CVE-2024-50073

In the Linux kernel, the following vulnerability has been resolved:

tty: n_gsm: Fix use-after-free in gsm_cleanup_mux

BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by task poc/3379 CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: <TASK> gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm] __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389 update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500 __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846 __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161 gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107 __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm] ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195 ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79 __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338 __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805 tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818

Allocated by task 65: gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm] gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm] gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm] gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm] tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391 tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39 flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445 process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229 worker_thread+0x3dc/0x950 kernel/workqueue.c:3391 kthread+0x2a3/0x370 kernel/kthread.c:389 ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257

Freed by task 3367: kfree+0x126/0x420 mm/slub.c:4580 gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818

[Analysis] gsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux can be freed by multi threads through ioctl,which leads to the occurrence of uaf. Protect it by gsm tx lock.

In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by task poc/3379 CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: <TASK> gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm] __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389 update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500 __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846 __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161 gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107 __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm] ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195 ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79 __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338 __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805 tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818 Allocated by task 65: gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm] gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm] gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm] gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm] tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391 tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39 flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445 process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229 worker_thread+0x3dc/0x950 kernel/workqueue.c:3391 kthread+0x2a3/0x370 kernel/kthread.c:389 ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257 Freed by task 3367: kfree+0x126/0x420 mm/slub.c:4580 gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818 [Analysis] gsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux can be freed by multi threads through ioctl,which leads to the occurrence of uaf. Protect it by gsm tx lock.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Prevent buffer overflow in setup handler Setup function uvc_function_setup permits control transfer requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE), data stage handler for OUT transfer uses memcpy to copy req->actual bytes to uvc_event->data.data array of size 60. This may result in an overflow of 4 bytes.(CVE-2022-48948)

In the Linux kernel, the following vulnerability has been resolved: igb: Initialize mailbox message for VF reset When a MAC address is not assigned to the VF, that portion of the message sent to the VF is not set. The memory, however, is allocated from the stack meaning that information may be leaked to the VM. Initialize the message buffer to 0 so that no information is passed to the VM in this case.(CVE-2022-48949)

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() The skb is delivered to napi_gro_receive() which may free it, after calling this, dereferencing skb may trigger use-after-free.(CVE-2022-48960)

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() The skb is delivered to napi_gro_receive() which may free it, after calling this, dereferencing skb may trigger use-after-free.(CVE-2022-48962)

In the Linux kernel, the following vulnerability has been resolved: net: mvneta: Prevent out of bounds read in mvneta_config_rss() The pp->indir[0] value comes from the user. It is passed to: if (cpu_online(pp->rxq_def)) inside the mvneta_percpu_elect() function. It needs bounds checkeding to ensure that it is not beyond the end of the cpu bitmap.(CVE-2022-48966)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix not cleanup led when bt_init fails bt_init() calls bt_leds_init() to register led, but if it fails later, bt_leds_cleanup() is not called to unregister it. This can cause panic if the argument "bluetooth-power" in text is freed and then another led_trigger_register() tries to access it: BUG: unable to handle page fault for address: ffffffffc06d3bc0 RIP: 0010:strcmp+0xc/0x30 Call Trace: <TASK> led_trigger_register+0x10d/0x4f0 led_trigger_register_simple+0x7d/0x100 bt_init+0x39/0xf7 [bluetooth] do_one_initcall+0xd0/0x4e0(CVE-2022-48971)

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() Kernel fault injection test reports null-ptr-deref as follows: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:cfg802154_netdev_notifier_call+0x120/0x310 include/linux/list.h:114 Call Trace: <TASK> raw_notifier_call_chain+0x6d/0xa0 kernel/notifier.c:87 call_netdevice_notifiers_info+0x6e/0xc0 net/core/dev.c:1944 unregister_netdevice_many_notify+0x60d/0xcb0 net/core/dev.c:1982 unregister_netdevice_queue+0x154/0x1a0 net/core/dev.c:10879 register_netdevice+0x9a8/0xb90 net/core/dev.c:10083 ieee802154_if_add+0x6ed/0x7e0 net/mac802154/iface.c:659 ieee802154_register_hw+0x29c/0x330 net/mac802154/main.c:229 mcr20a_probe+0xaaa/0xcb1 drivers/net/ieee802154/mcr20a.c:1316 ieee802154_if_add() allocates wpan_dev as netdev's private data, but not init the list in struct wpan_dev. cfg802154_netdev_notifier_call() manage the list when device register/unregister, and may lead to null-ptr-deref. Use INIT_LIST_HEAD() on it to initialize it correctly.(CVE-2022-48972)

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix shift-out-of-bounds in hid_report_raw_event Syzbot reported shift-out-of-bounds in hid_report_raw_event. microsoft 0003:045E:07DA.0001: hid_field_extract() called with n (128) > 32! (swapper/0)…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: single: fix potential NULL dereference in pcs_get_function()

pinmux_generic_get_function() can return NULL and the pointer 'function' was dereferenced without checking against NULL. Add checking of pointer 'function' in pcs_get_function().

Found by code review.(CVE-2024-46685)

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Mark XDomain as unplugged when router is removed

I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another host connected with enabled paths we hang in tearing them down. This is due to fact that the Thunderbolt networking driver also tries to cleanup the paths and ends up blocking in tb_disconnect_xdomain_paths() waiting for the domain lock.

However, at this point we already cleaned the paths in tb_stop() so there is really no need for tb_disconnect_xdomain_paths() to do that anymore. Furthermore it already checks if the XDomain is unplugged and bails out early so take advantage of that and mark the XDomain as unplugged when we remove the parent router.(CVE-2024-46702)

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]

[WHY & HOW] num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets - 1].

This fixes an OVERRUN issue reported by Coverity.(CVE-2024-46815)

In the Linux kernel, the following vulnerability has been resolved: vfs: fix race between evice_inodes() and find_inode()&iput() Hi, all Recently I noticed a bug[1] in btrfs, after digged it into and I believe it'a race in vfs. Let's assume there's a inode (ie ino 261) with i_count 1 is called by iput(), and there's a concurrent thread calling generic_shutdown_super(). cpu0: cpu1: iput() // i_count is 1 ->spin_lock(inode) ->dec i_count to 0 ->iput_final() generic_shutdown_super() ->__inode_add_lru() ->evict_inodes() // cause some reason[2] ->if (atomic_read(inode->i_count)) continue; // return before // inode 261 passed the above check // list_lru_add_obj() // and then schedule out ->spin_unlock() // note here: the inode 261 // was still at sb list and hash list, // and I_FREEING|I_WILL_FREE was not been set btrfs_iget() // after some function calls ->find_inode() // found the above inode 261 ->spin_lock(inode) // check I_FREEING|I_WILL_FREE // and passed ->__iget() ->spin_unlock(inode) // schedule back ->spin_lock(inode) // check (I_NEW|I_FREEING|I_WILL_FREE) flags, // passed and set I_FREEING iput() ->spin_unlock(inode) ->spin_lock(inode) ->evict() // dec i_count to 0 ->iput_final() ->spin_unlock() ->evict() Now, we have two threads simultaneously evicting the same inode, which may trigger the BUG(inode->i_state & I_CLEAR) statement both within clear_inode() and iput(). To fix the bug, recheck the inode->i_count after holding i_lock. Because in the most scenarios, the first check is valid, and the overhead of spin_lock() can be reduced. If there is any misunderstanding, please let me know, thanks. [1]: https://lore.kernel.org/linux-btrfs/[email protected]/ [2]: The reason might be 1. SB_ACTIVE was removed or 2. mapping_shrinkable() return false when I reproduced the bug.(CVE-2024-47679)

In the Linux…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: single: fix potential NULL dereference in pcs_get_function()

pinmux_generic_get_function() can return NULL and the pointer 'function' was dereferenced without checking against NULL. Add checking of pointer 'function' in pcs_get_function().

Found by code review.(CVE-2024-46685)

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Mark XDomain as unplugged when router is removed

I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another host connected with enabled paths we hang in tearing them down. This is due to fact that the Thunderbolt networking driver also tries to cleanup the paths and ends up blocking in tb_disconnect_xdomain_paths() waiting for the domain lock.

However, at this point we already cleaned the paths in tb_stop() so there is really no need for tb_disconnect_xdomain_paths() to do that anymore. Furthermore it already checks if the XDomain is unplugged and bails out early so take advantage of that and mark the XDomain as unplugged when we remove the parent router.(CVE-2024-46702)

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]

[WHY & HOW] num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets - 1].

