk for zero to avoid divide by zero
• CVE-url: https://ubuntu.com/security/CVE-2024-45021
  • memcg_write_event_control(): fix a user-triggerable oops
• CVE-url: https://ubuntu.com/security/CVE-2024-41012
  • filelock: Remove locks reliably when fcntl/close race is detected
• CVE-url: https://ubuntu.com/security/CVE-2024-42310
  • drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
• CVE-url: https://ubuntu.com/security/CVE-2024-42311
  • hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
• CVE-url: https://ubuntu.com/security/CVE-2024-45028
  • mmc: mmc_test: Fix NULL dereference on allocation failure
• CVE-url: https://ubuntu.com/security/CVE-2024-43914
  • md/raid5: avoid BUG_ON() while continue reshape after reassembling
• CVE-url: https://ubuntu.com/security/CVE-2024-43856
  • dma: fix call order in dmam_free_coherent
• CVE-url: https://ubuntu.com/security/CVE-2024-43884
  • Bluetooth: MGMT: Add error handling to pair_device()
• CVE-url: https://ubuntu.com/security/CVE-2024-42309
  • drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
• CVE-url: https://ubuntu.com/security/CVE-2024-50044
  • Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
• CVE-url: https://ubuntu.com/security/CVE-2024-49967
  • ext4: no need to continue when the number of entries is 1
• Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596) // CVE- url: https://ubuntu.com/security/CVE-2022-49015
  • net: hsr: Fix potential use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2024-50033
  • slip: make slhc_remember() more robust against malicious packets
• CVE-url: https://ubuntu.com/security/CVE-2024-47670
  • ocfs2: add bounds checking to ocfs2_xattr_find_entry()
• CVE-url: https://ubuntu.com/security/CVE-2024-49950
  • Bluetooth: L2CAP: Fix uaf in l2cap_connect
• CVE-url: https://ubuntu.com/security/CVE-2024-49883
  • ext4: aovid use-after-free in ext4_ext_insert_extent()
• Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596) // CVE- url: https://ubuntu.com/security/CVE-2022-48960
  • net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
• CVE-url: https://ubuntu.com/security/CVE-2024-47745
  • mm: call the security_mmap_file() LSM hook in remap_file_pages()
• CVE-url: https://ubuntu.com/security/CVE-2024-49860
  • ACPI: sysfs: validate return type of _STR method
• CVE-url: https://ubuntu.com/security/CVE-2024-49882
  • ext4: fix double brelse() the buffer of the extents path
• CVE-url: https://ubuntu.com/security/CVE-2024-49995
  • tipc: guard against string buffer overrun
• CVE-url: https://ubuntu.com/security/CVE-2024-47723 -…

