CVE-2024-50267

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: io_edgeport: fix use after free in debug printk

The "dev_dbg(&urb->dev->dev, ..." which happens after usb_free_urb(urb) is a use after free of the "urb" pointer. Store the "dev" pointer at the start of the function to avoid this issue.

In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_edgeport: fix use after free in debug printk The "dev_dbg(&urb->dev->dev, ..." which happens after usb_free_urb(urb) is a use after free of the "urb" pointer. Store the "dev" pointer at the start of the function to avoid this issue.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() Since '__dev_queue_xmit()' should be called with interrupts enabled, the following backtrace: ieee80211_do_stop() ... spin_lock_irqsave(&local->queue_stop_reason_lock, flags) ... ieee80211_free_txskb() ieee80211_report_used_skb() ieee80211_report_ack_skb() cfg80211_mgmt_tx_status_ext() nl80211_frame_tx_status() genlmsg_multicast_netns() genlmsg_multicast_netns_filtered() nlmsg_multicast_filtered() netlink_broadcast_filtered() do_one_broadcast() netlink_broadcast_deliver() __netlink_sendskb() netlink_deliver_tap() __netlink_deliver_tap_skb() dev_queue_xmit() __dev_queue_xmit() ; with IRQS disabled ... spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags) issues the warning (as reported by syzbot reproducer): WARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120 Fix this by implementing a two-phase skb reclamation in 'ieee80211_do_stop()', where actual work is performed outside of a section with interrupts disabled.(CVE-2024-47713)

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix helper writes to read-only maps Lonial found an issue that despite user- and BPF-side frozen BPF map (like in case of .rodata), it was still possible to write into it from a BPF program side through specific helpers having ARG_PTR_TO_{LONG,INT} as arguments. In check_func_arg() when the argument is as mentioned, the meta->raw_mode is never set. Later, check_helper_mem_access(), under the case of PTR_TO_MAP_VALUE as register base type, it assumes BPF_READ for the subsequent call to check_map_access_type() and given the BPF map is read-only it succeeds. The helpers really need to be annotated as ARG_PTR_TO_{LONG,INT} | MEM_UNINIT when results are written into them as opposed to read out of them. The latter indicates that it's okay to pass a pointer to uninitialized memory as the memory is written to anyway. However, ARG_PTR_TO_{LONG,INT} is a special case of ARG_PTR_TO_FIXED_SIZE_MEM just with additional alignment requirement. So it is better to just get rid of the ARG_PTR_TO_{LONG,INT} special cases altogether and reuse the fixed size memory types. For this, add MEM_ALIGNED to additionally ensure alignment given these helpers write directly into the args via <ptr> = val. The .arg_size has been initialized reflecting the actual sizeof(*<ptr>). MEM_ALIGNED can only be used in combination with MEM_FIXED_SIZE annotated argument types, since in !MEM_FIXED_SIZE cases the verifier does not know the buffer size a priori and therefore cannot blindly write *<ptr> = val.(CVE-2024-49861)

In the Linux kernel, the following vulnerability has been resolved: vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() Since commit 3f8ca2e115e5 ("vhost/scsi: Extract common handling code from control queue handler") a null pointer dereference bug can be triggered when guest sends an SCSI AN request. In vhost_scsi_ctl_handle_vq(), vc.target is assigned with &v_req.tmf.lun[1] within a switch-case block and is then passed to vhost_scsi_get_req() which extracts vc->req and tpg. However, for a VIRTIO_SCSI_T_AN_* request, tpg is not required, so vc.target is set to NULL in this branch. Later, in vhost_scsi_get_req(), vc->target is dereferenced without being checked, leading to a null pointer dereference bug. This bug can be triggered from guest. When this bug occurs, the vhost_worker process is killed while holding vq->mutex and the corresponding tpg will remain occupied indefinitely. Below is the KASAN report: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: xhci: Handle TD clearing for multiple streams case When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for each, to ensure everything is reset properly and the caches cleared. Change the logic so that any N>1 TDs found active for different streams are deferred until after the first one is processed, calling xhci_invalidate_cancelled_tds() again from xhci_handle_cmd_set_deq() to queue another command until we are done with all of them. Also change the error/"should never happen" paths to ensure we at least clear any affected TDs, even if we can't issue a command to clear the hardware cache, and complain loudly with an xhci_warn() if this ever happens. This problem case dates back to commit e9df17eb1408 ("USB: xhci: Correct assumptions about number of rings per endpoint.") early on in the XHCI driver's life, when stream support was first added. It was then identified but not fixed nor made into a warning in commit 674f8438c121 ("xhci: split handling halted endpoints into two steps"), which added a FIXME comment for the problem case (without materially changing the behavior as far as I can tell, though the new logic made the problem more obvious). Then later, in commit 94f339147fc3 ("xhci: Fix failure to give back some cached cancelled URBs."), it was acknowledged again. [Mathias: commit 94f339147fc3 ("xhci: Fix failure to give back some cached cancelled URBs.") was a targeted regression fix to the previously mentioned patch. Users reported issues with usb stuck after unmounting/disconnecting UAS devices. This rolled back the TD clearing of multiple streams to its original state.] Apparently the commit author was aware of the problem (yet still chose to submit it): It was still mentioned as a FIXME, an xhci_dbg() was added to log the problem condition, and the remaining issue was mentioned in the commit description. The choice of making the log type xhci_dbg() for what is, at this point, a completely unhandled and known broken condition is puzzling and unfortunate, as it guarantees that no actual users would see the log in production, thereby making it nigh undebuggable (indeed, even if you turn on DEBUG, the message doesn't really hint at there being a problem at all). It took me months of random xHC crashes to finally find a reliable repro and be able to do a deep dive debug session, which could all have been avoided had this unhandled, broken condition been actually reported with a warning, as it should have been as a bug intentionally left in unfixed (never mind that it shouldn't have been left in at all). > Another fix to solve clearing the caches of all stream rings with > cancelled TDs is needed, but not as urgent. 3 years after that statement and 14 years after the original bug was introduced, I think it's finally time to fix it. And maybe next time let's not leave bugs unfixed (that are actually worse than the original bug), and let's actually get people to review kernel commits please. Fixes xHC crashes and IOMMU faults with UAS devices when handling errors/faults. Easiest repro is to use hdparm to mark an early sector (e.g. 1024) on a disk as bad, then cat /dev/sdX > /dev/null in a loop. At least in the case of JMicron controllers, the read errors end up having to cancel two TDs (for two queued requests to different streams) and the one that didn't get cleared properly ends up faulting the xHC entirely when it tries to access DMA pages that have since been unmapped, referred to by the stale TDs. This normally happens quickly (after two or three loops). After this fix, I left the cat in a loop running overnight and experienced no xHC failures, with all read errors recovered…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmode should keep reference to parent The altmode device release refers to its parent device, but without keeping a reference to it. When registering the altmode, get a reference to the parent and put it in the release function. Before this fix, when using CONFIG_DEBUG_KOBJECT_RELEASE, we see issues like this: [ 43.572860] kobject: 'port0.0' (ffff8880057ba008): kobject_release, parent 0000000000000000 (delayed 3000) [ 43.573532] kobject: 'port0.1' (ffff8880057bd008): kobject_release, parent 0000000000000000 (delayed 1000) [ 43.574407] kobject: 'port0' (ffff8880057b9008): kobject_release, parent 0000000000000000 (delayed 3000) [ 43.575059] kobject: 'port1.0' (ffff8880057ca008): kobject_release, parent 0000000000000000 (delayed 4000) [ 43.575908] kobject: 'port1.1' (ffff8880057c9008): kobject_release, parent 0000000000000000 (delayed 4000) [ 43.576908] kobject: 'typec' (ffff8880062dbc00): kobject_release, parent 0000000000000000 (delayed 4000) [ 43.577769] kobject: 'port1' (ffff8880057bf008): kobject_release, parent 0000000000000000 (delayed 3000) [ 46.612867] ================================================================== [ 46.613402] BUG: KASAN: slab-use-after-free in typec_altmode_release+0x38/0x129 [ 46.614003] Read of size 8 at addr ffff8880057b9118 by task kworker/2:1/48 [ 46.614538] [ 46.614668] CPU: 2 UID: 0 PID: 48 Comm: kworker/2:1 Not tainted 6.12.0-rc1-00138-gedbae730ad31 #535 [ 46.615391] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 46.616042] Workqueue: events kobject_delayed_cleanup [ 46.616446] Call Trace: [ 46.616648] <TASK> [ 46.616820] dump_stack_lvl+0x5b/0x7c [ 46.617112] ? typec_altmode_release+0x38/0x129 [ 46.617470] print_report+0x14c/0x49e [ 46.617769] ? rcu_read_unlock_sched+0x56/0x69 [ 46.618117] ? __virt_addr_valid+0x19a/0x1ab [ 46.618456] ? kmem_cache_debug_flags+0xc/0x1d [ 46.618807] ? typec_altmode_release+0x38/0x129 [ 46.619161] kasan_report+0x8d/0xb4 [ 46.619447] ? typec_altmode_release+0x38/0x129 [ 46.619809] ? process_scheduled_works+0x3cb/0x85f [ 46.620185] typec_altmode_release+0x38/0x129 [ 46.620537] ? process_scheduled_works+0x3cb/0x85f [ 46.620907] device_release+0xaf/0xf2 [ 46.621206] kobject_delayed_cleanup+0x13b/0x17a [ 46.621584] process_scheduled_works+0x4f6/0x85f [ 46.621955] ? __pfx_process_scheduled_works+0x10/0x10 [ 46.622353] ? hlock_class+0x31/0x9a [ 46.622647] ? lock_acquired+0x361/0x3c3 [ 46.622956] ? move_linked_works+0x46/0x7d [ 46.623277] worker_thread+0x1ce/0x291 [ 46.623582] ? __kthread_parkme+0xc8/0xdf [ 46.623900] ? __pfx_worker_thread+0x10/0x10 [ 46.624236] kthread+0x17e/0x190 [ 46.624501] ? kthread+0xfb/0x190 [ 46.624756] ? __pfx_kthread+0x10/0x10 [ 46.625015] ret_from_fork+0x20/0x40 [ 46.625268] ? __pfx_kthread+0x10/0x10 [ 46.625532] ret_from_fork_asm+0x1a/0x30 [ 46.625805] </TASK> [ 46.625953] [ 46.626056] Allocated by task 678: [ 46.626287] kasan_save_stack+0x24/0x44 [ 46.626555] kasan_save_track+0x14/0x2d [ 46.626811] __kasan_kmalloc+0x3f/0x4d [ 46.627049] __kmalloc_noprof+0x1bf/0x1f0 [ 46.627362] typec_register_port+0x23/0x491 [ 46.627698] cros_typec_probe+0x634/0xbb6 [ 46.628026] platform_probe+0x47/0x8c [ 46.628311] really_probe+0x20a/0x47d [ 46.628605] device_driver_attach+0x39/0x72 [ 46.628940] bind_store+0x87/0xd7 [ 46.629213] kernfs_fop_write_iter+0x1aa/0x218 [ 46.629574] vfs_write+0x1d6/0x29b [ 46.629856] ksys_write+0xcd/0x13b [ 46.630128] do_syscall_64+0xd4/0x139 [ 46.630420] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 46.630820] [ 46.630946] Freed by task 48: [ 46.631182] kasan_save_stack+0x24/0x44 [ …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() Since '__dev_queue_xmit()' should be called with interrupts enabled, the following backtrace: ieee80211_do_stop() ... spin_lock_irqsave(&local->queue_stop_reason_lock, flags) ... ieee80211_free_txskb() ieee80211_report_used_skb() ieee80211_report_ack_skb() cfg80211_mgmt_tx_status_ext() nl80211_frame_tx_status() genlmsg_multicast_netns() genlmsg_multicast_netns_filtered() nlmsg_multicast_filtered() netlink_broadcast_filtered() do_one_broadcast() netlink_broadcast_deliver() __netlink_sendskb() netlink_deliver_tap() __netlink_deliver_tap_skb() dev_queue_xmit() __dev_queue_xmit() ; with IRQS disabled ... spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags) issues the warning (as reported by syzbot reproducer): WARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120 Fix this by implementing a two-phase skb reclamation in 'ieee80211_do_stop()', where actual work is performed outside of a section with interrupts disabled.(CVE-2024-47713)