This fixes an OVERRUN issue reported by Coverity.(CVE-2024-46815)

In the Linux kernel, the following vulnerability has been resolved: vfs: fix race between evice_inodes() and find_inode()&iput() Hi, all Recently I noticed a bug[1] in btrfs, after digged it into and I believe it'a race in vfs. Let's assume there's a inode (ie ino 261) with i_count 1 is called by iput(), and there's a concurrent thread calling generic_shutdown_super(). cpu0: cpu1: iput() // i_count is 1 ->spin_lock(inode) ->dec i_count to 0 ->iput_final() generic_shutdown_super() ->__inode_add_lru() ->evict_inodes() // cause some reason[2] ->if (atomic_read(inode->i_count)) continue; // return before // inode 261 passed the above check // list_lru_add_obj() // and then schedule out ->spin_unlock() // note here: the inode 261 // was still at sb list and hash list, // and I_FREEING|I_WILL_FREE was not been set btrfs_iget() // after some function calls ->find_inode() // found the above inode 261 ->spin_lock(inode) // check I_FREEING|I_WILL_FREE // and passed ->__iget() ->spin_unlock(inode) // schedule back ->spin_lock(inode) // check (I_NEW|I_FREEING|I_WILL_FREE) flags, // passed and set I_FREEING iput() ->spin_unlock(inode) ->spin_lock(inode) ->evict() // dec i_count to 0 ->iput_final() ->spin_unlock() ->evict() Now, we have two threads simultaneously evicting the same inode, which may trigger the BUG(inode->i_state & I_CLEAR) statement both within clear_inode() and iput(). To fix the bug, recheck the inode->i_count after holding i_lock. Because in the most scenarios, the first check is valid, and the overhead of spin_lock() can be reduced. If there is any misunderstanding, please let me know, thanks. [1]: https://lore.kernel.org/linux-btrfs/[email protected]/ [2]: The reason might be 1. SB_ACTIVE was removed or 2. mapping_shrinkable() return false when I reproduced the bug.(CVE-2024-47679)

In the Linux…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Fix NULL sring after live migration A NAPI is setup for each network sring to poll data to kernel The sring with source host is destroyed before live migration and new sring with target host is setup after live migration. The NAPI for the old sring is not deleted until setup new sring with target host after migration. With busy_poll/busy_read enabled, the NAPI can be polled before got deleted when resume VM. BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: xennet_poll+0xae/0xd20 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI Call Trace: finish_task_switch+0x71/0x230 timerqueue_del+0x1d/0x40 hrtimer_try_to_cancel+0xb5/0x110 xennet_alloc_rx_buffers+0x2a0/0x2a0 napi_busy_loop+0xdb/0x270 sock_poll+0x87/0x90 do_sys_poll+0x26f/0x580 tracing_map_insert+0x1d4/0x2f0 event_hist_trigger+0x14a/0x260 finish_task_switch+0x71/0x230 __schedule+0x256/0x890 recalc_sigpending+0x1b/0x50 xen_sched_clock+0x15/0x20 __rb_reserve_next+0x12d/0x140 ring_buffer_lock_reserve+0x123/0x3d0 event_triggers_call+0x87/0xb0 trace_event_buffer_commit+0x1c4/0x210 xen_clocksource_get_cycles+0x15/0x20 ktime_get_ts64+0x51/0xf0 SyS_ppoll+0x160/0x1a0 SyS_ppoll+0x160/0x1a0 do_syscall_64+0x73/0x130 entry_SYSCALL_64_after_hwframe+0x41/0xa6 ... RIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900 CR2: 0000000000000008 ---[ end trace f8601785b354351c ]--- xen frontend should remove the NAPIs for the old srings before live migration as the bond srings are destroyed There is a tiny window between the srings are set to NULL and the NAPIs are disabled, It is safe as the NAPI threads are still frozen at that time(CVE-2022-48969)

In the Linux kernel, the following vulnerability has been resolved:

bonding: stop the device in bond_setup_by_slave()

Commit 9eed321cde22 ("net: lapbether: only support ethernet devices") has been able to keep syzbot away from net/lapb, until today.

In the following splat [1], the issue is that a lapbether device has been created on a bonding device without members. Then adding a non ARPHRD_ETHER member forced the bonding master to change its type.

The fix is to make sure we call dev_close() in bond_setup_by_slave() so that the potential linked lapbether devices (or any other devices having assumptions on the physical device) are removed.

A similar bug has been addressed in commit 40baec225765 ("bonding: fix panic on non-ARPHRD_ETHER enslave failure")

[1] skbuff: skb_under_panic: text:ffff800089508810 len:44 put:40 head:ffff0000c78e7c00 data:ffff0000c78e7bea tail:0x16 end:0x140 dev:bond0 kernel BUG at net/core/skbuff.c:192 ! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6007 Comm: syz-executor383 Not tainted 6.6.0-rc3-syzkaller-gbf6547d8715b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic net/core/skbuff.c:188 [inline] pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202 lr : skb_panic net/core/skbuff.c:188 [inline] lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202 sp : ffff800096a06aa0 x29: ffff800096a06ab0 x28: ffff800096a06ba0 x27: dfff800000000000 x26: ffff0000ce9b9b50 x25: 0000000000000016 x24: ffff0000c78e7bea x23: ffff0000c78e7c00 x22: 000000000000002c x21: 0000000000000140 x20: 0000000000000028 x19: ffff800089508810 x18: ffff800096a06100 x17: 0000000000000000 x16: ffff80008a629a3c x15: 0000000000000001 x14: 1fffe00036837a32 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000201 x10: 0000000000000000 x9 : cb50b496c519aa00 x8 : cb50b496c519aa00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800096a063b8 x4 : ffff80008e280f80 x3 : ffff8000805ad11c x2 : 0000000000000001 x1 : 0000000100000201 x0 : 0000000000000086 Call…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new

This patch enhances error handling in scenarios with RTS (Request to Send) messages arriving closely. It replaces the less informative WARN_ON_ONCE backtraces with a new error handling method. This provides clearer error messages and allows for the early termination of problematic sessions. Previously, sessions were only released at the end of j1939_xtp_rx_rts().

Potentially this could be reproduced with something like: testj1939 -r vcan0:0x80 & while true; do # send first RTS cansend vcan0 18EC8090#1014000303002301; # send second RTS cansend vcan0 18EC8090#1014000303002301; # send abort cansend vcan0 18EC8090#ff00000000002301; done(CVE-2023-52887)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()

Extend a critical section to prevent chan from early freeing. Also make the l2cap_connect() return type void. Nothing is using the returned value but it is ugly to return a potentially freed pointer. Making it void will help with backports because earlier kernels did use the return value. Now the compile will break for kernels where this patch is not a complete fix.

Call stack summary:

[use] l2cap_bredr_sig_cmd l2cap_connect ┌ mutex_lock(&conn->chan_lock); │ chan = pchan->ops->new_connection(pchan); <- alloc chan │ __l2cap_chan_add(conn, chan); │ l2cap_chan_hold(chan); │ list_add(&chan->list, &conn->chan_l); ... (1) └ mutex_unlock(&conn->chan_lock); chan->conf_state ... (4) <- use after free

[free] l2cap_conn_del ┌ mutex_lock(&conn->chan_lock); │ foreach chan in conn->chan_l: ... (2) │ l2cap_chan_put(chan); │ l2cap_chan_destroy │ kfree(chan) ... (3) <- chan freed └ mutex_unlock(&conn->chan_lock);

================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0 net/bluetooth/l2cap_core.c:4260 Read of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311(CVE-2024-36013)

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: fix kernel crash when devlink reload during pf initialization

The devlink reload process will access the hardware resources, but the register operation is done before the hardware is initialized. So, processing the devlink reload during initialization may lead to kernel crash. This patch fixes this by taking devl_lock during initialization.(CVE-2024-36021)

In the Linux kernel, the following vulnerability has been resolved:

bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq

Undefined behavior is triggered when bnxt_qplib_alloc_init_hwq is called with hwq_attr->aux_depth != 0 and hwq_attr->aux_stride == 0. In that case, "roundup_pow_of_two(hwq_attr->aux_stride)" gets called. roundup_pow_of_two is documented as undefined for 0.

Fix it in the one caller that had this combination.

The undefined behavior was detected by UBSAN: UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13 shift exponent 64 is too large for 64-bit type 'long unsigned int' CPU: 24 PID: 1075 Comm: (udev-worker) Not tainted 6.9.0-rc6+ #4 Hardware name: Abacus electric, s.r.o. - [email protected] Super Server/H12SSW-iN, BIOS 2.7 10/25/2023 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ubsan_epilogue+0x5/0x30 __ubsan_handle_shift_out_of_bounds.cold+0x61/0xec …

Root has patched CVE-2024-50073 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2024-50073 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by task poc/3379 CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: <TASK> gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm] __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389 update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500 __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846 __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161 gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107 __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm] ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195 ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79 __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338 __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805 tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818 Allocated by task 65: gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm] gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm] gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm] gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm] tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391 tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39 flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445 process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229 worker_thread+0x3dc/0x950 kernel/workqueue.c:3391 kthread+0x2a3/0x370 kernel/kthread.c:389 ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257 Freed by task 3367: kfree+0x126/0x420 mm/slub.c:4580 gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818 [Analysis] gsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux can be freed by multi threads through ioctl,which leads to the occurrence of uaf. Protect it by gsm tx lock.

• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• firmware_loader: Block path traversal {CVE-2024-47742}
• ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950}
• ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
• driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
• ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• smack: tcp: ipv4, fix incorrect labeling {CVE-2024-47659}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• ALSA: asihpi: Fix potential OOB array access {CVE-2024-50007}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• drm/amd/display: Fix index out of bounds in degamma hardware format translation {CVE-2024-49894}
• ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
• ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
• bna: adjust 'name' buf size of bna_tcb and bna_ccb structures {CVE-2024-43839}

• driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
• net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}
• memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• tipc: guard against string buffer overrun {CVE-2024-49995}
• ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
• ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
• ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• padata: Fix possible divide-by-0 panic in padata_mt_helper() {CVE-2024-43889}
• hwmon: (coretemp) Check for null before removing sysfs attrs {CVE-2022-49010}
• drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error {CVE-2024-47697}
• wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
• ipv6: avoid use-after-free in ip6_fragment() {CVE-2022-48956}
• netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
• drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
• slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• firmware_loader: Block path traversal {CVE-2024-47742}
• ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
• tcp: drop the hash_32() part from the index calculation {CVE-2022-1012}
• tcp: increase source port perturb table to 2^16 {CVE-2022-1012}
• tcp: dynamically allocate the perturb table used by source ports {CVE-2022-1012}
• net: dccp: fix kernel crash on module load {CVE-2022-1012}
• net: dccp: initialize (addr,port) listening hashtable {CVE-2022-1012}
• tcp: add small random increments to the source port {CVE-2022-1012}
• tcp: resalt the secret every 10 seconds {CVE-2022-1012}
• tcp: use different parts of the port_offset for index and offset {CVE-2022-1012}
• secure_seq: use the 64 bits of the siphash for port offset calculation {CVE-2022-1012}
• Revert "[ELSCVE-6395] secure_seq: use the 64 bits of the siphash for port offset calculation" {CVE-2022-1012}
• tcp: add some entropy in __inet_hash_connect() {CVE-2022-1012}
• tcp: change source port randomizarion at connect() time {CVE-2022-1012}
• esp: limit skb_page_frag_refill use to a single page {CVE-2022-27666}
• drm/vmwgfx: Fix stale file descriptors on failed usercopy {CVE-2022-22942}
• drm/i915: Fix the GT fence revocation runtime PM logic {CVE-2022-0330}
• PM: runtime: Add pm_runtime_get_if_active() {CVE-2022-0330}
• PM-runtime: add tracepoints for usage_count changes {CVE-2022-0330}
• fget: clarify and improve __fget_files() implementation {CVE-2021-4083}
• proc/fd: In proc_fd_link use fget_task {CVE-2021-4083}
• kcmp: In kcmp_epoll_target use fget_task {CVE-2021-4083}
• file: Rename __fcheck_files to files_lookup_fd_raw {CVE-2021-4083}
• bpf: In bpf_task_fd_query use fget_task {CVE-2021-4083}
• fget: check that the fd still exists after getting a ref to it {CVE-2021-4083}
• Revert "[ELSCVE-2732] fget: check that the fd still exists after getting a ref to it" {CVE-2021-4083}
• file: Replace fcheck_files with files_lookup_fd_rcu {CVE-2021-4083}
• file: Factor files_lookup_fd_locked out of fcheck_files {CVE-2021-4083}
• vfs, fdtable: Add fget_task helper {CVE-2021-4083}

• driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
• net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}
• memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• tipc: guard against string buffer overrun {CVE-2024-49995}
• ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
• ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
• ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• padata: Fix possible divide-by-0 panic in padata_mt_helper() {CVE-2024-43889}
• hwmon: (coretemp) Check for null before removing sysfs attrs {CVE-2022-49010}
• drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error {CVE-2024-47697}
• wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
• ipv6: avoid use-after-free in ip6_fragment() {CVE-2022-48956}
• netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
• drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
• slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• firmware_loader: Block path traversal {CVE-2024-47742}
• ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
• tcp: drop the hash_32() part from the index calculation {CVE-2022-1012}
• tcp: increase source port perturb table to 2^16 {CVE-2022-1012}
• tcp: dynamically allocate the perturb table used by source ports {CVE-2022-1012}
• net: dccp: fix kernel crash on module load {CVE-2022-1012}
• net: dccp: initialize (addr,port) listening hashtable {CVE-2022-1012}
• tcp: add small random increments to the source port {CVE-2022-1012}
• tcp: resalt the secret every 10 seconds {CVE-2022-1012}
• tcp: use different parts of the port_offset for index and offset {CVE-2022-1012}
• secure_seq: use the 64 bits of the siphash for port offset calculation {CVE-2022-1012}
• Revert "[ELSCVE-6395] secure_seq: use the 64 bits of the siphash for port offset calculation" {CVE-2022-1012}
• tcp: add some entropy in __inet_hash_connect() {CVE-2022-1012}
• tcp: change source port randomizarion at connect() time {CVE-2022-1012}
• esp: limit skb_page_frag_refill use to a single page {CVE-2022-27666}
• drm/vmwgfx: Fix stale file descriptors on failed usercopy {CVE-2022-22942}
• PM-runtime: add tracepoints for usage_count changes {CVE-2022-0330}
• fget: clarify and improve __fget_files() implementation {CVE-2021-4083}
• proc/fd: In proc_fd_link use fget_task {CVE-2021-4083}
• kcmp: In kcmp_epoll_target use fget_task {CVE-2021-4083}
• file: Rename __fcheck_files to files_lookup_fd_raw {CVE-2021-4083}
• fget: check that the fd still exists after getting a ref to it {CVE-2021-4083}
• Revert "[ELSCVE-2732] fget: check that the fd still exists after getting a ref to it" {CVE-2021-4083}
• file: Replace fcheck_files with files_lookup_fd_rcu {CVE-2021-4083}
• file: Factor files_lookup_fd_locked out of fcheck_files {CVE-2021-4083}

• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
• ext4: fix slab-use-after-free in ext4_split_extent_at() {CVE-2024-49884}
• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
• drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX {CVE-2024-46871}
• Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950}
• Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit {CVE-2024-49950}
• driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
• padata: Fix possible divide-by-0 panic in padata_mt_helper() {CVE-2024-43889}
• wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
• net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• tipc: guard against string buffer overrun {CVE-2024-49995}
• ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
• ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
• ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
• drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error {CVE-2024-47697}
• slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
• net: delete "register" keyword {CVE-2024-50033}
• drm/amd/display: fix double free issue during amdgpu module unload {CVE-2024-49989}
• drm/amd/display: Fix index out of bounds in degamma hardware format translation {CVE-2024-49894}
• drm/amd/display: Fix index out of bounds in DCN30 color transformation {CVE-2024-49969}
• drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
• drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation {CVE-2024-49895}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
• net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change {CVE-2021-47624}

• CVE-url: https://ubuntu.com/security/CVE-2024-44946
  • kcm: Serialise kcm_sendmsg() for the same socket.
• CVE-url: https://ubuntu.com/security/CVE-2024-42292
  • kobject_uevent: Fix OOB access within zap_modalias_env()
• CVE-url: https://ubuntu.com/security/CVE-2024-41042
  • netfilter: nf_tables: prefer nft_chain_validate
• CVE-url: https://ubuntu.com/security/CVE-2024-42265
  • protect the fetch of ->fd[fd] in do_dup2() from mispredictions
• CVE-url: https://ubuntu.com/security/CVE-2024-50036
  • net: do not delay dst_entries_add() in dst_release()
• CVE-url: https://ubuntu.com/security/CVE-2024-47663
  • staging: iio: frequency: ad9833: Load clock using clock framework
  • staging: iio: frequency: ad9834: Validate frequency parameter value
• CVE-url: https://ubuntu.com/security/CVE-2024-47669
  • nilfs2: fix state management in error path of log writing function
• CVE-url: https://ubuntu.com/security/CVE-2023-52918
  • media: pci: cx23885: check cx23885_vdev_init() return
• CVE-url: https://ubuntu.com/security/CVE-2024-44960
  • usb: gadget: core: Check for unset descriptor
• CVE-url: https://ubuntu.com/security/CVE-2024-42297
  • f2fs: fix to don't dirty inode for readonly filesystem
• CVE-url: https://ubuntu.com/security/CVE-2024-46750
  • PCI: Add missing bridge lock to pci_bus_lock()
• CVE-url: https://ubuntu.com/security/CVE-2024-46676
  • nfc: pn533: Add poll mod list filling check
• CVE-url: https://ubuntu.com/security/CVE-2024-46761
  • pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
• CVE-url: https://ubuntu.com/security/CVE-2024-46755
  • wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
• CVE-url: https://ubuntu.com/security/CVE-2024-46679
  • ethtool: check device is present when getting link settings
• CVE-url: https://ubuntu.com/security/CVE-2024-46721
  • apparmor: fix possible NULL pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-46685
  • pinctrl: single: fix potential NULL dereference in pcs_get_function()
• CVE-url: https://ubuntu.com/security/CVE-2024-44947
  • fuse: Initialize beyond-EOF page contents before setting uptodate
• CVE-url: https://ubuntu.com/security/CVE-2024-46675
  • usb: dwc3: core: Prevent USB core invalid event buffer address access
• CVE-url: https://ubuntu.com/security/CVE-2024-43893
  • serial: core: check uartclk for zero to avoid divide by zero
• CVE-url: https://ubuntu.com/security/CVE-2024-45021
  • memcg_write_event_control(): fix a user-triggerable oops
• CVE-url: https://ubuntu.com/security/CVE-2024-46677
  • gtp: fix a potential NULL pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-43861
  • net: usb: qmi_wwan: fix memory leak for not ip packets
• CVE-url: https://ubuntu.com/security/CVE-2024-41063
  • Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
• CVE-url: https://ubuntu.com/security/CVE-2024-45006
  • xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
• CVE-url: https://ubuntu.com/security/CVE-2024-43853
  • cgroup/cpuset: Prevent UAF in proc_cpuset_show()
• CVE-url: https://ubuntu.com/security/CVE-2024-42310
  • drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
• CVE-url: https://ubuntu.com/security/CVE-2024-42311
  • hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
• CVE-url: https://ubuntu.com/security/CVE-2024-41012
  • filelock: Remove locks reliably when fcntl/close race is detected
• CVE-url: https://ubuntu.com/security/CVE-2024-45028
  • mmc: mmc_test: Fix NULL dereference on allocation failure
• CVE-url: https://ubuntu.com/security/CVE-2024-43860
  • remoteproc: imx_rproc: Skip over memory region when node value is NULL
• CVE-url: https://ubuntu.com/security/CVE-2024-43914
  • md/raid5: avoid BUG_ON() while continue…