• CVE-url: https://ubuntu.com/security/CVE-2024-42265
  • protect the fetch of ->fd[fd] in do_dup2() from mispredictions
• CVE-url: https://ubuntu.com/security/CVE-2024-47669
  • nilfs2: fix state management in error path of log writing function
• CVE-url: https://ubuntu.com/security/CVE-2023-52918
  • media: pci: cx23885: check cx23885_vdev_init() return
• CVE-url: https://ubuntu.com/security/CVE-2024-46750
  • PCI: Add missing bridge lock to pci_bus_lock()
• CVE-url: https://ubuntu.com/security/CVE-2024-46676
  • nfc: pn533: Add poll mod list filling check
• CVE-url: https://ubuntu.com/security/CVE-2024-46755
  • wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
• CVE-url: https://ubuntu.com/security/CVE-2024-46721
  • apparmor: fix possible NULL pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-44947
  • fuse: Initialize beyond-EOF page contents before setting uptodate
• CVE-url: https://ubuntu.com/security/CVE-2024-46675
  • usb: dwc3: core: Prevent USB core invalid event buffer address access
• CVE-url: https://ubuntu.com/security/CVE-2024-43893
  • serial: core: check uartclk for zero to avoid divide by zero
• CVE-url: https://ubuntu.com/security/CVE-2024-45021
  • memcg_write_event_control(): fix a user-triggerable oops
• CVE-url: https://ubuntu.com/security/CVE-2024-41012
  • filelock: Remove locks reliably when fcntl/close race is detected
• CVE-url: https://ubuntu.com/security/CVE-2024-42310
  • drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
• CVE-url: https://ubuntu.com/security/CVE-2024-42311
  • hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
• CVE-url: https://ubuntu.com/security/CVE-2024-45028
  • mmc: mmc_test: Fix NULL dereference on allocation failure
• CVE-url: https://ubuntu.com/security/CVE-2024-43914
  • md/raid5: avoid BUG_ON() while continue reshape after reassembling
• CVE-url: https://ubuntu.com/security/CVE-2024-43856
  • dma: fix call order in dmam_free_coherent
• CVE-url: https://ubuntu.com/security/CVE-2024-43884
  • Bluetooth: MGMT: Add error handling to pair_device()
• CVE-url: https://ubuntu.com/security/CVE-2024-42309
  • drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
• CVE-url: https://ubuntu.com/security/CVE-2024-50044
  • Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
• CVE-url: https://ubuntu.com/security/CVE-2024-49967
  • ext4: no need to continue when the number of entries is 1
• Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596) // CVE- url: https://ubuntu.com/security/CVE-2022-49015
  • net: hsr: Fix potential use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2024-50033
  • slip: make slhc_remember() more robust against malicious packets
• CVE-url: https://ubuntu.com/security/CVE-2024-47670
  • ocfs2: add bounds checking to ocfs2_xattr_find_entry()
• CVE-url: https://ubuntu.com/security/CVE-2024-49950
  • Bluetooth: L2CAP: Fix uaf in l2cap_connect
• CVE-url: https://ubuntu.com/security/CVE-2024-49883
  • ext4: aovid use-after-free in ext4_ext_insert_extent()
• Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596) // CVE- url: https://ubuntu.com/security/CVE-2022-48960
  • net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
• CVE-url: https://ubuntu.com/security/CVE-2024-47745
  • mm: call the security_mmap_file() LSM hook in remap_file_pages()
• CVE-url: https://ubuntu.com/security/CVE-2024-49860
  • ACPI: sysfs: validate return type of _STR method
• CVE-url: https://ubuntu.com/security/CVE-2024-49882
  • ext4: fix double brelse() the buffer of the extents path
• CVE-url: https://ubuntu.com/security/CVE-2024-49995
  • tipc: guard against string buffer overrun
• CVE-url: https://ubuntu.com/security/CVE-2024-47723 -…

• smb: client: fix use-after-free in smb2_query_info_compound() {CVE-2023-52751}
• smb: client: prevent new fids from being removed by laundromat {CVE-2023-52751}
• cifs: fix dentry lookups in directory handle cache {CVE-2023-52751}
• uprobe: avoid out-of-bounds memory access of fetching args {CVE-2024-50067}
• net: do not delay dst_entries_add() in dst_release() {CVE-2024-50036}
• smb: client: fix UAF in async decryption {CVE-2024-50047}
• smb3: rename encryption/decryption TFMs
• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• drm/amd/display: fix double free issue during amdgpu module unload {CVE-2024-49989}
• ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950}
• Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit {CVE-2024-49950}
• mptcp: pm: Fix uaf in __timer_delete_sync {CVE-2024-46858}
• of: fdt: fix off-by-one error in unflatten_dt_nodes() {CVE-2022-48672}
• filelock: fix potential use-after-free in posix_lock_inode {CVE-2024-41049}
• locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock {CVE-2024-41049}
• drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation {CVE-2024-49895}
• slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
• drm/amd/display: Fix index out of bounds in DCN30 color transformation {CVE-2024-49969}
• drm/amd/display: Fix index out of bounds in degamma hardware format translation {CVE-2024-49894}
• ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
• ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
• ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
• tipc: guard against string buffer overrun {CVE-2024-49995}
• drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
• firmware_loader: Block path traversal {CVE-2024-47742}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
• ext4: fix slab-use-after-free in ext4_split_extent_at() {CVE-2024-49884}
• drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX {CVE-2024-46871}
• ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
• wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
• net: do not leave a dangling sk pointer, when socket creation fails {CVE-2024-40954}
• net: sched: sch_multiq: fix possible OOB write in multiq_tune() {CVE-2024-36978}
• drm/amdgpu: Validate TA binary size {CVE-2024-44977}

• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• net/packet: fix slab-out-of-bounds access in packet_recvmsg() {CVE-2022-20368}
• packet: in recvmsg msg_name return at least sizeof sockaddr_ll {CVE-2022-20368}
• ath9k: fix use-after-free in ath9k_hif_usb_rx_cb {CVE-2022-1679}
• Squashfs: sanity check symbolic link size {CVE-2024-46744}

• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• net/packet: fix slab-out-of-bounds access in packet_recvmsg() {CVE-2022-20368}
• packet: in recvmsg msg_name return at least sizeof sockaddr_ll {CVE-2022-20368}
• ath9k: fix use-after-free in ath9k_hif_usb_rx_cb {CVE-2022-1679}
• Squashfs: sanity check symbolic link size {CVE-2024-46744}

Vanilla upstream kernel version 6.6.58 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

Upstream kernel version 6.6.58 fixes bugs and vulnerabilities. The kmod-virtualbox and kmod-xtables-addons packages have been updated to work with this new kernel. For information about the vulnerabilities see the links.