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix helper writes to read-only maps Lonial found an issue that despite user- and BPF-side frozen BPF map (like in case of .rodata), it was still possible to write into it from a BPF program side through specific helpers having ARG_PTR_TO_{LONG,INT} as arguments. In check_func_arg() when the argument is as mentioned, the meta->raw_mode is never set. Later, check_helper_mem_access(), under the case of PTR_TO_MAP_VALUE as register base type, it assumes BPF_READ for the subsequent call to check_map_access_type() and given the BPF map is read-only it succeeds. The helpers really need to be annotated as ARG_PTR_TO_{LONG,INT} | MEM_UNINIT when results are written into them as opposed to read out of them. The latter indicates that it's okay to pass a pointer to uninitialized memory as the memory is written to anyway. However, ARG_PTR_TO_{LONG,INT} is a special case of ARG_PTR_TO_FIXED_SIZE_MEM just with additional alignment requirement. So it is better to just get rid of the ARG_PTR_TO_{LONG,INT} special cases altogether and reuse the fixed size memory types. For this, add MEM_ALIGNED to additionally ensure alignment given these helpers write directly into the args via <ptr> = val. The .arg_size has been initialized reflecting the actual sizeof(*<ptr>). MEM_ALIGNED can only be used in combination with MEM_FIXED_SIZE annotated argument types, since in !MEM_FIXED_SIZE cases the verifier does not know the buffer size a priori and therefore cannot blindly write *<ptr> = val.(CVE-2024-49861)

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointer before try to access it [why & how] Change the order of the pipe_ctx->plane_state check to ensure that plane_state is not null before accessing it.(CVE-2024-49906)

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags [WHAT & HOW] "dcn20_validate_apply_pipe_split_flags" dereferences merge, and thus it cannot be a null pointer. Let's pass a valid pointer to avoid null dereference. This fixes 2 FORWARD_NULL issues reported by Coverity.(CVE-2024-49923)

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Fix zero-division error when disabling tc cbs The commit b8c43360f6e4 ("net: stmmac: No need to calculate speed divider when offload is disabled") allows the "port_transmit_rate_kbps" to be set to a value of 0, which is then passed to the "div_s64" function when tc-cbs is disabled.…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: xhci: Handle TD clearing for multiple streams case When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for each, to ensure everything is reset properly and the caches cleared. Change the logic so that any N>1 TDs found active for different streams are deferred until after the first one is processed, calling xhci_invalidate_cancelled_tds() again from xhci_handle_cmd_set_deq() to queue another command until we are done with all of them. Also change the error/"should never happen" paths to ensure we at least clear any affected TDs, even if we can't issue a command to clear the hardware cache, and complain loudly with an xhci_warn() if this ever happens. This problem case dates back to commit e9df17eb1408 ("USB: xhci: Correct assumptions about number of rings per endpoint.") early on in the XHCI driver's life, when stream support was first added. It was then identified but not fixed nor made into a warning in commit 674f8438c121 ("xhci: split handling halted endpoints into two steps"), which added a FIXME comment for the problem case (without materially changing the behavior as far as I can tell, though the new logic made the problem more obvious). Then later, in commit 94f339147fc3 ("xhci: Fix failure to give back some cached cancelled URBs."), it was acknowledged again. [Mathias: commit 94f339147fc3 ("xhci: Fix failure to give back some cached cancelled URBs.") was a targeted regression fix to the previously mentioned patch. Users reported issues with usb stuck after unmounting/disconnecting UAS devices. This rolled back the TD clearing of multiple streams to its original state.] Apparently the commit author was aware of the problem (yet still chose to submit it): It was still mentioned as a FIXME, an xhci_dbg() was added to log the problem condition, and the remaining issue was mentioned in the commit description. The choice of making the log type xhci_dbg() for what is, at this point, a completely unhandled and known broken condition is puzzling and unfortunate, as it guarantees that no actual users would see the log in production, thereby making it nigh undebuggable (indeed, even if you turn on DEBUG, the message doesn't really hint at there being a problem at all). It took me months of random xHC crashes to finally find a reliable repro and be able to do a deep dive debug session, which could all have been avoided had this unhandled, broken condition been actually reported with a warning, as it should have been as a bug intentionally left in unfixed (never mind that it shouldn't have been left in at all). > Another fix to solve clearing the caches of all stream rings with > cancelled TDs is needed, but not as urgent. 3 years after that statement and 14 years after the original bug was introduced, I think it's finally time to fix it. And maybe next time let's not leave bugs unfixed (that are actually worse than the original bug), and let's actually get people to review kernel commits please. Fixes xHC crashes and IOMMU faults with UAS devices when handling errors/faults. Easiest repro is to use hdparm to mark an early sector (e.g. 1024) on a disk as bad, then cat /dev/sdX > /dev/null in a loop. At least in the case of JMicron controllers, the read errors end up having to cancel two TDs (for two queued requests to different streams) and the one that didn't get cleared properly ends up faulting the xHC entirely when it tries to access DMA pages that have since been unmapped, referred to by the stale TDs. This normally happens quickly (after two or three loops). After this fix, I left the cat in a loop running overnight and experienced no xHC failures, with all read errors recovered…

In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_edgeport: fix use after free in debug printk The "dev_dbg(&urb->dev->dev, ..." which happens after usb_free_urb(urb) is a use after free of the "urb" pointer. Store the "dev" pointer at the start of the function to avoid this issue.

• HID: core: zero-initialize the report buffer {CVE-2024-50302}
• Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()"
• drm/amd/amdgpu: Fix GPR read from debugfs (v2) {CVE-2024-50282}
• USB: serial: io_edgeport: fix use after free in debug printk {CVE-2024-50267}
• wifi: iwlegacy: Clear stale interrupts before resuming device {CVE-2024-50234}
• udf: fix uninit-value use in udf_get_fileshortad {CVE-2024-50143}
• Update dependency for shim and signing key

• CVE-url: https://ubuntu.com/security/CVE-2024-50180
  • fbdev: sisfb: Fix strbuf array overflow
• CVE-url: https://ubuntu.com/security/CVE-2023-52522
  • net: fix possible store tearing in neigh_periodic_work()
• CVE-url: https://ubuntu.com/security/CVE-2024-40911
  • wifi: cfg80211: Lock wiphy in cfg80211_get_station
• CVE-url: https://ubuntu.com/security/CVE-2024-43863
  • drm/vmwgfx: Fix a deadlock in dma buf fence polling
• CVE-url: https://ubuntu.com/security/CVE-2024-44931
  • gpio: prevent potential speculation leaks in gpio_device_get_desc()
• CVE-url: https://ubuntu.com/security/CVE-2024-23848
  • media: cec: cec-api: add locking in cec_release()
  • media: cec: core: avoid recursive cec_claim_log_addrs
• CVE-url: https://ubuntu.com/security/CVE-2024-50229
  • nilfs2: fix potential deadlock with newly created symlinks
• CVE-url: https://ubuntu.com/security/CVE-2024-50171
  • net: systemport: fix potential memory leak in bcm_sysport_xmit()
• CVE-url: https://ubuntu.com/security/CVE-2024-50233
  • staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
• CVE-url: https://ubuntu.com/security/CVE-2024-50134
  • drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
• CVE-url: https://ubuntu.com/security/CVE-2024-44938
  • jfs: Fix shift-out-of-bounds in dbDiscardAG
• CVE-url: https://ubuntu.com/security/CVE-2024-50117
  • drm/amd: Guard against bad data for ATIF ACPI method
• CVE-url: https://ubuntu.com/security/CVE-2024-49902
  • jfs: check if leafidx greater than num leaves per dmap tree
• CVE-url: https://ubuntu.com/security/CVE-2023-52799
  • jfs: fix array-index-out-of-bounds in dbFindLeaf
• CVE-url: https://ubuntu.com/security/CVE-2024-49966
  • ocfs2: cancel dqi_sync_work before freeing oinfo
• CVE-url: https://ubuntu.com/security/CVE-2024-50267
  • USB: serial: io_edgeport: fix use after free in debug printk
• CVE-url: https://ubuntu.com/security/CVE-2024-50230
  • nilfs2: fix kernel bug due to missing clearing of checked flag
• CVE-url: https://ubuntu.com/security/CVE-2024-50302
  • HID: core: zero-initialize the report buffer
• CVE-url: https://ubuntu.com/security/CVE-2024-50278
  • dm cache: fix out-of-bounds access to the dirty bitset when resizing
  • dm cache: fix potential out-of-bounds access on the first resume
• CVE-url: https://ubuntu.com/security/CVE-2024-50234
  • wifi: iwlegacy: Clear stale interrupts before resuming device
• CVE-url: https://ubuntu.com/security/CVE-2024-50301
  • security/keys: fix slab-out-of-bounds in key_task_permission
• CVE-url: https://ubuntu.com/security/CVE-2024-50143
  • overflow: Add _must_check attribute to check*() helpers
  • compiler.h: drop fallback overflow checkers
  • overflow: Allow mixed type arguments
  • udf: fix uninit-value use in udf_get_fileshortad
• CVE-url: https://ubuntu.com/security/CVE-2024-53061
  • media: s5p-jpeg: prevent buffer overflows
• CVE-url: https://ubuntu.com/security/CVE-2024-57798
  • drm/dp-mst-helper: Remove hotplug callback
  • drm/dp_mst: Remove huge conditional in drm_dp_mst_handle_up_req()
  • drm/dp_mst: Refactor drm_dp_mst_handle_up_req()
  • drm/dp_mst: Rename drm_dp_add_port and drm_dp_update_port
  • drm/dp_mst: Handle UP requests asynchronously
  • drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()
• CVE-url: https://ubuntu.com/security/CVE-2023-52854
  • padata: make padata_do_parallel find alternate callback CPU
  • padata: allocate workqueue internally
  • crypto: pcrypt - remove padata cpumask notifier
  • padata, pcrypt: take CPU hotplug lock internally in padata_alloc_possible
  • padata: use separate workqueues for parallel and serial work
  • padata: unbind parallel jobs from specific CPUs
  • workqueue: Make…