• CVE-url: https://ubuntu.com/security/CVE-2024-44946
  • kcm: Serialise kcm_sendmsg() for the same socket.
• CVE-url: https://ubuntu.com/security/CVE-2024-42292
  • kobject_uevent: Fix OOB access within zap_modalias_env()
• CVE-url: https://ubuntu.com/security/CVE-2024-41042
  • netfilter: nf_tables: prefer nft_chain_validate
• CVE-url: https://ubuntu.com/security/CVE-2024-42265
  • protect the fetch of ->fd[fd] in do_dup2() from mispredictions
• CVE-url: https://ubuntu.com/security/CVE-2024-50036
  • net: do not delay dst_entries_add() in dst_release()
• CVE-url: https://ubuntu.com/security/CVE-2024-47663
  • staging: iio: frequency: ad9833: Load clock using clock framework
  • staging: iio: frequency: ad9834: Validate frequency parameter value
• CVE-url: https://ubuntu.com/security/CVE-2024-47669
  • nilfs2: fix state management in error path of log writing function
• CVE-url: https://ubuntu.com/security/CVE-2023-52918
  • media: pci: cx23885: check cx23885_vdev_init() return
• CVE-url: https://ubuntu.com/security/CVE-2024-44960
  • usb: gadget: core: Check for unset descriptor
• CVE-url: https://ubuntu.com/security/CVE-2024-42297
  • f2fs: fix to don't dirty inode for readonly filesystem
• CVE-url: https://ubuntu.com/security/CVE-2024-46750
  • PCI: Add missing bridge lock to pci_bus_lock()
• CVE-url: https://ubuntu.com/security/CVE-2024-46676
  • nfc: pn533: Add poll mod list filling check
• CVE-url: https://ubuntu.com/security/CVE-2024-46761
  • pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
• CVE-url: https://ubuntu.com/security/CVE-2024-46755
  • wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
• CVE-url: https://ubuntu.com/security/CVE-2024-46679
  • ethtool: check device is present when getting link settings
• CVE-url: https://ubuntu.com/security/CVE-2024-46721
  • apparmor: fix possible NULL pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-46685
  • pinctrl: single: fix potential NULL dereference in pcs_get_function()
• CVE-url: https://ubuntu.com/security/CVE-2024-44947
  • fuse: Initialize beyond-EOF page contents before setting uptodate
• CVE-url: https://ubuntu.com/security/CVE-2024-46675
  • usb: dwc3: core: Prevent USB core invalid event buffer address access
• CVE-url: https://ubuntu.com/security/CVE-2024-43893
  • serial: core: check uartclk for zero to avoid divide by zero
• CVE-url: https://ubuntu.com/security/CVE-2024-45021
  • memcg_write_event_control(): fix a user-triggerable oops
• CVE-url: https://ubuntu.com/security/CVE-2024-46677
  • gtp: fix a potential NULL pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-43861
  • net: usb: qmi_wwan: fix memory leak for not ip packets
• CVE-url: https://ubuntu.com/security/CVE-2024-41063
  • Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
• CVE-url: https://ubuntu.com/security/CVE-2024-45006
  • xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
• CVE-url: https://ubuntu.com/security/CVE-2024-43853
  • cgroup/cpuset: Prevent UAF in proc_cpuset_show()
• CVE-url: https://ubuntu.com/security/CVE-2024-42310
  • drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
• CVE-url: https://ubuntu.com/security/CVE-2024-42311
  • hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
• CVE-url: https://ubuntu.com/security/CVE-2024-41012
  • filelock: Remove locks reliably when fcntl/close race is detected
• CVE-url: https://ubuntu.com/security/CVE-2024-45028
  • mmc: mmc_test: Fix NULL dereference on allocation failure
• CVE-url: https://ubuntu.com/security/CVE-2024-43860
  • remoteproc: imx_rproc: Skip over memory region when node value is NULL
• CVE-url: https://ubuntu.com/security/CVE-2024-43914
  • md/raid5: avoid BUG_ON() while continue…

• CVE-url: https://ubuntu.com/security/CVE-2024-42265
  • protect the fetch of ->fd[fd] in do_dup2() from mispredictions
• CVE-url: https://ubuntu.com/security/CVE-2024-47669
  • nilfs2: fix state management in error path of log writing function
• CVE-url: https://ubuntu.com/security/CVE-2023-52918
  • media: pci: cx23885: check cx23885_vdev_init() return
• CVE-url: https://ubuntu.com/security/CVE-2024-46750
  • PCI: Add missing bridge lock to pci_bus_lock()
• CVE-url: https://ubuntu.com/security/CVE-2024-46676
  • nfc: pn533: Add poll mod list filling check
• CVE-url: https://ubuntu.com/security/CVE-2024-46755
  • wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
• CVE-url: https://ubuntu.com/security/CVE-2024-46721
  • apparmor: fix possible NULL pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-44947
  • fuse: Initialize beyond-EOF page contents before setting uptodate
• CVE-url: https://ubuntu.com/security/CVE-2024-46675
  • usb: dwc3: core: Prevent USB core invalid event buffer address access
• CVE-url: https://ubuntu.com/security/CVE-2024-43893
  • serial: core: check uartclk for zero to avoid divide by zero
• CVE-url: https://ubuntu.com/security/CVE-2024-45021
  • memcg_write_event_control(): fix a user-triggerable oops
• CVE-url: https://ubuntu.com/security/CVE-2024-41012
  • filelock: Remove locks reliably when fcntl/close race is detected
• CVE-url: https://ubuntu.com/security/CVE-2024-42310
  • drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
• CVE-url: https://ubuntu.com/security/CVE-2024-42311
  • hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
• CVE-url: https://ubuntu.com/security/CVE-2024-45028
  • mmc: mmc_test: Fix NULL dereference on allocation failure
• CVE-url: https://ubuntu.com/security/CVE-2024-43914
  • md/raid5: avoid BUG_ON() while continue reshape after reassembling
• CVE-url: https://ubuntu.com/security/CVE-2024-43856
  • dma: fix call order in dmam_free_coherent
• CVE-url: https://ubuntu.com/security/CVE-2024-43884
  • Bluetooth: MGMT: Add error handling to pair_device()
• CVE-url: https://ubuntu.com/security/CVE-2024-42309
  • drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
• CVE-url: https://ubuntu.com/security/CVE-2024-50044
  • Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
• CVE-url: https://ubuntu.com/security/CVE-2024-49967
  • ext4: no need to continue when the number of entries is 1
• Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596) // CVE- url: https://ubuntu.com/security/CVE-2022-49015
  • net: hsr: Fix potential use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2024-50033
  • slip: make slhc_remember() more robust against malicious packets
• CVE-url: https://ubuntu.com/security/CVE-2024-47670
  • ocfs2: add bounds checking to ocfs2_xattr_find_entry()
• CVE-url: https://ubuntu.com/security/CVE-2024-49950
  • Bluetooth: L2CAP: Fix uaf in l2cap_connect
• CVE-url: https://ubuntu.com/security/CVE-2024-49883
  • ext4: aovid use-after-free in ext4_ext_insert_extent()
• Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596) // CVE- url: https://ubuntu.com/security/CVE-2022-48960
  • net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
• CVE-url: https://ubuntu.com/security/CVE-2024-47745
  • mm: call the security_mmap_file() LSM hook in remap_file_pages()
• CVE-url: https://ubuntu.com/security/CVE-2024-49860
  • ACPI: sysfs: validate return type of _STR method
• CVE-url: https://ubuntu.com/security/CVE-2024-49882
  • ext4: fix double brelse() the buffer of the extents path
• CVE-url: https://ubuntu.com/security/CVE-2024-49995
  • tipc: guard against string buffer overrun
• CVE-url: https://ubuntu.com/security/CVE-2024-47723 -…