These are all security issues fixed in the kernel-devel-6.11.8-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.12.11-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48957: dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() (bsc#1231973).
• CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
• CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
• CVE-2022-48980: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() (bsc#1232233).
• CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070 git-fix prerequisity).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2022-49017: tipc: re-fetch skb cb after tipc_msg_validate (bsc#1232004).
• CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
• CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB (bsc#1228709).
• CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005 stable-fixes).
• CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837 stable-fixes).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46716: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor (bsc#1230715).
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46809: drm/amd/display: Check BIOS images before it is used (bsc#1231148).
• CVE-2024-46811: drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box (bsc#1231179).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
• CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231195).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (bsc#1231200).
• CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
• CVE-2024-46828: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1231114).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs: do not BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() (bsc#1231094).
• CVE-2024-46848: perf/x86/intel: Limit the period on Haswell (bsc#1231072).
• CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
• CVE-2024-47660: fsnotify: clear…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46828: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1231114).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs: do not BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() (bsc#1231094).
• CVE-2024-46843: scsi: ufs: core: Remove SCSI host only if added (bsc#1231100).
• CVE-2024-46854: net: dpaa: Pad packets to ETH_ZLEN (bsc#1231084).
• CVE-2024-46855: netfilter: nft_socket: fix sk refcount leaks (bsc#1231085).
• CVE-2024-46857: net/mlx5: Fix bridge mode operations when there are no VFs (bsc#1231087).
• CVE-2024-46870: drm/amd/display: Disable DMCUB timeout for DCN35 (bsc#1231435).
• CVE-2024-47658: crypto: stm32/cryp - call finalize with bh disabled (bsc#1231436).
• CVE-2024-47660: fsnotify: clear PARENT_WATCHED flags lazily (bsc#1231439).
• CVE-2024-47664: spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware (bsc#1231442).
• CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
• CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
• CVE-2024-47685: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (bsc#1231998).
• CVE-2024-47687: vdpa/mlx5: Fix invalid mr resource destroy (bsc#1232003).
• CVE-2024-47692: nfsd: return -EINVAL when namelen is 0 (bsc#1231857).
• CVE-2024-47704: drm/amd/display: Check link_res->hpo_dp_link_enc before using it (bsc#1231944).
• CVE-2024-47705: block: fix potential invalid pointer dereference in blk_add_partition (bsc#1231872).
• CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
• CVE-2024-47707: ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() (bsc#1231935).
• CVE-2024-47710: sock_map: Add a cond_resched() in sock_hash_free() (bsc#1232049).
• CVE-2024-47727: x86/tdx: Fix 'in-kernel MMIO' check (bsc#1232116).
• CVE-2024-47730: crypto: hisilicon/qm - inject error before stopping queue (bsc#1232075).
• CVE-2024-47731: drivers/perf: Fix ali_drw_pmu driver interrupt status clearing (bsc#1232117).
• CVE-2024-47739: padata: use integer wrap around to prevent deadlock on seq_nr overflow (bsc#1232124).
• CVE-2024-47741:…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48957: dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() (bsc#1231973).
• CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
• CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
• CVE-2022-48980: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() (bsc#1232233).
• CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2022-49017: tipc: re-fetch skb cb after tipc_msg_validate (bsc#1232004).
• CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
• CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB (bsc#1228709).
• CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005).
• CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46716: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor (bsc#1230715).
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46809: drm/amd/display: Check BIOS images before it is used (bsc#1231148).
• CVE-2024-46811: drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box (bsc#1231179).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
• CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231195).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (bsc#1231200).
• CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46828: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1231114).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs: do not…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46828: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1231114).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs: do not BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() (bsc#1231094).
• CVE-2024-46843: scsi: ufs: core: Remove SCSI host only if added (bsc#1231100).
• CVE-2024-46854: net: dpaa: Pad packets to ETH_ZLEN (bsc#1231084).
• CVE-2024-46855: netfilter: nft_socket: fix sk refcount leaks (bsc#1231085).
• CVE-2024-46857: net/mlx5: Fix bridge mode operations when there are no VFs (bsc#1231087).
• CVE-2024-46870: drm/amd/display: Disable DMCUB timeout for DCN35 (bsc#1231435).
• CVE-2024-47658: crypto: stm32/cryp - call finalize with bh disabled (bsc#1231436).
• CVE-2024-47660: fsnotify: clear PARENT_WATCHED flags lazily (bsc#1231439).
• CVE-2024-47664: spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware (bsc#1231442).
• CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
• CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
• CVE-2024-47685: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (bsc#1231998).
• CVE-2024-47687: vdpa/mlx5: Fix invalid mr resource destroy (bsc#1232003).
• CVE-2024-47692: nfsd: return -EINVAL when namelen is 0 (bsc#1231857).
• CVE-2024-47704: drm/amd/display: Check link_res->hpo_dp_link_enc before using it (bsc#1231944).
• CVE-2024-47705: block: fix potential invalid pointer dereference in blk_add_partition (bsc#1231872).
• CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
• CVE-2024-47707: ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() (bsc#1231935).
• CVE-2024-47710: sock_map: Add a cond_resched() in sock_hash_free() (bsc#1232049).
• CVE-2024-47727: x86/tdx: Fix 'in-kernel MMIO' check (bsc#1232116).
• CVE-2024-47730: crypto: hisilicon/qm - inject error before stopping queue (bsc#1232075).
• CVE-2024-47731: drivers/perf: Fix ali_drw_pmu driver interrupt status clearing (bsc#1232117).
• CVE-2024-47739: padata: use integer wrap around to prevent deadlock on seq_nr overflow (bsc#1232124).
• CVE-2024-47741:…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The Linux Enterprise 12 SP5 kernel turned LTSS (Extended Security)