• CVE-url: https://ubuntu.com/security/CVE-2023-52522
  • net: fix possible store tearing in neigh_periodic_work()
• CVE-url: https://ubuntu.com/security/CVE-2024-40911
  • wifi: cfg80211: Lock wiphy in cfg80211_get_station
• CVE-url: https://ubuntu.com/security/CVE-2024-43863
  • drm/vmwgfx: Fix a deadlock in dma buf fence polling
• CVE-url: https://ubuntu.com/security/CVE-2024-44931
  • gpio: prevent potential speculation leaks in gpio_device_get_desc()
• CVE-url: https://ubuntu.com/security/CVE-2024-50229
  • nilfs2: fix potential deadlock with newly created symlinks
• CVE-url: https://ubuntu.com/security/CVE-2024-50171
  • net: systemport: fix potential memory leak in bcm_sysport_xmit()
• CVE-url: https://ubuntu.com/security/CVE-2024-50233
  • staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
• CVE-url: https://ubuntu.com/security/CVE-2024-44938
  • jfs: Fix shift-out-of-bounds in dbDiscardAG
• CVE-url: https://ubuntu.com/security/CVE-2024-50117
  • drm/amd: Guard against bad data for ATIF ACPI method
• CVE-url: https://ubuntu.com/security/CVE-2024-49902
  • jfs: check if leafidx greater than num leaves per dmap tree
• CVE-url: https://ubuntu.com/security/CVE-2023-52799
  • jfs: fix array-index-out-of-bounds in dbFindLeaf
• CVE-url: https://ubuntu.com/security/CVE-2024-41063
  • Bluetooth: fix power_on vs close race
  • Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
• CVE-url: https://ubuntu.com/security/CVE-2024-50267
  • USB: serial: io_edgeport: fix use after free in debug printk
• CVE-url: https://ubuntu.com/security/CVE-2024-50230
  • nilfs2: fix kernel bug due to missing clearing of checked flag
• CVE-url: https://ubuntu.com/security/CVE-2024-50302
  • HID: core: zero-initialize the report buffer
• CVE-url: https://ubuntu.com/security/CVE-2024-50180
  • fbdev: sisfb: Fix strbuf array overflow
• CVE-url: https://ubuntu.com/security/CVE-2024-50278
  • dm cache: fix out-of-bounds access to the dirty bitset when resizing
  • dm cache: fix potential out-of-bounds access on the first resume
• CVE-url: https://ubuntu.com/security/CVE-2024-50234
  • wifi: iwlegacy: Clear stale interrupts before resuming device
• CVE-url: https://ubuntu.com/security/CVE-2024-50301
  • security/keys: fix slab-out-of-bounds in key_task_permission
• CVE-url: https://ubuntu.com/security/CVE-2024-50143
  • overflow: Add _must_check attribute to check*() helpers
  • compiler.h: drop fallback overflow checkers
  • overflow: Allow mixed type arguments
  • udf: fix uninit-value use in udf_get_fileshortad
• Bionic update: upstream stable patchset 2020-11-10 (LP: #1903768) // CVE- url: https://ubuntu.com/security/CVE-2024-50143
  • overflow: Include header file with SIZE_MAX declaration
• Bionic update: upstream stable patchset 2020-09-16 (LP: #1895873) // CVE- url: https://ubuntu.com/security/CVE-2024-50143
  • overflow.h: Add allocation size calculation helpers
• Bionic update: upstream stable patchset 2020-05-07 (LP: #1877461) // CVE- url: https://ubuntu.com/security/CVE-2024-50143
  • overflow.h: Add arithmetic shift helper
• CVE-url: https://ubuntu.com/security/CVE-2024-53061
  • media: s5p-jpeg: prevent buffer overflows
• CVE-url: https://ubuntu.com/security/CVE-2024-47809
  • dlm: fix possible lkb_resource null dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-41020
  • filelock: Fix fcntl/close race recovery compat path
• CVE-url: https://ubuntu.com/security/CVE-2024-43892
  • memcg: protect concurrent access to mem_cgroup_idr
• CVE-url: https://ubuntu.com/security/CVE-2021-47379
  • blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd
• CVE-url: https://ubuntu.com/security/CVE-2024-53239
  • ALSA: 6fire: Release resources at card release
• CVE-url:…

• HID: core: zero-initialize the report buffer {CVE-2024-50302}
• Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()"
• drm/amd/amdgpu: Fix GPR read from debugfs (v2) {CVE-2024-50282}
• USB: serial: io_edgeport: fix use after free in debug printk {CVE-2024-50267}
• wifi: iwlegacy: Clear stale interrupts before resuming device {CVE-2024-50234}
• udf: fix uninit-value use in udf_get_fileshortad {CVE-2024-50143}
• Update dependency for shim and signing key

• net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
• smb: client: fix potential deadlock when releasing mids {CVE-2023-52757}
• tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). {CVE-2024-50154}
• ALSA: 6fire: Release resources at card release {CVE-2024-53239}
• smb: client: fix use-after-free of signing key {CVE-2024-53179}
• tun: avoid double free in tun_free_netdev {CVE-2022-4744}
• Revert "tun: call dev_get_valid_name() before register_netdevice()" {CVE-2022-4744}
• USB: serial: io_edgeport: fix use after free in debug printk {CVE-2024-50267}
• igb: Fix use-after-free error during reset {CVE-2021-47301}
• HID: core: zero-initialize the report buffer {CVE-2024-50302}
• usb: musb: sunxi: Fix accessing an released usb phy {CVE-2024-50269}
• dm cache: fix potential out-of-bounds access on the first resume {CVE-2024-50278}
• dm cache: fix out-of-bounds access to the dirty bitset when resizing {CVE-2024-50278}
• wifi: iwlegacy: Clear stale interrupts before resuming device {CVE-2024-50234}
• security/keys: fix slab-out-of-bounds in key_task_permission {CVE-2024-50301}
• udf: fix uninit-value use in udf_get_fileshortad {CVE-2024-50143}
• overflow: Allow mixed type arguments {CVE-2024-50143}
• compiler.h: drop fallback overflow checkers {CVE-2024-50143}
• overflow: Add _must_check attribute to check*() helpers {CVE-2024-50143}
• media: s5p-jpeg: prevent buffer overflows {CVE-2024-53061}
• mptcp: fix double-free on socket dismantle {CVE-2024-26782}
• drm/amdgpu: fix usage slab after free {CVE-2024-56551}
• bpf: fix OOB devmap writes when deleting elements {CVE-2024-56615}
• uprobe: avoid out-of-bounds memory access of fetching args {CVE-2024-50067}

• net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
• smb: client: fix potential deadlock when releasing mids {CVE-2023-52757}
• tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). {CVE-2024-50154}
• ALSA: 6fire: Release resources at card release {CVE-2024-53239}
• smb: client: fix use-after-free of signing key {CVE-2024-53179}
• inet_connection_sock: remove unused parameter of reqsk_queue_unlink func {CVE-2024-50154}
• tun: avoid double free in tun_free_netdev {CVE-2022-4744}
• USB: serial: io_edgeport: fix use after free in debug printk {CVE-2024-50267}
• igb: Fix use-after-free error during reset {CVE-2021-47301}
• HID: core: zero-initialize the report buffer {CVE-2024-50302}
• usb: musb: sunxi: Fix accessing an released usb phy {CVE-2024-50269}
• dm cache: fix potential out-of-bounds access on the first resume {CVE-2024-50278}
• dm cache: fix out-of-bounds access to the dirty bitset when resizing {CVE-2024-50278}
• wifi: iwlegacy: Clear stale interrupts before resuming device {CVE-2024-50234}
• security/keys: fix slab-out-of-bounds in key_task_permission {CVE-2024-50301}
• udf: fix uninit-value use in udf_get_fileshortad {CVE-2024-50143}
• overflow: Allow mixed type arguments {CVE-2024-50143}
• compiler.h: drop fallback overflow checkers {CVE-2024-50143}
• overflow: Add _must_check attribute to check*() helpers {CVE-2024-50143}
• media: s5p-jpeg: prevent buffer overflows {CVE-2024-53061}
• mptcp: fix double-free on socket dismantle {CVE-2024-26782}
• drm/amdgpu: fix usage slab after free {CVE-2024-56551}
• bpf: fix OOB devmap writes when deleting elements {CVE-2024-56615}
• uprobe: avoid out-of-bounds memory access of fetching args {CVE-2024-50067}

• USB: serial: io_edgeport: fix use after free in debug printk {CVE-2024-50267}
• HID: core: zero-initialize the report buffer {CVE-2024-50302}
• dm cache: fix potential out-of-bounds access on the first resume {CVE-2024-50278}
• dm cache: fix out-of-bounds access to the dirty bitset when resizing {CVE-2024-50278}
• wifi: iwlegacy: Clear stale interrupts before resuming device {CVE-2024-50234}
• security/keys: fix slab-out-of-bounds in key_task_permission {CVE-2024-50301}
• udf: fix uninit-value use in udf_get_fileshortad {CVE-2024-50143}
• overflow: Allow mixed type arguments {CVE-2024-50143}
• compiler.h: drop fallback overflow checkers {CVE-2024-50143}
• overflow: Add _must_check attribute to check*() helpers {CVE-2024-50143}
• mptcp: fix double-free on socket dismantle {CVE-2024-26782}
• drm/amdgpu: fix usage slab after free {CVE-2024-56551}
• drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() {CVE-2024-57798}
• drm/dp_mst: Skip CSN if topology probing is not done yet {CVE-2024-57798}

