CVE-2024-50043

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible badness in FREE_STATEID When multiple FREE_STATEIDs are sent for the same delegation stateid, it can lead to a possible either use-after-free or counter refcount underflow errors. In nfsd4_free_stateid() under the client lock we find a delegation stateid, however the code drops the lock before calling nfs4_put_stid(), that allows another FREE_STATE to find the stateid again. The first one will proceed to then free the stateid which leads to either use-after-free or decrementing already zeroed counter.

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible badness in FREE_STATEID When multiple FREE_STATEIDs are sent for the same delegation stateid, it can lead to a possible either use-after-free or counter refcount underflow errors. In nfsd4_free_stateid() under the client lock we find a delegation stateid, however the code drops the lock before calling nfs4_put_stid(), that allows another FREE_STATE to find the stateid again. The first one will proceed to then free the stateid which leads to either use-after-free or decrementing already zeroed counter.

• udmabuf: fix a buf size overflow issue during udmabuf creation {CVE-2025-37803}
• bpf: Prevent tail call between progs attached to different hooks {CVE-2024-50063}
• nfsd: fix possible badness in FREE_STATEID {CVE-2024-50043}
• nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open {CVE-2024-46682}
• nfsd: fix race between laundromat and free_stateid {CVE-2024-50106}
• nfsd: split sc_status out of sc_type {CVE-2024-46682}
• net: gso: fix ownership in __udp_gso_segment {CVE-2025-21926}
• net: fix geneve_opt length integer overflow {CVE-2025-22055}
• net: usb: lan78xx: Fix double free issue with interrupt buffer allocation {CVE-2024-53213}
• mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths {CVE-2022-48991}
• xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982}

• Bluetooth: Fix use after free in hci_send_acl {CVE-2022-49111}
• drm/amd/display: clear optc underflow before turn off odm clock {CVE-2022-49969}
• NFSv4/pnfs: Fix a use-after-free bug in open {CVE-2022-50072}
• NFSv4: Don't hold the layoutget locks across multiple RPC calls {CVE-2022-50072}
• tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() {CVE-2022-49940}
• net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764}
• udmabuf: fix a buf size overflow issue during udmabuf creation {CVE-2025-37803}
• mptcp: fix race on unaccepted mptcp sockets {CVE-2022-49669}
• net: introduce and use lock_sock_fast_nested() {CVE-2022-49669}
• net: add annotation for sock_{lock,unlock}_fast {CVE-2022-49669}
• net/mlx5: Always stop health timer during driver removal {CVE-2024-40906}
• nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open {CVE-2024-46682}
• nfsd: fix possible badness in FREE_STATEID {CVE-2024-50043}
• nfsd: fix race between laundromat and free_stateid {CVE-2024-50106}
• nfsd: split sc_status out of sc_type {CVE-2024-50106}
• nfsd: avoid race after unhash_delegation_locked() {CVE-2024-50106}
• nfsd: remove fault injection code {CVE-2024-50106}
• nfsd: don't call functions with side-effecting inside WARN_ON() {CVE-2024-50106}
• ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855 {CVE-2022-49238}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• cifs: fix potential double free during failed mount {CVE-2022-49541}
• xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982}
• drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() {CVE-2024-50282}

• Bluetooth: Fix use after free in hci_send_acl {CVE-2022-49111}
• NFSv4/pnfs: Fix a use-after-free bug in open {CVE-2022-50072}
• NFSv4: Don't hold the layoutget locks across multiple RPC calls {CVE-2022-50072}
• net: qrtr: start MHI channel after endpoit creation {CVE-2022-50044}
• tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() {CVE-2022-49940}
• net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764}
• udmabuf: fix a buf size overflow issue during udmabuf creation {CVE-2025-37803}
• mptcp: fix race on unaccepted mptcp sockets {CVE-2022-49669}
• net: introduce and use lock_sock_fast_nested() {CVE-2022-49669}
• net: add annotation for sock_{lock,unlock}_fast {CVE-2022-49669}
• net/mlx5: Always stop health timer during driver removal {CVE-2024-40906}
• nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open {CVE-2024-46682}
• nfsd: fix possible badness in FREE_STATEID {CVE-2024-50043}
• nfsd: fix race between laundromat and free_stateid {CVE-2024-50106}
• nfsd: split sc_status out of sc_type {CVE-2024-50106}
• nfsd: avoid race after unhash_delegation_locked() {CVE-2024-50106}
• nfsd: remove fault injection code {CVE-2024-50106}
• nfsd: don't call functions with side-effecting inside WARN_ON() {CVE-2024-50106}
• ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855 {CVE-2022-49238}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982}
• drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() {CVE-2024-50282}

These are all security issues fixed in the kernel-devel-6.11.8-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.12.11-1.1 package on the GA media of openSUSE Tumbleweed.

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• SuperH RISC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• RAM backed block device driver;
• Network block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• Buffer Sharing and Synchronization framework;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• EFI core;
• Qualcomm firmware drivers;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• I3C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NTB driver;
• Virtio pmem driver;
• NVME drivers;
• Parport drivers;
• PCI subsystem;
• Alibaba DDR Sub-System Driveway PMU driver;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• i.MX PM domains;
• Powercap sysfs driver;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• StarFive reset controller drivers;
• Real Time Clock drivers;
• SCSI subsystem;
• SuperH / SH-Mobile drivers;
• QCOM SoC drivers;
• Xilinx SoC drivers;
• SPI subsystem;
• Direct Digital Synthesis drivers;
• Media staging drivers;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• USB Device Class drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Port Controller Manager driver;
• TI TPS6598x USB Power Delivery controller driver;
• USB Type-C Connector System Software Interface driver;
• vDPA drivers;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Virtio drivers;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• File systems infrastructure;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file systems library;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• Proc file system;
• SMB network file system;
• UBI file system;
• BPF subsystem;
• Network file system (NFS) superblock;
• Virtio network driver;
• Bluetooth subsystem;
• Network traffic control;
• Network sockets;
• TCP network protocol;
• Tracing infrastructure;
• User-space API (UAPI);
• Kernel init infrastructure; -…