The following security bugs were fixed:

• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47163: kABI fix for tipc: wait and exit until all work queues are done (bsc#1221980).
• CVE-2021-47612: nfc: fix segfault in nfc_genl_dump_devices_done (bsc#1226585).
• CVE-2022-48809: net: fix a memleak when uncloning an skb dst and its metadata (bsc#1227947).
• CVE-2022-48951: ASoC: ops: Correct bounds check for second channel on SX controls (bsc#1231929).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
• CVE-2022-48967: NFC: nci: Bounds check struct nfc_target arrays (bsc#1232304).
• CVE-2022-48971: Bluetooth: Fix not cleanup led when bt_init fails (bsc#1232037).
• CVE-2022-48972: mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (bsc#1232025).
• CVE-2022-48973: gpio: amd8111: Fix PCI device reference count leak (bsc#1232039).
• CVE-2022-48978: HID: core: fix shift-out-of-bounds in hid_report_raw_event (bsc#1232038).
• CVE-2022-48991: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths (bsc#1232070).
• CVE-2022-48992: ASoC: soc-pcm: Add NULL check in BE reparenting (bsc#1232071).
• CVE-2022-49000: iommu/vt-d: Fix PCI device refcount leak in has_external_pci() (bsc#1232123).
• CVE-2022-49002: iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (bsc#1232133).
• CVE-2022-49010: hwmon: (coretemp) Check for null before removing sysfs attrs (bsc#1232172).
• CVE-2022-49011: hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (bsc#1232006).
• CVE-2022-49014: net: tun: Fix use-after-free in tun_detach() (bsc#1231890).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
• CVE-2022-49021: net: phy: fix null-ptr-deref while probe() failed (bsc#1231939).
• CVE-2022-49026: e100: Fix possible use after free in e100_xmit_prepare (bsc#1231997).
• CVE-2022-49027: iavf: Fix error handling in iavf_init_module() (bsc#1232007).
• CVE-2022-49028: ixgbevf: Fix resource leak in ixgbevf_init_module() (bsc#1231996).
• CVE-2022-49029: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (bsc#1231995).
• CVE-2023-52898: xhci: Fix null pointer dereference when host dies (bsc#1229568).
• CVE-2023-52918: media: pci: cx23885: check cx23885_vdev_init() return (bsc#1232047).
• CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).
• CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).
• CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42114: netlink: extend policy range validation (bsc#1228564 prerequisite).
• CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005 stable-fixes).
• CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837 stable-fixes).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-46724: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number (bsc#1230725).
• CVE-2024-46755: wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() (bsc#1230802). -…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-53095: smb: client: Fix use-after-free of network namespace (bsc#1233642).
• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2023-6270: aoe: fix the potential use-after-free problem in more places (bsc#1218562).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46828: sched: sch_cake: fix bulk flow accounting logic for host fairness (bsc#1231114).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free…