• HID: core: zero-initialize the report buffer {CVE-2024-50302}
• net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
• bus: mhi: host: Add alignment check for event ring read pointer {CVE-2023-52494}
• net: sched: fix ets qdisc OOB Indexing {CVE-2025-21692}
• parport: Proper fix for array out-of-bounds access {CVE-2024-50074}
• udf: fix uninit-value use in udf_get_fileshortad {CVE-2024-50143}
• security/keys: fix slab-out-of-bounds in key_task_permission {CVE-2024-50301}
• usb: typec: altmode should keep reference to parent {CVE-2024-50150}
• dm cache: fix potential out-of-bounds access on the first resume {CVE-2024-50278}
• dm cache: optimize dirty bit checking with find_next_bit when resizing {CVE-2024-50278}
• dm cache: fix out-of-bounds access to the dirty bitset when resizing {CVE-2024-50279}
• spi: nxp-fspi: fix the KASAN report out-of-bounds bug {CVE-2024-46853}
• smb: client: fix OOBs when building SMB2_IOCTL request {CVE-2024-50151}
• net: sched: fix use-after-free in taprio_change() {CVE-2024-50127}
• USB: serial: io_edgeport: fix use after free in debug printk {CVE-2024-50267}
• wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() {CVE-2024-53059}
• wifi: iwlwifi: mvm: disconnect station vifs if recovery failed {CVE-2024-53059}
• tracing: Consider the NULL character when validating the event length {CVE-2024-50131}
• crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612}
• NFSD: fix hang in nfsd4_shutdown_callback {CVE-2025-21795}
• NFSD: add courteous server support for thread with only delegation {CVE-2025-21795}
• mptcp: refactor passive socket initialization {CVE-2024-26782}
• mptcp: implement delayed seq generation for passive fastopen {CVE-2024-26782}
• smb: client: fix potential UAF in smb2_is_valid_lease_break() {CVE-2024-35864}
• smb: client: fix potential UAF in cifs_dump_full_key() {CVE-2024-35866}
• cifs: fix session state check in reconnect to avoid use-after-free issue {CVE-2024-35866}
• smb: client: fix potential UAF in smb2_is_network_name_deleted() {CVE-2024-35862}
• smb: client: fix potential UAF in is_valid_oplock_break() {CVE-2024-35863}
• smb: client: fix potential UAF in cifs_stats_proc_show() {CVE-2024-35867}
• bpf: Protect against int overflow for stack access size {CVE-2024-35905}
• bpf: Fix verification of indirect var-off stack access {CVE-2024-35905}
• devlink: fix possible use-after-free and memory leaks in devlink_init() {CVE-2024-26734}
• leds: trigger: Unregister sysfs attributes before calling deactivate() {CVE-2024-43830}
• ionic: fix use after netif_napi_del() {CVE-2024-39502}
• ionic: clean interrupt before enabling queue to avoid credit race {CVE-2024-39502}
• net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink {CVE-2024-44970}
• vt_ioctl: fix array_index_nospec in vt_setactivate {CVE-2022-48804}
• hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() {CVE-2022-49011}
• raid1: fix use-after-free for original bio in raid1_write_request() {CVE-2024-35979}
• md/raid1: free the r1bio before waiting for blocked rdev {CVE-2024-35979}
• drm/amdgpu: fix usage slab after free {CVE-2024-56551}
• drm/amd: Use amdgpu_ucode_* helpers for GPU info bin {CVE-2024-56551}
• drm/amd: Add a new helper for loading/validating microcode {CVE-2024-56551}
• drm/amd: check num of link levels when update pcie param {CVE-2023-52812}
• drm/amd: Update update_pcie_parameters functions to use uint8_t arguments {CVE-2023-52812}
• drm/amd: Disable PP_PCIE_DPM_MASK when dynamic speed switching not supported {CVE-2023-52812}
• drm/amd: Fix logic error in sienna_cichlid_update_pcie_parameters() {CVE-2023-52812}
• drm/amd: Use amdgpu_device_pcie_dynamic_switching_supported() for SMU7 {CVE-2023-52812}
• drm/amd: Align SMU11 SMU_MSG_OverridePcieParameters implementation with SMU13 {CVE-2023-52812}
• drm/amd/pm: conditionally disable pcie lane switching for some sienna_cichlid SKUs {CVE-2023-52812}
• drm/amd: Move helper for dynamic speed switch check out…

• sctp: sysctl: auth_enable: avoid using current->nsproxy
• sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy {CVE-2025-21640}
• bpf: Use preempt_count() directly in bpf_send_signal_common()
• Revert "sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy"
• jfs: fix slab-out-of-bounds read in ea_get()
• serial: 8250_dma: terminate correct DMA in tx_dma_flush()
• Revert "sctp: sysctl: auth_enable: avoid using current->nsproxy"
• net: usb: usbnet: restore usb%d name exception for local mac addresses
• vlan: fix memory leak in vlan_newlink() {CVE-2022-49636}
• rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity
• LTS tag: v5.4.291
• eeprom: digsy_mtc: Make GPIO lookup table match the device
• slimbus: messaging: Free transaction ID in delayed interrupt scenario {CVE-2025-21914}
• intel_th: pci: Add Panther Lake-P/U support
• intel_th: pci: Add Panther Lake-H support
• intel_th: pci: Add Arrow Lake support
• Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
• xhci: pci: Fix indentation in the PCI device ID definitions
• usb: gadget: Check bmAttributes only if configuration is valid
• usb: gadget: Fix setting self-powered state on suspend
• usb: gadget: Set self-powered based on MaxPower and bmAttributes
• usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality
• usb: typec: ucsi: increase timeout for PPM reset operations
• usb: atm: cxacru: fix a flaw in existing endpoint checks {CVE-2025-21916}
• usb: renesas_usbhs: Flush the notify_hotplug_work {CVE-2025-21917}
• usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader
• usb: renesas_usbhs: Use devm_usb_get_phy()
• usb: renesas_usbhs: Call clk_put()
• Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"
• gpio: rcar: Fix missing of_node_put() call
• net: ipv6: fix missing dst ref drop in ila lwtunnel
• net: ipv6: fix dst ref loop in ila lwtunnel
• net-timestamp: support TCP GSO case for a few missing flags
• vlan: enforce underlying device type {CVE-2025-21920}
• ppp: Fix KMSAN uninit-value warning with bpf {CVE-2025-21922}
• be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
• drm/sched: Fix preprocessor guard
• hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()
• llc: do not use skb_get() before dev_queue_xmit() {CVE-2025-21925}
• hwmon: (ad7314) Validate leading zero bits and return error
• hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
• hwmon: (pmbus) Initialise page count in pmbus_identify()
• caif_virtio: fix wrong pointer check in cfv_probe() {CVE-2025-21904}
• net: gso: fix ownership in __udp_gso_segment {CVE-2025-21926}
• HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
• HID: google: fix unused variable warning under !CONFIG_ACPI
• wifi: iwlwifi: limit printed string from FW file {CVE-2025-21905}
• mm/page_alloc: fix uninitialized variable
• rapidio: fix an API misues when rio_add_net() fails {CVE-2025-21934}
• rapidio: add check for rio_add_net() in rio_scan_alloc_net()
• wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
• wifi: cfg80211: regulatory: improve invalid hints checking {CVE-2025-21910}
• x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
• x86/cpu: Validate CPUID leaf 0x2 EDX output
• x86/cacheinfo: Validate CPUID leaf 0x2 EDX output
• platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
• drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
• ALSA: hda/realtek: update ALC222 depop optimize
• ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
• HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
• Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'"
• drm/amdgpu: disable BAR resize on Dell G5 SE
• drm/amdgpu: Check extended configuration space register when system uses large bar
• drm/amdgpu: skip BAR resizing if the bios already…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070)
• CVE-2024-50205: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (bsc#1233293).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233453).
• CVE-2024-50267: USB: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).
• CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).
• CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).

The following non-security bugs were fixed:

• Update config files (bsc#1218644).
• e1000e: Correct NVM checksum verification flow (jsc#SLE-8100).
• e1000e: Correct NVM checksum verification flow (jsc#SLE-8100).
• e1000e: Do not take care about recovery NVM checksum (jsc#SLE-8100).
• e1000e: Do not take care about recovery NVM checksum (jsc#SLE-8100).
• ena: Remove rcu_read_lock() around XDP program invocation (bsc#1198778).
• ethernet: amazon: ena: A typo fix in the file ena_com.h (bsc#1198778).
• initramfs: avoid filename buffer overrun (bsc#1232436).
• kernel-binary: Enable livepatch package only when livepatch is enabled Otherwise the filelist may be empty failing the build (bsc#1218644).
• net: ena: Add capabilities field with support for ENI stats capability (bsc#1198778).
• net: ena: Add debug prints for invalid req_id resets (bsc#1198778).
• net: ena: Change ENI stats support check to use capabilities field (bsc#1198778).
• net: ena: Change return value of ena_calc_io_queue_size() to void (bsc#1198778).
• net: ena: Change the name of bad_csum variable (bsc#1198778).
• net: ena: Extract recurring driver reset code into a function (bsc#1198778).
• net: ena: Flush XDP packets on error (bsc#1198778).
• net: ena: Improve error logging in driver (bsc#1198778).
• net: ena: Move reset completion print to the reset function (bsc#1198778).
• net: ena: Remove ena_calc_queue_size_ctx struct (bsc#1198778).
• net: ena: Remove module param and change message severity (bsc#1198778).
• net: ena: Remove redundant return code check (bsc#1198778).
• net: ena: Remove unused code (bsc#1198778).
• net: ena: Set tx_info->xdpf value to NULL (bsc#1198778).
• net: ena: Update XDP verdict upon failure (bsc#1198778).
• net: ena: Use bitmask to indicate packet redirection (bsc#1198778).
• net: ena: Use dev_alloc() in RX buffer allocation (bsc#1198778).
• net: ena: add device distinct log prefix to files (bsc#1198778).
• net: ena: add jiffies of last napi call to stats (bsc#1198778).
• net: ena: aggregate doorbell common operations into a function (bsc#1198778).
• net: ena: aggregate stats increase into a function (bsc#1198778).
• net: ena: fix DMA mapping function issues in XDP (bsc#1198778).
• net: ena: fix coding style nits (bsc#1198778).
• net: ena: fix inaccurate print type (bsc#1198778).
• net: ena: introduce XDP redirect…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-47703: bpf, lsm: add check for BPF LSM return value (bsc#1231946).
• CVE-2024-49852: scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del() (bsc#1232819).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49881: ext4: update orig_path in ext4_find_extent() (bsc#1232201).
• CVE-2024-49883: ext4: aovid use-after-free in ext4_ext_insert_extent() (bsc#1232199).
• CVE-2024-49894: drm/amd/display: Fix index out of bounds in degamma hardware format translation (bsc#1232354).
• CVE-2024-49895: drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation (bsc#1232352).
• CVE-2024-49897: drm/amd/display: Check phantom_stream before it is used (bsc#1232355).
• CVE-2024-49899: drm/amd/display: Initialize denominators' default to 1 (bsc#1232358).
• CVE-2024-49901: drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs (bsc#1232305).
• CVE-2024-49909: drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func (bsc#1232337).
• CVE-2024-49911: drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func (bsc#1232366).
• CVE-2024-49912: drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream' (bsc#1232367).
• CVE-2024-49913: drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream (bsc#1232307).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49922:…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
• CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
• CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-47745: mm: call the security_mmap_file() LSM hook in remap_file_pages() (bsc#1232135).
• CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49934: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (bsc#1232387).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
• CVE-2024-49968: ext4: filesystems without casefold feature cannot be mounted with siphash (bsc#1232264).
• CVE-2024-49983: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (bsc#1232096).
• CVE-2024-49989: drm/amd/display: fix double free issue during amdgpu module unload (bsc#1232483).
• CVE-2024-50009: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (bsc#1232318).
• CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
• CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50093: thermal: intel: int340x: processor: Fix warning during module unload (bsc#1232877).
• CVE-2024-50098: scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down (bsc#1232881).
• CVE-2024-50108: drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too (bsc#1232884).
• CVE-2024-50110: xfrm: fix one more kernel-infoleak in algo dumping (bsc#1232885).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-47703: bpf, lsm: add check for BPF LSM return value (bsc#1231946).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49888: bpf: Fix a sdiv overflow issue (bsc#1232208).
• CVE-2024-49899: drm/amd/display: Initialize denominators' default to 1 (bsc#1232358).
• CVE-2024-49911: drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func (bsc#1232366).
• CVE-2024-49912: drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream' (bsc#1232367).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49922: drm/amd/display: Check null pointers before using them (bsc#1232374).
• CVE-2024-49923: drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags (bsc#1232361).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49933: blk_iocost: fix more out of bound shifts (bsc#1232368).
• CVE-2024-49934: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (bsc#1232387).
• CVE-2024-49944: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start (bsc#1232166).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
• CVE-2024-49968: ext4: filesystems without casefold feature cannot be mounted with siphash (bsc#1232264).
• CVE-2024-49983:…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52524: net: nfc: llcp: Add lock when modifying device list (bsc#1220927).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50205: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (bsc#1233293).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233453).
• CVE-2024-50267: usb: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).
• CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).
• CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).