• CVE-url: https://ubuntu.com/security/CVE-2024-42265
  • protect the fetch of ->fd[fd] in do_dup2() from mispredictions
• CVE-url: https://ubuntu.com/security/CVE-2024-47669
  • nilfs2: fix state management in error path of log writing function
• CVE-url: https://ubuntu.com/security/CVE-2023-52918
  • media: pci: cx23885: check cx23885_vdev_init() return
• CVE-url: https://ubuntu.com/security/CVE-2024-46750
  • PCI: Add missing bridge lock to pci_bus_lock()
• CVE-url: https://ubuntu.com/security/CVE-2024-46676
  • nfc: pn533: Add poll mod list filling check
• CVE-url: https://ubuntu.com/security/CVE-2024-46755
  • wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
• CVE-url: https://ubuntu.com/security/CVE-2024-46721
  • apparmor: fix possible NULL pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-44947
  • fuse: Initialize beyond-EOF page contents before setting uptodate
• CVE-url: https://ubuntu.com/security/CVE-2024-46675
  • usb: dwc3: core: Prevent USB core invalid event buffer address access
• CVE-url: https://ubuntu.com/security/CVE-2024-43893
  • serial: core: check uartclk for zero to avoid divide by zero
• CVE-url: https://ubuntu.com/security/CVE-2024-45021
  • memcg_write_event_control(): fix a user-triggerable oops
• CVE-url: https://ubuntu.com/security/CVE-2024-41012
  • filelock: Remove locks reliably when fcntl/close race is detected
• CVE-url: https://ubuntu.com/security/CVE-2024-42310
  • drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
• CVE-url: https://ubuntu.com/security/CVE-2024-42311
  • hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
• CVE-url: https://ubuntu.com/security/CVE-2024-45028
  • mmc: mmc_test: Fix NULL dereference on allocation failure
• CVE-url: https://ubuntu.com/security/CVE-2024-43914
  • md/raid5: avoid BUG_ON() while continue reshape after reassembling
• CVE-url: https://ubuntu.com/security/CVE-2024-43856
  • dma: fix call order in dmam_free_coherent
• CVE-url: https://ubuntu.com/security/CVE-2024-43884
  • Bluetooth: MGMT: Add error handling to pair_device()
• CVE-url: https://ubuntu.com/security/CVE-2024-42309
  • drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
• CVE-url: https://ubuntu.com/security/CVE-2024-50044
  • Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
• CVE-url: https://ubuntu.com/security/CVE-2024-49967
  • ext4: no need to continue when the number of entries is 1
• Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596) // CVE- url: https://ubuntu.com/security/CVE-2022-49015
  • net: hsr: Fix potential use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2024-50033
  • slip: make slhc_remember() more robust against malicious packets
• CVE-url: https://ubuntu.com/security/CVE-2024-47670
  • ocfs2: add bounds checking to ocfs2_xattr_find_entry()
• CVE-url: https://ubuntu.com/security/CVE-2024-49950
  • Bluetooth: L2CAP: Fix uaf in l2cap_connect
• CVE-url: https://ubuntu.com/security/CVE-2024-49883
  • ext4: aovid use-after-free in ext4_ext_insert_extent()
• Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596) // CVE- url: https://ubuntu.com/security/CVE-2022-48960
  • net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
• CVE-url: https://ubuntu.com/security/CVE-2024-47745
  • mm: call the security_mmap_file() LSM hook in remap_file_pages()
• CVE-url: https://ubuntu.com/security/CVE-2024-49860
  • ACPI: sysfs: validate return type of _STR method
• CVE-url: https://ubuntu.com/security/CVE-2024-49882
  • ext4: fix double brelse() the buffer of the extents path
• CVE-url: https://ubuntu.com/security/CVE-2024-49995
  • tipc: guard against string buffer overrun
• CVE-url: https://ubuntu.com/security/CVE-2024-47723 -…

• smb: client: fix use-after-free in smb2_query_info_compound() {CVE-2023-52751}
• smb: client: prevent new fids from being removed by laundromat {CVE-2023-52751}
• cifs: fix dentry lookups in directory handle cache {CVE-2023-52751}
• uprobe: avoid out-of-bounds memory access of fetching args {CVE-2024-50067}
• net: do not delay dst_entries_add() in dst_release() {CVE-2024-50036}
• smb: client: fix UAF in async decryption {CVE-2024-50047}
• smb3: rename encryption/decryption TFMs
• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• drm/amd/display: fix double free issue during amdgpu module unload {CVE-2024-49989}
• ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950}
• Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit {CVE-2024-49950}
• mptcp: pm: Fix uaf in __timer_delete_sync {CVE-2024-46858}
• of: fdt: fix off-by-one error in unflatten_dt_nodes() {CVE-2022-48672}
• filelock: fix potential use-after-free in posix_lock_inode {CVE-2024-41049}
• locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock {CVE-2024-41049}
• drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation {CVE-2024-49895}
• slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
• drm/amd/display: Fix index out of bounds in DCN30 color transformation {CVE-2024-49969}
• drm/amd/display: Fix index out of bounds in degamma hardware format translation {CVE-2024-49894}
• ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
• ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
• ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
• tipc: guard against string buffer overrun {CVE-2024-49995}
• drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
• firmware_loader: Block path traversal {CVE-2024-47742}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
• ext4: fix slab-use-after-free in ext4_split_extent_at() {CVE-2024-49884}
• drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX {CVE-2024-46871}
• ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
• wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
• net: do not leave a dangling sk pointer, when socket creation fails {CVE-2024-40954}
• net: sched: sch_multiq: fix possible OOB write in multiq_tune() {CVE-2024-36978}
• drm/amdgpu: Validate TA binary size {CVE-2024-44977}

• CVE-2024-50047 fix. // CVE-url: https://ubuntu.com/security/CVE-2025-38488
  • smb: client: fix use-after-free in crypt_message when using async crypto
• CVE-url: https://ubuntu.com/security/CVE-2024-57996 // CVE-url: https://ubuntu.com/security/CVE-2025-37752
  • net_sched: sch_sfq: move the limit validation
• CVE-url: https://ubuntu.com/security/CVE-2023-52975
  • scsi: iscsi: Move pool freeing
  • scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
• CVE-url: https://ubuntu.com/security/CVE-2023-52757
  • smb: client: fix potential deadlock when releasing mids
• CVE-url: https://ubuntu.com/security/CVE-2025-38083
  • net_sched: prio: fix a race in prio_tune()
• CVE-url: https://ubuntu.com/security/CVE-2024-49950
  • Bluetooth: L2CAP: Fix uaf in l2cap_connect
  • Bluetooth: hci_core: Fix calling mgmt_device_connected
• CVE-url: https://ubuntu.com/security/CVE-2024-50073
  • tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
• CVE-url: https://ubuntu.com/security/CVE-2025-37797
  • net_sched: hfsc: Fix a UAF vulnerability in class handling
• CVE-url: https://ubuntu.com/security/CVE-2024-38541
  • of: module: add buffer overflow check in of_modalias()
• CVE-url: https://ubuntu.com/security/CVE-2025-37997
  • netfilter: ipset: fix region locking in hash types
• CVE-url: https://ubuntu.com/security/CVE-2024-53051
  • drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability
• CVE-url: https://ubuntu.com/security/CVE-2025-37890
  • net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
  • sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
  • net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
• CVE-url: https://ubuntu.com/security/CVE-2025-37782
  • hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
• CVE-url: https://ubuntu.com/security/CVE-2024-53185
  • smb: client: fix NULL ptr deref in crypto_aead_setkey()
• CVE-url: https://ubuntu.com/security/CVE-2024-50047
  • smb: client: fix UAF in async decryption
• CVE-url: https://ubuntu.com/security/CVE-2024-56662
  • acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
• Miscellaneous upstream changes
  • Revert "UBUNTU: SAUCE: fs: hfs/hfsplus: add key_len boundary check to hfs_bnode_read_key"

• ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() {CVE-2026-23089}
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory {CVE-2024-50115}
• KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349}
• Revert "IB/core: Implement clear counters"
• Revert "IB/mlx5: Implement clear counters"
• Revert "ib/core: add SET_DEVICE_OP call for clear_hw_stats()"
• Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
• Revert "xfrm: destroy xfrm_state synchronously on net exit path"
• bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
• can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23061}
• crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060}
• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• drm/amd/pm: fix the Out-of-bounds read warning {CVE-2024-46731}
• drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number {CVE-2024-46724}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• ext4/jbd2: skip sb flush when EIO happened
• ext4: save the error code which triggered an
• fou: remove warn in gue_gro_receive on unsupported protocol {CVE-2024-44940}
• fs: proc: inode: delay put_pid() by RCU
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask
• io_uring: fix filename leak in __io_openat_prep() {CVE-2025-68814}
• jbd2: store more accurate errno in superblock
• libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285}
• libceph: make free_choose_arg_map() resilient to partial allocation {CVE-2026-22991}
• macvlan: Add nodst option to macvlan type source
• macvlan: Use 'hash' iterators to simplify code
• macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001}
• macvlan: observe an RCU grace period in macvlan_common_newlink() error path {CVE-2026-23273}
• media: xc2028: avoid use-after-free in load_firmware_cb() {CVE-2024-43900}
• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• net/sched: sch_qfq: do not free existing class in qfq_change_class() {CVE-2026-22999}
• net: sock: fix hardened usercopy panic in sock_recv_errqueue {CVE-2026-22977}
• net: usb: rtl8150: fix memory leak on usb_submit_urb() failure {CVE-2025-71154}
• rds: Add state field to RDS trace logs.
• rds: Drop rds conn in connect worker if not in down state.
• scsi: mpi3mr: Sanitise num_phys {CVE-2024-42159}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() {CVE-2026-23193}
• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
• wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
• xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added {CVE-2025-40256}
• xfrm: delete x->tunnel as we delete x {CVE-2025-40215}
• xfrm: flush all states in xfrm_state_fini

• Rebased onto Oracle UEK base 5.4.17-2136.357.2.el7uek
• sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
• ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison {CVE-2026-53309}
• ocfs2/dlm: validate qr_numregions in dlm_match_regions() {CVE-2026-53043}
• ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
• crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060}
• futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
• i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597}
• netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381}
• wifi: mac80211: fix NULL deref in mesh_matches_local() {CVE-2026-23396}
• icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
• HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382}
• net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
• wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367}
• drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() {CVE-2026-23356}
• batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
• drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• sysctl: Fix data races in proc_douintvec(). {CVE-2022-49641}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
• mm:…

• Bump kernel ABI to 29: ship the ELS kernel as 4.19.0-29-*, distinct from the prior 4.19.0-28.
• CVE-2021-46984
  • kyber: fix out of bounds access when preempted {CVE-2021-46984}
• CVE-2021-47049
  • Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}
• CVE-2021-47101
  • asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
• CVE-2021-47191
  • scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• CVE-2021-47352
  • virtio-net: Add validation for used length {CVE-2021-47352}
• CVE-2021-47379
  • blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd {CVE-2021-47379}
• CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests {CVE-2021-47391}
• CVE-2021-47479
  • staging: rtl8712: fix use-after-free in rtl8712_dl_fw {CVE-2021-47479}
• CVE-2022-21546
  • scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• CVE-2022-39189
  • KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• CVE-2022-43945
  • SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
  • NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2022-49026
  • e100: Fix possible use after free in e100_xmit_prepare {CVE-2022-49026}
• CVE-2022-49720
  • block: Fix handling of offline queues in blk_mq_alloc_request_hctx() {CVE-2022-49720}
• CVE-2022-49975
  • bpf: Don't redirect packets with invalid pkt_len {CVE-2022-49975}
  • bpf: Move skb->len == 0 checks into __bpf_redirect {CVE-2022-49975}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2022-50103
  • sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• CVE-2022-50129
  • RDMA/srpt: Introduce a reference count in struct srpt_device {CVE-2022-50129}
  • RDMA/srpt: Fix a use-after-free {CVE-2022-50129}
• CVE-2022-50300
  • btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300}
• CVE-2022-50406
  • iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50552
  • blk-mq: use quiesced elevator switch when reinitializing queues {CVE-2022-50552}
• CVE-2023-51779
  • Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
• CVE-2023-52434
  • smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• CVE-2023-52515
  • RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
• CVE-2023-52531
  • wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
• CVE-2023-52741
  • cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
• CVE-2023-53000
  • netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• CVE-2023-53039
  • workqueue: Add resource managed version of delayed work init {CVE-2023-53039}
  • devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc {CVE-2023-53039}
  • devm-helpers: Add resource managed version of work init {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc {CVE-2023-53039}
• CVE-2023-53111
  • loop: Fix use-after-free issues {CVE-2023-53111}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels…

These are all security issues fixed in the kernel-devel-6.11.8-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.12.11-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46828: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1231114).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs: do not BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() (bsc#1231094).
• CVE-2024-46843: scsi: ufs: core: Remove SCSI host only if added (bsc#1231100).
• CVE-2024-46854: net: dpaa: Pad packets to ETH_ZLEN (bsc#1231084).
• CVE-2024-46855: netfilter: nft_socket: fix sk refcount leaks (bsc#1231085).
• CVE-2024-46857: net/mlx5: Fix bridge mode operations when there are no VFs (bsc#1231087).
• CVE-2024-46870: drm/amd/display: Disable DMCUB timeout for DCN35 (bsc#1231435).
• CVE-2024-47658: crypto: stm32/cryp - call finalize with bh disabled (bsc#1231436).
• CVE-2024-47660: fsnotify: clear PARENT_WATCHED flags lazily (bsc#1231439).
• CVE-2024-47664: spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware (bsc#1231442).
• CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
• CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
• CVE-2024-47685: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (bsc#1231998).
• CVE-2024-47687: vdpa/mlx5: Fix invalid mr resource destroy (bsc#1232003).
• CVE-2024-47692: nfsd: return -EINVAL when namelen is 0 (bsc#1231857).
• CVE-2024-47704: drm/amd/display: Check link_res->hpo_dp_link_enc before using it (bsc#1231944).
• CVE-2024-47705: block: fix potential invalid pointer dereference in blk_add_partition (bsc#1231872).
• CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
• CVE-2024-47707: ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() (bsc#1231935).
• CVE-2024-47710: sock_map: Add a cond_resched() in sock_hash_free() (bsc#1232049).
• CVE-2024-47727: x86/tdx: Fix 'in-kernel MMIO' check (bsc#1232116).
• CVE-2024-47730: crypto: hisilicon/qm - inject error before stopping queue (bsc#1232075).
• CVE-2024-47731: drivers/perf: Fix ali_drw_pmu driver interrupt status clearing (bsc#1232117).
• CVE-2024-47739: padata: use integer wrap around to prevent deadlock on seq_nr overflow (bsc#1232124).
• CVE-2024-47741:…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46828: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1231114).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs: do not BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() (bsc#1231094).
• CVE-2024-46843: scsi: ufs: core: Remove SCSI host only if added (bsc#1231100).
• CVE-2024-46854: net: dpaa: Pad packets to ETH_ZLEN (bsc#1231084).
• CVE-2024-46855: netfilter: nft_socket: fix sk refcount leaks (bsc#1231085).
• CVE-2024-46857: net/mlx5: Fix bridge mode operations when there are no VFs (bsc#1231087).
• CVE-2024-46870: drm/amd/display: Disable DMCUB timeout for DCN35 (bsc#1231435).
• CVE-2024-47658: crypto: stm32/cryp - call finalize with bh disabled (bsc#1231436).
• CVE-2024-47660: fsnotify: clear PARENT_WATCHED flags lazily (bsc#1231439).
• CVE-2024-47664: spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware (bsc#1231442).
• CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
• CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
• CVE-2024-47685: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (bsc#1231998).
• CVE-2024-47687: vdpa/mlx5: Fix invalid mr resource destroy (bsc#1232003).
• CVE-2024-47692: nfsd: return -EINVAL when namelen is 0 (bsc#1231857).
• CVE-2024-47704: drm/amd/display: Check link_res->hpo_dp_link_enc before using it (bsc#1231944).
• CVE-2024-47705: block: fix potential invalid pointer dereference in blk_add_partition (bsc#1231872).
• CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
• CVE-2024-47707: ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() (bsc#1231935).
• CVE-2024-47710: sock_map: Add a cond_resched() in sock_hash_free() (bsc#1232049).
• CVE-2024-47727: x86/tdx: Fix 'in-kernel MMIO' check (bsc#1232116).
• CVE-2024-47730: crypto: hisilicon/qm - inject error before stopping queue (bsc#1232075).
• CVE-2024-47731: drivers/perf: Fix ali_drw_pmu driver interrupt status clearing (bsc#1232117).
• CVE-2024-47739: padata: use integer wrap around to prevent deadlock on seq_nr overflow (bsc#1232124).
• CVE-2024-47741:…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
• CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
• CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-47745: mm: call the security_mmap_file() LSM hook in remap_file_pages() (bsc#1232135).
• CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49934: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (bsc#1232387).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
• CVE-2024-49968: ext4: filesystems without casefold feature cannot be mounted with siphash (bsc#1232264).
• CVE-2024-49983: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (bsc#1232096).
• CVE-2024-49989: drm/amd/display: fix double free issue during amdgpu module unload (bsc#1232483).
• CVE-2024-50009: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (bsc#1232318).
• CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
• CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50093: thermal: intel: int340x: processor: Fix warning during module unload (bsc#1232877).
• CVE-2024-50098: scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down (bsc#1232881).
• CVE-2024-50108: drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too (bsc#1232884).
• CVE-2024-50110: xfrm: fix one more kernel-infoleak in algo dumping (bsc#1232885).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-53095: smb: client: Fix use-after-free of network namespace (bsc#1233642).
• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2023-6270: aoe: fix the potential use-after-free problem in more places (bsc#1218562).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46828: sched: sch_cake: fix bulk flow accounting logic for host fairness (bsc#1231114).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
• CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48957: dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() (bsc#1231973).
• CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
• CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
• CVE-2022-48980: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() (bsc#1232233).
• CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
• CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2022-49017: tipc: re-fetch skb cb after tipc_msg_validate (bsc#1232004).
• CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
• CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB (bsc#1228709).
• CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005).
• CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837).
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46716: dmaengine: altera-msgdma:…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48853: swiotlb: fix info leak with DMA_FROM_DEVICE (bsc#1228015).
• CVE-2024-26801: Bluetooth: Avoid potential use-after-free in hci_error_reset (bsc#1222413).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2024-26886: Bluetooth: af_bluetooth: Fix deadlock (bsc#1223044).
• CVE-2024-27051: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value (bsc#1223769).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-46771: can: bcm: Remove proc entry when dev is unregistered (bsc#1230766).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47660: fsnotify: clear PARENT_WATCHED flags lazily (bsc#1231439).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-49858: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption (bsc#1232251).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49938: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit (bsc#1232552).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
• CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
• CVE-2024-50044: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (bsc#1231904).
• CVE-2024-50055: driver core: bus: Fix double free in driver API bus_register() (bsc#1232329).
• CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
• CVE-2024-50074: parport: Proper fix for array out-of-bounds access (bsc#1232507).
• CVE-2024-50095: RDMA/mad: Improve handling of timed out WRs of mad agent (bsc#1232873).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50117: drm/amd: Guard against bad data for ATIF ACPI method (bsc#1232897).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50135: nvme-pci: fix race condition between reset and nvme_dev_disable() (bsc#1232888).
• CVE-2024-50148: Bluetooth: bnep: fix wild-memory-access in proto_unregister (bsc#1233063).
• CVE-2024-50150: usb: typec: altmode should keep reference to parent (bsc#1233051).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50167: be2net: fix potential memory leak in be_xmit() (bsc#1233049).
• CVE-2024-50171: net: systemport: fix potential memory leak in bcm_sysport_xmit() (bsc#1233057).
• CVE-2024-50183: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (bsc#1233130).
• CVE-2024-50187: drm/vc4: Stop the active perfmon before being destroyed (bsc#1233108).
• CVE-2024-50195: posix-clock: Fix missing timespec64 check in pc_clock_settime() (bsc#1233103).
• CVE-2024-50218: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
• CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
• CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: explicitly exit when ext4_find_inline_entry returns an error (bsc#1231920).
• CVE-2024-47745: mm: split critical region in remap_file_pages() and invoke LSMs in between (bsc#1232135).
• CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49934: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (bsc#1232387).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
• CVE-2024-49968: ext4: fix error message when rejecting the default hash (bsc#1232264).
• CVE-2024-49983: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (bsc#1232096).
• CVE-2024-49989: drm/amd/display: fix double free issue during amdgpu module unload (bsc#1232483).
• CVE-2024-50009: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (bsc#1232318).
• CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
• CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50093: thermal: intel: int340x: processor: Fix warning during module unload (bsc#1232877).
• CVE-2024-50098: scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down (bsc#1232881).
• CVE-2024-50108: drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too (bsc#1232884).
• CVE-2024-50110: xfrm: fix one more kernel-infoleak in algo dumping (bsc#1232885).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix…