The following non-security bugs were fixed:

• e1000e: Correct NVM checksum verification flow (jsc#SLE-8100).
• e1000e: Do not take care about recovery NVM checksum (jsc#SLE-8100).
• ena: Remove rcu_read_lock() around XDP program invocation (bsc#1198778).
• ethernet: amazon: ena: A typo fix in the file ena_com.h (bsc#1198778).
• initramfs: avoid filename buffer overrun (bsc#1232436).
• kernel-binary: Enable livepatch package only when livepatch is enabled (bsc#1218644).
• net: ena: Add capabilities field with support for ENI stats capability (bsc#1198778).
• net: ena: Add debug prints for invalid req_id resets (bsc#1198778).
• net: ena: Change ENI stats support check to use capabilities field (bsc#1198778).
• net: ena: Change return value of ena_calc_io_queue_size() to void (bsc#1198778).
• net: ena: Change the name of bad_csum variable (bsc#1198778).
• net: ena: Extract recurring driver reset code into a function (bsc#1198778).
• net: ena: Flush XDP packets on error (bsc#1198778).
• net: ena: Improve error logging in driver (bsc#1198778).
• net: ena: Move reset completion print to the reset function (bsc#1198778).
• net: ena: Remove ena_calc_queue_size_ctx struct (bsc#1198778).
• net: ena: Remove module param and change message severity (bsc#1198778).
• net: ena: Remove redundant return code check (bsc#1198778).
• net: ena: Remove unused code (bsc#1198778).
• net: ena: Set tx_info->xdpf value to NULL (bsc#1198778).
• net: ena: Update XDP verdict upon failure (bsc#1198778).
• net: ena: Use bitmask to indicate packet redirection (bsc#1198778).
• net: ena: Use dev_alloc() in RX buffer allocation (bsc#1198778).
• net: ena: add device distinct log prefix to files (bsc#1198778).
• net: ena: add jiffies of last napi call to stats (bsc#1198778).
• net: ena: aggregate doorbell common operations into a function (bsc#1198778).
• net: ena: aggregate stats increase into a function (bsc#1198778).
• net: ena: fix DMA mapping function issues in XDP (bsc#1198778).
• net: ena: fix coding style nits (bsc#1198778).
• net: ena: fix inaccurate print type (bsc#1198778).
• net: ena: introduce XDP redirect implementation (bsc#1198778).
• net: ena: introduce ndo_xdp_xmit() function for XDP_REDIRECT (bsc#1198778).
• net: ena: make symbol 'ena_alloc_map_page' static (bsc#1198778).
• net: ena: re-organize code to improve…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-53095: smb: client: Fix use-after-free of network namespace (bsc#1233642).
• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2023-6270: aoe: fix the potential use-after-free problem in more places (bsc#1218562).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46828: sched: sch_cake: fix bulk flow accounting logic for host fairness (bsc#1231114).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50205: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (bsc#1233293).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
• CVE-2024-50259: netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() (bsc#1233214).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233453).
• CVE-2024-50267: usb: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).
• CVE-2024-50274: idpf: avoid vport access in idpf_get_link_ksettings (bsc#1233463).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).
• CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).
• CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).
• CVE-2024-53068: firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() (bsc#1233561).

The following non-security bugs were fixed:

• Update config files (bsc#1218644).
• Update config files. Enabled IDPF for ARM64 (bsc#1221309)
• initramfs: avoid filename buffer overrun (bsc#1232436).
• kernel-binary: Enable livepatch package only when livepatch is enabled Otherwise the filelist may be empty failing the build (bsc#1218644).
• mm/memory: add non-anonymous page check in the copy_present_page() (bsc#1231646).
• rpm/scripts: Remove obsolete Symbols.list Symbols.list is not longer needed by the new klp-convert implementation. (bsc#1218644)
• x86/kexec: Add EFI config table identity mapping for kexec kernel (bsc#1220382).
• x86/mm/ident_map: Use gbpages only where full GB page should be mapped (bsc#1220382).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
• CVE-2024-50154: tcp: Fix use-after-free of nreq in reqsk_timer_handler() (bsc#1233070).
• CVE-2024-50205: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (bsc#1233293).
• CVE-2024-50259: netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() (bsc#1233214).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233453).
• CVE-2024-50267: USB: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).
• CVE-2024-50274: idpf: avoid vport access in idpf_get_link_ksettings (bsc#1233463).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).
• CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).
• CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).
• CVE-2024-53068: firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() (bsc#1233561).

The following non-security bugs were fixed:

• Update config files (bsc#1218644).
• Update config files. Enabled IDPF for ARM64 (bsc#1221309)
• kernel-binary: Enable livepatch package only when livepatch is enabled Otherwise the filelist may be empty failing the build (bsc#1218644).
• mm/memory: add non-anonymous page check in the copy_present_page() (bsc#1231646).
• rpm/scripts: Remove obsolete Symbols.list Symbols.list is not longer needed by the new klp-convert implementation. (bsc#1218644)

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
• CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48957: dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() (bsc#1231973).
• CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
• CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
• CVE-2022-48980: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() (bsc#1232233).
• CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
• CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2022-49017: tipc: re-fetch skb cb after tipc_msg_validate (bsc#1232004).
• CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
• CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB (bsc#1228709).
• CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005).
• CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837).
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46716: dmaengine: altera-msgdma:…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48853: swiotlb: fix info leak with DMA_FROM_DEVICE (bsc#1228015).
• CVE-2024-26801: Bluetooth: Avoid potential use-after-free in hci_error_reset (bsc#1222413).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2024-26886: Bluetooth: af_bluetooth: Fix deadlock (bsc#1223044).
• CVE-2024-27051: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value (bsc#1223769).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-46771: can: bcm: Remove proc entry when dev is unregistered (bsc#1230766).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47660: fsnotify: clear PARENT_WATCHED flags lazily (bsc#1231439).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-49858: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption (bsc#1232251).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49938: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit (bsc#1232552).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
• CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
• CVE-2024-50044: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (bsc#1231904).
• CVE-2024-50055: driver core: bus: Fix double free in driver API bus_register() (bsc#1232329).
• CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
• CVE-2024-50074: parport: Proper fix for array out-of-bounds access (bsc#1232507).
• CVE-2024-50095: RDMA/mad: Improve handling of timed out WRs of mad agent (bsc#1232873).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50117: drm/amd: Guard against bad data for ATIF ACPI method (bsc#1232897).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50135: nvme-pci: fix race condition between reset and nvme_dev_disable() (bsc#1232888).
• CVE-2024-50148: Bluetooth: bnep: fix wild-memory-access in proto_unregister (bsc#1233063).
• CVE-2024-50150: usb: typec: altmode should keep reference to parent (bsc#1233051).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50167: be2net: fix potential memory leak in be_xmit() (bsc#1233049).
• CVE-2024-50171: net: systemport: fix potential memory leak in bcm_sysport_xmit() (bsc#1233057).
• CVE-2024-50183: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (bsc#1233130).
• CVE-2024-50187: drm/vc4: Stop the active perfmon before being destroyed (bsc#1233108).
• CVE-2024-50195: posix-clock: Fix missing timespec64 check in pc_clock_settime() (bsc#1233103).
• CVE-2024-50218: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
• CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
• CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: explicitly exit when ext4_find_inline_entry returns an error (bsc#1231920).
• CVE-2024-47745: mm: split critical region in remap_file_pages() and invoke LSMs in between (bsc#1232135).
• CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49934: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (bsc#1232387).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
• CVE-2024-49968: ext4: fix error message when rejecting the default hash (bsc#1232264).
• CVE-2024-49983: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (bsc#1232096).
• CVE-2024-49989: drm/amd/display: fix double free issue during amdgpu module unload (bsc#1232483).
• CVE-2024-50009: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (bsc#1232318).
• CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
• CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50093: thermal: intel: int340x: processor: Fix warning during module unload (bsc#1232877).
• CVE-2024-50098: scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down (bsc#1232881).
• CVE-2024-50108: drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too (bsc#1232884).
• CVE-2024-50110: xfrm: fix one more kernel-infoleak in algo dumping (bsc#1232885).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix…

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2023-6270: aoe: fix the potential use-after-free problem in more places (bsc#1218562).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46828: sched: sch_cake: fix bulk flow accounting logic for host fairness (bsc#1231114).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs: do not BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() (bsc#1231094).
• CVE-2024-46843: scsi: ufs: core: Remove SCSI host only if added…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50205: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (bsc#1233293).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233453).
• CVE-2024-50267: usb: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).
• CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).
• CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).

The following non-security bugs were fixed:

• Update config files (bsc#1218644).
• initramfs: avoid filename buffer overrun (bsc#1232436).
• kernel-binary: Enable livepatch package only when livepatch is enabled Otherwise the filelist may be empty failing the build (bsc#1218644).
• rpm/scripts: Remove obsolete Symbols.list Symbols.list is not longer needed by the new klp-convert implementation. (bsc#1218644)

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48853: swiotlb: fix info leak with DMA_FROM_DEVICE (bsc#1228015).
• CVE-2024-26801: Bluetooth: Avoid potential use-after-free in hci_error_reset (bsc#1222413).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2024-26886: Bluetooth: af_bluetooth: Fix deadlock (bsc#1223044).
• CVE-2024-27051: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value (bsc#1223769).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-46771: can: bcm: Remove proc entry when dev is unregistered (bsc#1230766).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47660: fsnotify: clear PARENT_WATCHED flags lazily (bsc#1231439).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-49858: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption (bsc#1232251).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49938: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit (bsc#1232552).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
• CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
• CVE-2024-50044: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (bsc#1231904).
• CVE-2024-50055: driver core: bus: Fix double free in driver API bus_register() (bsc#1232329).
• CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
• CVE-2024-50074: parport: Proper fix for array out-of-bounds access (bsc#1232507).
• CVE-2024-50095: RDMA/mad: Improve handling of timed out WRs of mad agent (bsc#1232873).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50117: drm/amd: Guard against bad data for ATIF ACPI method (bsc#1232897).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50135: nvme-pci: fix race condition between reset and nvme_dev_disable() (bsc#1232888).
• CVE-2024-50148: Bluetooth: bnep: fix wild-memory-access in proto_unregister (bsc#1233063).
• CVE-2024-50150: usb: typec: altmode should keep reference to parent (bsc#1233051).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50167: be2net: fix potential memory leak in be_xmit() (bsc#1233049).
• CVE-2024-50171: net: systemport: fix potential memory leak in bcm_sysport_xmit() (bsc#1233057).
• CVE-2024-50183: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (bsc#1233130).
• CVE-2024-50187: drm/vc4: Stop the active perfmon before being destroyed (bsc#1233108).
• CVE-2024-50195: posix-clock: Fix missing timespec64 check in pc_clock_settime() (bsc#1233103).
• CVE-2024-50218: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs: do…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs: do…

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• STMicroelectronics network drivers;
• Parport drivers;
• Pin controllers subsystem;
• Direct Digital Synthesis drivers;
• TCM subsystem;
• TTY drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• BTRFS file system;
• File systems infrastructure;
• Network file system (NFS) client;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• User-space API (UAPI);
• io_uring subsystem;
• BPF subsystem;
• Timer substystem drivers;
• Tracing infrastructure;
• Closures library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• Network traffic control;
• SCTP protocol;
• XFRM subsystem;
• Key management;
• FireWire sound drivers;
• HD-audio driver;
• QCOM ASoC drivers;
• STMicroelectronics SoC drivers;
• KVM core; (CVE-2024-50202, CVE-2024-50208, CVE-2024-50265, CVE-2024-41080, CVE-2024-50101, CVE-2024-39497, CVE-2024-50153, CVE-2024-50162, CVE-2024-50150, CVE-2024-50115, CVE-2024-53066, CVE-2024-50279, CVE-2024-50116, CVE-2024-50218, CVE-2024-53104, CVE-2024-50086, CVE-2024-50154, CVE-2024-50244, CVE-2024-50074, CVE-2024-50278, CVE-2024-50262, CVE-2024-50168, CVE-2024-50134, CVE-2024-53063, CVE-2024-50236, CVE-2024-50082, CVE-2024-50234, CVE-2024-50247, CVE-2024-50282, CVE-2024-50267, CVE-2024-40965, CVE-2024-50229, CVE-2024-50110, CVE-2024-35887, CVE-2024-50302, CVE-2024-50036, CVE-2024-50209, CVE-2024-50287, CVE-2024-50245, CVE-2024-50072, CVE-2024-50301, CVE-2024-50201, CVE-2024-53097, CVE-2024-40953, CVE-2024-50085, CVE-2024-50299, CVE-2024-50292, CVE-2024-50269, CVE-2024-50182, CVE-2024-50233, CVE-2024-53088, CVE-2024-50259, CVE-2024-50232, CVE-2024-53055, CVE-2024-50195, CVE-2024-50273, CVE-2024-42291, CVE-2024-50192, CVE-2024-50251, CVE-2024-50193, CVE-2024-50142, CVE-2024-53101, CVE-2024-50205, CVE-2024-26718, CVE-2024-50167, CVE-2024-50010, CVE-2024-50230, CVE-2024-41066, CVE-2024-50194, CVE-2024-50148, CVE-2024-50151, CVE-2024-50127, CVE-2024-50160, CVE-2023-52913, CVE-2024-53052, CVE-2024-50156, CVE-2024-50141, CVE-2024-50103, CVE-2024-50296, CVE-2024-50257, CVE-2024-50199, CVE-2024-50128, CVE-2024-50058, CVE-2024-50099, CVE-2024-50290, CVE-2024-53042, CVE-2024-50295, CVE-2024-50268, CVE-2024-50163, CVE-2024-53058, CVE-2024-50185, CVE-2024-50117, CVE-2024-50237, CVE-2024-50083, CVE-2024-50131, CVE-2024-50196, CVE-2024-42252, CVE-2024-50143, CVE-2024-50171, CVE-2024-50249, CVE-2024-53059, CVE-2024-50198, CVE-2024-53061)