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2023-6270: aoe: fix the potential use-after-free problem in more places (bsc#1218562).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46828: sched: sch_cake: fix bulk flow accounting logic for host fairness (bsc#1231114).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs: do not BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() (bsc#1231094).
• CVE-2024-46843: scsi: ufs: core: Remove SCSI host only if added…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48853: swiotlb: fix info leak with DMA_FROM_DEVICE (bsc#1228015).
• CVE-2024-26801: Bluetooth: Avoid potential use-after-free in hci_error_reset (bsc#1222413).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2024-26886: Bluetooth: af_bluetooth: Fix deadlock (bsc#1223044).
• CVE-2024-27051: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value (bsc#1223769).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-46771: can: bcm: Remove proc entry when dev is unregistered (bsc#1230766).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47660: fsnotify: clear PARENT_WATCHED flags lazily (bsc#1231439).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-49858: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption (bsc#1232251).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49938: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit (bsc#1232552).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
• CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
• CVE-2024-50044: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (bsc#1231904).
• CVE-2024-50055: driver core: bus: Fix double free in driver API bus_register() (bsc#1232329).
• CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
• CVE-2024-50074: parport: Proper fix for array out-of-bounds access (bsc#1232507).
• CVE-2024-50095: RDMA/mad: Improve handling of timed out WRs of mad agent (bsc#1232873).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50117: drm/amd: Guard against bad data for ATIF ACPI method (bsc#1232897).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50135: nvme-pci: fix race condition between reset and nvme_dev_disable() (bsc#1232888).
• CVE-2024-50148: Bluetooth: bnep: fix wild-memory-access in proto_unregister (bsc#1233063).
• CVE-2024-50150: usb: typec: altmode should keep reference to parent (bsc#1233051).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50167: be2net: fix potential memory leak in be_xmit() (bsc#1233049).
• CVE-2024-50171: net: systemport: fix potential memory leak in bcm_sysport_xmit() (bsc#1233057).
• CVE-2024-50183: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (bsc#1233130).
• CVE-2024-50187: drm/vc4: Stop the active perfmon before being destroyed (bsc#1233108).
• CVE-2024-50195: posix-clock: Fix missing timespec64 check in pc_clock_settime() (bsc#1233103).
• CVE-2024-50218: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow…

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26708: mptcp: fastopen and PM-trigger subflow shutdown can race (bsc#1222672).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50185: mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-56568: iommu/arm-smmu: Defer probe of clients after smmu device bound (bsc#1235032).
• CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
• CVE-2024-56720: bpf, sockmap: Several fixes to bpf_msg_pop_data (bsc#1235592).
• CVE-2025-21636: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy (bsc#1236113).
• CVE-2025-21637: sctp: sysctl: udp_port: avoid using current->nsproxy (bsc#1236114).
• CVE-2025-21638: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115).
• CVE-2025-21639: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122).
• CVE-2025-21640: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123).
• CVE-2025-21647: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133).
• CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236700).
• CVE-2025-21687: vfio/platform: check the bounds of read/write syscalls (bsc#1237045).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
• CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).

The following non-security bugs were fixed:

• ACPI: x86: Add skip i2c clients quirk for Vexia EDU ATLA 10 tablet 5V (stable-fixes).
• ALSA: hda/cirrus: Correct the full scale volume set logic (git-fixes).
• ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED (stable-fixes).
• ALSA: hda/realtek: Fixup ALC225 depop procedure (git-fixes).
• ALSA: hda: Add error check for snd_ctl_rename_id() in snd_hda_create_dig_out_ctls() (git-fixes).
• ALSA: seq: Drop UMP events when no UMP-conversion is set (git-fixes).
• APEI: GHES: Have GHES honor the panic= setting (stable-fixes).
• ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V (stable-fixes).
• ASoC: SOF: pcm: Clear the susbstream pointer to NULL on close (git-fixes).
• ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (git-fixes).
• ASoC: amd: Add ACPI dependency to fix build error (stable-fixes).
• ASoC: fsl_micfil: Enable default case in micfil_set_quality() (git-fixes).
• ASoC: rockchip: i2s-tdm: fix shift config for SND_SOC_DAIFMT_DSP_[AB] (git-fixes).
• Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (stable-fixes).
• HID: Wacom: Add PCI Wacom device support (stable-fixes).
• HID: hid-steam: Add Deck IMU support (stable-fixes).
• HID: hid-steam: Add gamepad-only mode switched to by holding options (stable-fixes).
• HID: hid-steam: Avoid overwriting smoothing parameter (stable-fixes).
• HID: hid-steam: Clean up locking (stable-fixes).
• HID: hid-steam: Disable watchdog instead of using a heartbeat (stable-fixes).
• HID: hid-steam: Do not use cancel_delayed_work_sync in IRQ context (git-fixes).
• HID: hid-steam: Fix cleanup in probe() (git-fixes).
• HID: hid-steam: Make sure rumble work is canceled on removal (stable-fixes).
• HID: hid-steam: Move hidraw input (un)registering to work (git-fixes).
• HID: hid-steam: Update list of identifiers from SDL (stable-fixes).
• HID: hid-steam: remove pointless error message (stable-fixes).
• HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints()…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM (bsc#1186482).
• CVE-2021-47634: ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl (bsc#1237758).
• CVE-2021-47644: media: staging: media: zoran: move videodev alloc (bsc#1237766).
• CVE-2022-48953: rtc: cmos: fix build on non-ACPI platforms (bsc#1231941).
• CVE-2022-48975: gpiolib: fix memory leak in gpiochip_setup_dev() (bsc#1231885).
• CVE-2022-49006: tracing: Free buffers when a used dynamic event is removed (bsc#1232163).
• CVE-2022-49076: RDMA/hfi1: Fix use-after-free bug for mm struct (bsc#1237738).
• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238033).
• CVE-2022-49089: IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition (bsc#1238041).
• CVE-2022-49124: x86/mce: Work around an erratum on fast string copy instructions (bsc#1238148).
• CVE-2022-49134: mlxsw: spectrum: Guard against invalid local ports (bsc#1237982).
• CVE-2022-49135: drm/amd/display: Fix memory leak (bsc#1238006).
• CVE-2022-49151: can: mcba_usb: properly check endpoint type (bsc#1237778).
• CVE-2022-49178: memstick/mspro_block: fix handling of read-only devices (bsc#1238107).
• CVE-2022-49182: net: hns3: add vlan list lock to protect vlan list (bsc#1238260).
• CVE-2022-49201: ibmvnic: fix race between xmit and reset (bsc#1238256).
• CVE-2022-49247: media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED (bsc#1237783).
• CVE-2022-49490: drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is (bsc#1238275).
• CVE-2022-49626: sfc: fix use after free when disabling sriov (bsc#1238270).
• CVE-2022-49661: can: gs_usb: gs_usb_open/close(): fix memory leak (bsc#1237788).
• CVE-2023-52572: Fixed UAF in cifs_demultiplex_thread() in cifs (bsc#1220946).
• CVE-2023-52853: hid: cp2112: Fix duplicate workqueue initialization (bsc#1224988).
• CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).
• CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).
• CVE-2024-49963: mailbox: bcm2835: Fix timeout during suspend mode (bsc#1232147).
• CVE-2024-49975: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1232104).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50067: uprobe: avoid out-of-bounds memory access of fetching args (bsc#1232416).
• CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
• CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
• CVE-2024-53217: nfsd: restore callback functionality for NFSv4.0 (bsc#1234999).
• CVE-2024-56633: bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data (bsc#1235485).
• CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
• CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
• CVE-2024-56688: sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (bsc#1235538).
• CVE-2025-21638: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115).
• CVE-2025-21639: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122).
• CVE-2025-21640: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123).
• CVE-2025-21673: smb: client: fix double free of TCP_Server_Info::hostname (bsc#1236689).
• CVE-2025-21689: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() (bsc#1237017).
• CVE-2025-21690: scsi: storvsc:…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56568: iommu/arm-smmu: Defer probe of clients after smmu device bound (bsc#1235032).
• CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
• CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
• CVE-2024-56720: bpf, sockmap: Several fixes to bpf_msg_pop_data (bsc#1235592).
• CVE-2024-57882: mptcp: fix TCP options overflow. (bsc#1235914).
• CVE-2024-57994: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() (bsc#1237901).
• CVE-2025-21636: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy (bsc#1236113).
• CVE-2025-21637: sctp: sysctl: udp_port: avoid using current->nsproxy (bsc#1236114).
• CVE-2025-21638: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115).
• CVE-2025-21639: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122).
• CVE-2025-21640: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123).
• CVE-2025-21647: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133).
• CVE-2025-21665: filemap: avoid truncating 64-bit offset to 32 bits (bsc#1236684).
• CVE-2025-21666: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] (bsc#1236680).
• CVE-2025-21667: iomap: avoid avoid truncating 64-bit offset to 32 bits (bsc#1236681).
• CVE-2025-21668: pmdomain: imx8mp-blk-ctrl: add missing loop break condition (bsc#1236682).
• CVE-2025-21669: vsock/virtio: discard packets if the transport changes (bsc#1236683).
• CVE-2025-21670: vsock/bpf: return early if transport is not assigned (bsc#1236685).
• CVE-2025-21673: smb: client: fix double free of TCP_Server_Info::hostname (bsc#1236689).
• CVE-2025-21675: net/mlx5: Clear port select structure when fail to create (bsc#1236694).
• CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236700).
• CVE-2025-21681: openvswitch: fix lockup on tx to unregistering netdev with carrier (bsc#1236702).
• CVE-2025-21687: vfio/platform: check the bounds of read/write syscalls (bsc#1237045).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
• CVE-2025-21700: net: sched:…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56568: iommu/arm-smmu: Defer probe of clients after smmu device bound (bsc#1235032).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
• CVE-2024-56720: bpf, sockmap: Several fixes to bpf_msg_pop_data (bsc#1235592).
• CVE-2024-57994: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() (bsc#1237901).
• CVE-2025-21636: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy (bsc#1236113).
• CVE-2025-21637: sctp: sysctl: udp_port: avoid using current->nsproxy (bsc#1236114).
• CVE-2025-21638: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115).
• CVE-2025-21639: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122).
• CVE-2025-21640: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123).
• CVE-2025-21647: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133).
• CVE-2025-21665: filemap: avoid truncating 64-bit offset to 32 bits (bsc#1236684).
• CVE-2025-21667: iomap: avoid avoid truncating 64-bit offset to 32 bits (bsc#1236681).
• CVE-2025-21668: pmdomain: imx8mp-blk-ctrl: add missing loop break condition (bsc#1236682).
• CVE-2025-21673: smb: client: fix double free of TCP_Server_Info::hostname (bsc#1236689).
• CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236700).
• CVE-2025-21681: openvswitch: fix lockup on tx to unregistering netdev with carrier (bsc#1236702).
• CVE-2025-21687: vfio/platform: check the bounds of read/write syscalls (bsc#1237045).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
• CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
• CVE-2025-21728: bpf: Send signals asynchronously if !preemptible (bsc#1237879).
• CVE-2025-21705: mptcp: handle fastopen disconnect correctly (bsc#1238525).
• CVE-2025-21715: net: davicom: fix UAF in dm9000_drv_remove (bsc#1237889).
• CVE-2025-21716: vxlan: Fix uninit-value in vxlan_vnifilter_dump() (bsc#1237891).
• CVE-2025-21719: ipmr: do not call mr_mfc_uses_dev() for unres entries (bsc#1238860).
• CVE-2025-21724: iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() (bsc#1238863).
• CVE-2025-21725: smb: client: fix oops due to unset link speed (bsc#1238877). -…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
• CVE-2024-56720: bpf, sockmap: Several fixes to bpf_msg_pop_data (bsc#1235592).
• CVE-2024-57994: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() (bsc#1237901).
• CVE-2025-21636: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy (bsc#1236113).
• CVE-2025-21637: sctp: sysctl: udp_port: avoid using current->nsproxy (bsc#1236114).
• CVE-2025-21638: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115).
• CVE-2025-21639: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122).
• CVE-2025-21640: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123).
• CVE-2025-21647: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133).
• CVE-2025-21665: filemap: avoid truncating 64-bit offset to 32 bits (bsc#1236684).
• CVE-2025-21667: iomap: avoid avoid truncating 64-bit offset to 32 bits (bsc#1236681).
• CVE-2025-21668: pmdomain: imx8mp-blk-ctrl: add missing loop break condition (bsc#1236682).
• CVE-2025-21673: smb: client: fix double free of TCP_Server_Info::hostname (bsc#1236689).
• CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236700).
• CVE-2025-21681: openvswitch: fix lockup on tx to unregistering netdev with carrier (bsc#1236702).
• CVE-2025-21687: vfio/platform: check the bounds of read/write syscalls (bsc#1237045).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
• CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
• CVE-2025-21705: mptcp: handle fastopen disconnect correctly (bsc#1238525).
• CVE-2025-21715: net: davicom: fix UAF in dm9000_drv_remove (bsc#1237889).
• CVE-2025-21716: vxlan: Fix uninit-value in vxlan_vnifilter_dump() (bsc#1237891).
• CVE-2025-21719: ipmr: do not call mr_mfc_uses_dev() for unres entries (bsc#1238860).
• CVE-2025-21724: iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() (bsc#1238863).
• CVE-2025-21725: smb: client: fix oops due to unset link speed (bsc#1238877).
• CVE-2025-21728: bpf: Send signals asynchronously if !preemptible (bsc#1237879).
• CVE-2025-21767: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs: do…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
• CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
• CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
• CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
• CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
• CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs: do…