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• STMicroelectronics network drivers;
• Parport drivers;
• Pin controllers subsystem;
• Direct Digital Synthesis drivers;
• TCM subsystem;
• TTY drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• BTRFS file system;
• File systems infrastructure;
• Network file system (NFS) client;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• User-space API (UAPI);
• io_uring subsystem;
• BPF subsystem;
• Timer substystem drivers;
• Tracing infrastructure;
• Closures library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• Network traffic control;
• SCTP protocol;
• XFRM subsystem;
• Key management;
• FireWire sound drivers;
• HD-audio driver;
• QCOM ASoC drivers;
• STMicroelectronics SoC drivers;
• KVM core; (CVE-2024-50151, CVE-2024-50195, CVE-2024-50117, CVE-2024-53104, CVE-2024-50171, CVE-2024-53059, CVE-2024-50160, CVE-2024-50163, CVE-2024-50103, CVE-2024-50245, CVE-2024-50282, CVE-2024-50233, CVE-2024-50218, CVE-2024-50201, CVE-2024-53058, CVE-2024-50115, CVE-2024-53101, CVE-2024-50268, CVE-2024-50127, CVE-2024-50182, CVE-2024-50148, CVE-2024-50295, CVE-2024-53061, CVE-2024-50232, CVE-2024-50010, CVE-2024-50273, CVE-2024-50267, CVE-2024-50198, CVE-2024-53097, CVE-2024-50150, CVE-2024-50278, CVE-2024-50301, CVE-2024-50290, CVE-2024-50185, CVE-2024-50036, CVE-2024-50296, CVE-2024-50082, CVE-2024-50058, CVE-2024-53063, CVE-2024-50192, CVE-2024-50208, CVE-2024-53052, CVE-2024-50162, CVE-2024-50247, CVE-2024-50302, CVE-2024-50153, CVE-2024-50143, CVE-2024-41080, CVE-2024-50287, CVE-2024-39497, CVE-2024-50156, CVE-2024-42252, CVE-2024-53055, CVE-2024-50265, CVE-2024-50230, CVE-2024-50269, CVE-2024-50167, CVE-2024-50237, CVE-2024-50168, CVE-2023-52913, CVE-2024-35887, CVE-2024-50299, CVE-2024-53088, CVE-2024-50209, CVE-2024-50234, CVE-2024-50131, CVE-2024-50141, CVE-2024-40965, CVE-2024-41066, CVE-2024-50251, CVE-2024-50292, CVE-2024-50194, CVE-2024-50085, CVE-2024-50154, CVE-2024-50202, CVE-2024-50074, CVE-2024-50199, CVE-2024-50110, CVE-2024-26718, CVE-2024-50205, CVE-2024-53042, CVE-2024-50279, CVE-2024-50101, CVE-2024-50116, CVE-2024-50236, CVE-2024-50083, CVE-2024-50262, CVE-2024-40953, CVE-2024-50142, CVE-2024-50128, CVE-2024-50099, CVE-2024-50086, CVE-2024-42291, CVE-2024-50257, CVE-2024-50229, CVE-2024-50134, CVE-2024-50244, CVE-2024-50249, CVE-2024-50193, CVE-2024-50072, CVE-2024-50259, CVE-2024-50196, CVE-2024-53066)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• STMicroelectronics network drivers;
• Parport drivers;
• Pin controllers subsystem;
• Direct Digital Synthesis drivers;
• TCM subsystem;
• TTY drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• BTRFS file system;
• File systems infrastructure;
• Network file system (NFS) client;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• User-space API (UAPI);
• io_uring subsystem;
• BPF subsystem;
• Timer substystem drivers;
• Tracing infrastructure;
• Closures library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• Network traffic control;
• SCTP protocol;
• XFRM subsystem;
• Key management;
• FireWire sound drivers;
• HD-audio driver;
• QCOM ASoC drivers;
• STMicroelectronics SoC drivers;
• KVM core; (CVE-2024-50196, CVE-2024-50199, CVE-2024-53055, CVE-2024-53101, CVE-2024-50160, CVE-2024-50257, CVE-2024-50148, CVE-2024-50182, CVE-2024-50162, CVE-2024-50249, CVE-2024-50127, CVE-2024-50115, CVE-2024-50192, CVE-2024-50218, CVE-2024-50086, CVE-2024-50262, CVE-2024-50201, CVE-2024-50082, CVE-2024-50110, CVE-2023-52913, CVE-2024-50290, CVE-2024-50269, CVE-2024-50208, CVE-2024-50103, CVE-2024-50194, CVE-2024-50237, CVE-2024-50245, CVE-2024-50128, CVE-2024-53052, CVE-2024-50117, CVE-2024-42252, CVE-2024-50233, CVE-2024-50058, CVE-2024-50229, CVE-2024-40965, CVE-2024-50265, CVE-2024-50143, CVE-2024-50205, CVE-2024-50131, CVE-2024-50236, CVE-2024-53066, CVE-2024-50268, CVE-2024-41066, CVE-2024-53088, CVE-2024-50209, CVE-2024-40953, CVE-2024-50168, CVE-2024-50010, CVE-2024-50195, CVE-2024-50171, CVE-2024-53058, CVE-2024-50267, CVE-2024-53061, CVE-2024-53042, CVE-2024-53104, CVE-2024-50247, CVE-2024-50101, CVE-2024-53063, CVE-2024-50167, CVE-2024-50273, CVE-2024-50163, CVE-2024-50085, CVE-2024-50154, CVE-2024-50301, CVE-2024-50259, CVE-2024-50292, CVE-2024-50185, CVE-2024-26718, CVE-2024-50116, CVE-2024-50302, CVE-2024-50083, CVE-2024-50299, CVE-2024-50036, CVE-2024-50251, CVE-2024-50202, CVE-2024-50099, CVE-2024-50279, CVE-2024-50232, CVE-2024-53059, CVE-2024-50153, CVE-2024-50156, CVE-2024-41080, CVE-2024-50193, CVE-2024-50287, CVE-2024-50141, CVE-2024-50296, CVE-2024-50230, CVE-2024-50074, CVE-2024-50234, CVE-2024-50142, CVE-2024-42291, CVE-2024-50151, CVE-2024-50295, CVE-2024-50150, CVE-2024-50282, CVE-2024-50278, CVE-2024-50198, CVE-2024-53097, CVE-2024-50244, CVE-2024-50134, CVE-2024-39497, CVE-2024-50072, CVE-2024-35887)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• STMicroelectronics network drivers;
• Parport drivers;
• Pin controllers subsystem;
• Direct Digital Synthesis drivers;
• TCM subsystem;
• TTY drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• BTRFS file system;
• File systems infrastructure;
• Network file system (NFS) client;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• User-space API (UAPI);
• io_uring subsystem;
• BPF subsystem;
• Timer substystem drivers;
• Tracing infrastructure;
• Closures library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• Network traffic control;
• SCTP protocol;
• XFRM subsystem;
• Key management;
• FireWire sound drivers;
• HD-audio driver;
• QCOM ASoC drivers;
• STMicroelectronics SoC drivers;
• KVM core; (CVE-2024-50269, CVE-2024-50208, CVE-2024-53101, CVE-2024-50257, CVE-2024-50110, CVE-2024-39497, CVE-2024-50116, CVE-2024-50153, CVE-2024-50143, CVE-2023-52913, CVE-2024-53042, CVE-2024-41066, CVE-2024-42252, CVE-2024-50247, CVE-2024-50131, CVE-2024-50182, CVE-2024-50279, CVE-2024-50209, CVE-2024-50163, CVE-2024-50265, CVE-2024-50010, CVE-2024-50171, CVE-2024-50295, CVE-2024-53088, CVE-2024-50142, CVE-2024-50058, CVE-2024-50195, CVE-2024-50232, CVE-2024-50141, CVE-2024-50117, CVE-2024-50229, CVE-2024-53061, CVE-2024-50074, CVE-2024-50282, CVE-2024-50296, CVE-2024-50218, CVE-2024-50259, CVE-2024-26718, CVE-2024-50134, CVE-2024-50150, CVE-2024-50301, CVE-2024-40953, CVE-2024-42291, CVE-2024-50086, CVE-2024-50198, CVE-2024-50194, CVE-2024-50168, CVE-2024-50196, CVE-2024-50262, CVE-2024-50290, CVE-2024-50036, CVE-2024-50156, CVE-2024-53066, CVE-2024-50245, CVE-2024-50278, CVE-2024-50127, CVE-2024-53055, CVE-2024-50287, CVE-2024-53052, CVE-2024-35887, CVE-2024-50199, CVE-2024-50205, CVE-2024-50273, CVE-2024-50185, CVE-2024-50201, CVE-2024-50072, CVE-2024-50234, CVE-2024-50101, CVE-2024-50103, CVE-2024-50302, CVE-2024-50251, CVE-2024-53104, CVE-2024-50083, CVE-2024-50292, CVE-2024-50236, CVE-2024-50230, CVE-2024-50085, CVE-2024-50162, CVE-2024-50193, CVE-2024-50267, CVE-2024-50192, CVE-2024-50148, CVE-2024-50167, CVE-2024-50249, CVE-2024-50268, CVE-2024-53058, CVE-2024-41080, CVE-2024-50233, CVE-2024-53097, CVE-2024-50244, CVE-2024-50160, CVE-2024-50299, CVE-2024-50115, CVE-2024-53059, CVE-2024-50099, CVE-2024-50154, CVE-2024-53063, CVE-2024-50237, CVE-2024-50128, CVE-2024-40965, CVE-2024-50151, CVE-2024-50082, CVE-2024-50202)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• STMicroelectronics network drivers;
• Parport drivers;
• Pin controllers subsystem;
• Direct Digital Synthesis drivers;
• TCM subsystem;
• TTY drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• BTRFS file system;
• File systems infrastructure;
• Network file system (NFS) client;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• User-space API (UAPI);
• io_uring subsystem;
• BPF subsystem;
• Timer substystem drivers;
• Tracing infrastructure;
• Closures library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• Network traffic control;
• SCTP protocol;
• XFRM subsystem;
• Key management;
• FireWire sound drivers;
• HD-audio driver;
• QCOM ASoC drivers;
• STMicroelectronics SoC drivers;
• KVM core; (CVE-2024-50117, CVE-2024-50230, CVE-2024-50131, CVE-2024-50128, CVE-2024-50142, CVE-2024-50141, CVE-2024-50267, CVE-2024-41066, CVE-2024-50236, CVE-2024-50205, CVE-2024-50202, CVE-2024-50209, CVE-2024-50148, CVE-2024-50171, CVE-2024-50074, CVE-2024-50268, CVE-2024-50265, CVE-2024-50160, CVE-2024-50143, CVE-2024-50296, CVE-2024-50101, CVE-2024-50103, CVE-2024-39497, CVE-2024-50151, CVE-2024-50127, CVE-2024-50150, CVE-2024-50229, CVE-2024-50115, CVE-2024-50058, CVE-2024-50292, CVE-2024-50010, CVE-2024-50247, CVE-2024-50110, CVE-2024-53088, CVE-2024-50116, CVE-2024-26718, CVE-2024-53097, CVE-2024-50192, CVE-2024-50234, CVE-2024-41080, CVE-2024-42291, CVE-2024-50195, CVE-2024-40965, CVE-2024-50278, CVE-2024-50290, CVE-2024-50162, CVE-2024-53066, CVE-2024-50085, CVE-2024-50099, CVE-2024-50237, CVE-2024-50156, CVE-2024-50185, CVE-2024-50273, CVE-2024-50302, CVE-2024-50249, CVE-2024-50208, CVE-2024-50232, CVE-2024-50287, CVE-2024-50262, CVE-2024-50194, CVE-2024-40953, CVE-2024-50083, CVE-2024-50082, CVE-2024-53063, CVE-2024-50086, CVE-2024-50193, CVE-2024-50282, CVE-2024-50201, CVE-2024-50134, CVE-2024-53061, CVE-2024-50299, CVE-2024-50279, CVE-2024-50198, CVE-2024-53104, CVE-2024-50244, CVE-2024-50167, CVE-2024-53052, CVE-2024-50196, CVE-2024-50182, CVE-2024-35887, CVE-2024-53042, CVE-2023-52913, CVE-2024-53055, CVE-2024-50301, CVE-2024-42252, CVE-2024-50259, CVE-2024-50218, CVE-2024-50168, CVE-2024-50245, CVE-2024-50163, CVE-2024-50036, CVE-2024-50154, CVE-2024-53059, CVE-2024-50257, CVE-2024-53101, CVE-2024-50295, CVE-2024-50269, CVE-2024-53058, CVE-2024-50072, CVE-2024-50251, CVE-2024-50153, CVE-2024-50233, CVE-2024-50199)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• STMicroelectronics network drivers;
• Parport drivers;
• Pin controllers subsystem;
• Direct Digital Synthesis drivers;
• TCM subsystem;
• TTY drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• BTRFS file system;
• File systems infrastructure;
• Network file system (NFS) client;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• User-space API (UAPI);
• io_uring subsystem;
• BPF subsystem;
• Timer substystem drivers;
• Tracing infrastructure;
• Closures library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• Network traffic control;
• SCTP protocol;
• XFRM subsystem;
• Key management;
• FireWire sound drivers;
• HD-audio driver;
• QCOM ASoC drivers;
• STMicroelectronics SoC drivers;
• KVM core; (CVE-2024-50082, CVE-2024-50134, CVE-2024-50142, CVE-2023-52913, CVE-2024-50205, CVE-2024-50127, CVE-2024-50208, CVE-2024-50143, CVE-2024-50163, CVE-2024-53059, CVE-2024-50282, CVE-2024-50279, CVE-2024-50296, CVE-2024-50295, CVE-2024-50010, CVE-2024-53088, CVE-2024-50128, CVE-2024-50290, CVE-2024-50099, CVE-2024-50234, CVE-2024-50154, CVE-2024-53052, CVE-2024-50116, CVE-2024-50168, CVE-2024-50086, CVE-2024-50267, CVE-2024-50156, CVE-2024-50110, CVE-2024-50103, CVE-2024-50192, CVE-2024-40953, CVE-2024-50085, CVE-2024-50247, CVE-2024-50257, CVE-2024-50237, CVE-2024-50185, CVE-2024-50198, CVE-2024-50229, CVE-2024-50171, CVE-2024-50259, CVE-2024-50209, CVE-2024-50233, CVE-2024-35887, CVE-2024-50251, CVE-2024-50141, CVE-2024-53061, CVE-2024-50232, CVE-2024-50167, CVE-2024-50201, CVE-2024-50193, CVE-2024-50269, CVE-2024-39497, CVE-2024-50036, CVE-2024-50299, CVE-2024-50072, CVE-2024-53101, CVE-2024-50262, CVE-2024-50194, CVE-2024-50202, CVE-2024-50101, CVE-2024-50151, CVE-2024-41080, CVE-2024-42291, CVE-2024-50245, CVE-2024-50278, CVE-2024-50195, CVE-2024-50265, CVE-2024-50074, CVE-2024-53063, CVE-2024-50131, CVE-2024-53058, CVE-2024-50160, CVE-2024-50287, CVE-2024-40965, CVE-2024-50273, CVE-2024-50268, CVE-2024-50302, CVE-2024-50218, CVE-2024-50199, CVE-2024-50196, CVE-2024-50083, CVE-2024-50244, CVE-2024-50117, CVE-2024-50058, CVE-2024-53055, CVE-2024-50182, CVE-2024-53097, CVE-2024-50236, CVE-2024-50162, CVE-2024-50301, CVE-2024-50249, CVE-2024-50292, CVE-2024-50150, CVE-2024-50153, CVE-2024-50115, CVE-2024-26718, CVE-2024-53104, CVE-2024-42252, CVE-2024-53066, CVE-2024-50148, CVE-2024-53042, CVE-2024-50230, CVE-2024-41066)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• STMicroelectronics network drivers;
• Parport drivers;
• Pin controllers subsystem;
• Direct Digital Synthesis drivers;
• TCM subsystem;
• TTY drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• BTRFS file system;
• File systems infrastructure;
• Network file system (NFS) client;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• User-space API (UAPI);
• io_uring subsystem;
• BPF subsystem;
• Timer substystem drivers;
• Tracing infrastructure;
• Closures library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• Network traffic control;
• SCTP protocol;
• XFRM subsystem;
• Key management;
• FireWire sound drivers;
• HD-audio driver;
• QCOM ASoC drivers;
• STMicroelectronics SoC drivers;
• KVM core; (CVE-2024-50083, CVE-2024-50134, CVE-2024-53063, CVE-2024-50131, CVE-2024-53104, CVE-2024-50182, CVE-2024-50279, CVE-2024-50185, CVE-2024-42252, CVE-2024-50247, CVE-2024-50128, CVE-2024-53088, CVE-2024-50082, CVE-2024-50160, CVE-2024-50103, CVE-2024-50259, CVE-2024-35887, CVE-2024-50251, CVE-2024-50150, CVE-2024-53066, CVE-2024-50262, CVE-2024-41066, CVE-2024-50086, CVE-2024-42291, CVE-2024-53061, CVE-2024-50245, CVE-2024-41080, CVE-2024-50244, CVE-2024-50198, CVE-2024-50282, CVE-2024-50074, CVE-2024-50195, CVE-2024-50010, CVE-2024-50202, CVE-2024-50295, CVE-2024-50162, CVE-2024-50273, CVE-2024-50233, CVE-2024-50302, CVE-2024-50201, CVE-2024-50278, CVE-2024-50036, CVE-2024-50296, CVE-2024-53058, CVE-2024-50116, CVE-2024-50163, CVE-2024-50292, CVE-2024-53097, CVE-2024-50196, CVE-2024-50058, CVE-2024-53042, CVE-2024-53059, CVE-2024-50110, CVE-2024-50151, CVE-2024-26718, CVE-2024-50099, CVE-2024-50115, CVE-2024-50171, CVE-2024-50237, CVE-2024-50154, CVE-2024-50199, CVE-2024-50192, CVE-2024-50167, CVE-2024-50127, CVE-2024-50142, CVE-2024-50229, CVE-2024-50269, CVE-2024-53055, CVE-2024-40965, CVE-2024-50265, CVE-2024-50143, CVE-2024-40953, CVE-2024-50117, CVE-2024-50156, CVE-2024-50193, CVE-2024-50072, CVE-2024-50230, CVE-2024-50287, CVE-2024-50148, CVE-2024-50208, CVE-2024-50267, CVE-2024-50290, CVE-2024-50085, CVE-2024-50168, CVE-2024-50205, CVE-2024-50232, CVE-2024-50153, CVE-2024-39497, CVE-2024-50194, CVE-2024-50101, CVE-2024-50257, CVE-2024-50249, CVE-2024-50299, CVE-2024-50234, CVE-2024-50209, CVE-2024-50141, CVE-2023-52913, CVE-2024-50301, CVE-2024-50236, CVE-2024-53052, CVE-2024-53101, CVE-2024-50268, CVE-2024-50218)

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• Block layer subsystem;
• ACPI drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• TPM device driver;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• NTB driver;
• Virtio pmem driver;
• Parport drivers;
• PCI subsystem;
• SPI subsystem;
• Direct Digital Synthesis drivers;
• USB Device Class drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• Framebuffer layer;
• BTRFS file system;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• File systems infrastructure;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• SMB network file system;
• Network traffic control;
• Network sockets;
• TCP network protocol;
• BPF subsystem;
• Perf events;
• Arbitrary resource management;
• Timer substystem drivers;
• Tracing infrastructure;
• Closures library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Ethernet bridge;
• CAN network layer;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Netfilter;
• Netlink;
• SCTP protocol;
• TIPC protocol;
• Wireless networking;
• XFRM subsystem;
• Key management;
• FireWire sound drivers;
• AudioScience HPI driver;
• Amlogic Meson SoC drivers;
• KVM core; (CVE-2024-50184, CVE-2024-47706, CVE-2024-49962, CVE-2024-35887, CVE-2024-53101, CVE-2024-50199, CVE-2024-47709, CVE-2024-50074, CVE-2024-41066, CVE-2024-42252, CVE-2024-43863, CVE-2024-47685, CVE-2024-47756, CVE-2024-50282, CVE-2024-50143, CVE-2024-50116, CVE-2024-47699, CVE-2024-47698, CVE-2024-50301, CVE-2024-47723, CVE-2024-50296, CVE-2024-50007, CVE-2024-49952, CVE-2024-50233, CVE-2023-52458, CVE-2024-53063, CVE-2024-49975, CVE-2024-50099, CVE-2024-47742, CVE-2024-50033, CVE-2024-50218, CVE-2024-50096, CVE-2024-49981, CVE-2024-40911, CVE-2024-47697, CVE-2024-49894, CVE-2024-49955, CVE-2024-53104, CVE-2024-49963, CVE-2024-49883, CVE-2024-47710, CVE-2024-49959, CVE-2024-49948, CVE-2024-50302, CVE-2024-49867, CVE-2024-50234, CVE-2024-49902, CVE-2024-50006, CVE-2024-47672, CVE-2024-50202, CVE-2024-49851, CVE-2024-35896, CVE-2024-50150, CVE-2024-53061, CVE-2024-46854, CVE-2024-50279, CVE-2024-50278, CVE-2024-50180, CVE-2024-50148, CVE-2024-50194, CVE-2024-50008, CVE-2024-47740, CVE-2024-49938, CVE-2024-46853, CVE-2024-50134, CVE-2024-44931, CVE-2024-46849, CVE-2024-49973, CVE-2024-50142, CVE-2024-49879, CVE-2024-50269, CVE-2024-50230, CVE-2024-49896, CVE-2024-49985, CVE-2024-50151, CVE-2024-40965, CVE-2024-50251, CVE-2024-49995, CVE-2024-47713, CVE-2023-52917, CVE-2024-50205, CVE-2024-49900, CVE-2024-49877, CVE-2024-47679, CVE-2024-50040, CVE-2024-47701, CVE-2024-50168, CVE-2024-49882, CVE-2024-50059, CVE-2024-49958, CVE-2024-50171, CVE-2021-47469, CVE-2024-50024, CVE-2024-47749, CVE-2024-50236, CVE-2024-50127, CVE-2024-50290, CVE-2024-47692, CVE-2024-50167, CVE-2024-49944, CVE-2024-50262, CVE-2024-47674, CVE-2024-49957, CVE-2024-50237, CVE-2024-47712, CVE-2024-49949, CVE-2024-40953, CVE-2024-50267, CVE-2024-53059, CVE-2024-49966, CVE-2024-47737, CVE-2024-49868, CVE-2024-50179, CVE-2024-50035, CVE-2024-49997, CVE-2024-50044, CVE-2024-49903, CVE-2024-46731, CVE-2024-49965, CVE-2024-50287,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• Block layer subsystem;
• ACPI drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• TPM device driver;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• NTB driver;
• Virtio pmem driver;
• Parport drivers;
• PCI subsystem;
• SPI subsystem;
• Direct Digital Synthesis drivers;
• USB Device Class drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• Framebuffer layer;
• BTRFS file system;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• File systems infrastructure;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• SMB network file system;
• Network traffic control;
• Network sockets;
• TCP network protocol;
• BPF subsystem;
• Perf events;
• Arbitrary resource management;
• Timer substystem drivers;
• Tracing infrastructure;
• Closures library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Ethernet bridge;
• CAN network layer;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Netfilter;
• Netlink;
• SCTP protocol;
• TIPC protocol;
• Wireless networking;
• XFRM subsystem;
• Key management;
• FireWire sound drivers;
• AudioScience HPI driver;
• Amlogic Meson SoC drivers;
• KVM core; (CVE-2024-40953, CVE-2024-50008, CVE-2024-40911, CVE-2024-47685, CVE-2024-49957, CVE-2024-38544, CVE-2024-49860, CVE-2024-46854, CVE-2024-49882, CVE-2024-44931, CVE-2024-47696, CVE-2021-47469, CVE-2024-41066, CVE-2024-46849, CVE-2024-47671, CVE-2024-49975, CVE-2024-49958, CVE-2024-50006, CVE-2024-50287, CVE-2024-50099, CVE-2024-50035, CVE-2024-46731, CVE-2024-49878, CVE-2024-50045, CVE-2023-52917, CVE-2024-47712, CVE-2024-49883, CVE-2024-50040, CVE-2024-50234, CVE-2024-50184, CVE-2024-50279, CVE-2024-49948, CVE-2024-50044, CVE-2024-50230, CVE-2024-47710, CVE-2024-50233, CVE-2024-49900, CVE-2024-49938, CVE-2024-50236, CVE-2024-47737, CVE-2024-47670, CVE-2024-41016, CVE-2024-50150, CVE-2024-50301, CVE-2024-50116, CVE-2024-47706, CVE-2024-40965, CVE-2024-50205, CVE-2024-49963, CVE-2024-47756, CVE-2024-53066, CVE-2024-49879, CVE-2024-53059, CVE-2024-50229, CVE-2024-50131, CVE-2024-53104, CVE-2024-50167, CVE-2024-47723, CVE-2024-47709, CVE-2024-42252, CVE-2024-50267, CVE-2024-50218, CVE-2024-47698, CVE-2024-50039, CVE-2024-47701, CVE-2024-50202, CVE-2024-50262, CVE-2024-50194, CVE-2024-46853, CVE-2024-47699, CVE-2024-47697, CVE-2024-50117, CVE-2024-49982, CVE-2024-47742, CVE-2024-50127, CVE-2024-50142, CVE-2024-49955, CVE-2024-47747, CVE-2024-49981, CVE-2024-47679, CVE-2024-50237, CVE-2024-43863, CVE-2024-47672, CVE-2024-50273, CVE-2024-49903, CVE-2024-50180, CVE-2024-50148, CVE-2024-50059, CVE-2024-50299, CVE-2024-47740, CVE-2024-47749, CVE-2024-49892, CVE-2024-50074, CVE-2024-49973, CVE-2024-50296, CVE-2024-49962, CVE-2024-50024, CVE-2024-49924, CVE-2024-49877, CVE-2024-49959, CVE-2024-49997, CVE-2024-50168, CVE-2024-47757, CVE-2024-49902, CVE-2024-49868, CVE-2023-52458, CVE-2024-47692, CVE-2024-49894, CVE-2024-50096, CVE-2024-47684, CVE-2024-50143, CVE-2024-35896, CVE-2024-47713, CVE-2024-50151, CVE-2024-50082, CVE-2024-50171, CVE-2024-53063, CVE-2024-50007, CVE-2024-49985, CVE-2024-49944, CVE-2024-50302, CVE-2024-49949, CVE-2024-50033, CVE-2024-49952, CVE-2024-49995, CVE-2024-50278, CVE-2024-53061, CVE-2024-50195, CVE-2024-49966, CVE-2024-50265, CVE-2024-50282, CVE-2024-35887, CVE-2024-49896, CVE-2024-50290, CVE-2024-53101, CVE-2024-49867, CVE-2024-50199, CVE-2024-49965, CVE-2024-50179,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• Block layer subsystem;
• ACPI drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• TPM device driver;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• NTB driver;
• Virtio pmem driver;
• Parport drivers;
• PCI subsystem;
• SPI subsystem;
• Direct Digital Synthesis drivers;
• USB Device Class drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• Framebuffer layer;
• BTRFS file system;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• File systems infrastructure;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• SMB network file system;
• Network traffic control;
• Network sockets;
• TCP network protocol;
• BPF subsystem;
• Perf events;
• Arbitrary resource management;
• Timer substystem drivers;
• Tracing infrastructure;
• Closures library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Ethernet bridge;
• CAN network layer;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Netfilter;
• Netlink;
• SCTP protocol;
• TIPC protocol;
• Wireless networking;
• XFRM subsystem;
• Key management;
• FireWire sound drivers;
• AudioScience HPI driver;
• Amlogic Meson SoC drivers;
• KVM core; (CVE-2024-53063, CVE-2024-50236, CVE-2024-47699, CVE-2024-50044, CVE-2024-49877, CVE-2024-47692, CVE-2024-50116, CVE-2024-47679, CVE-2024-50134, CVE-2024-50045, CVE-2024-50301, CVE-2024-40965, CVE-2024-47684, CVE-2024-49944, CVE-2024-43863, CVE-2024-50059, CVE-2024-50007, CVE-2024-49973, CVE-2024-50251, CVE-2024-47674, CVE-2024-49982, CVE-2024-50143, CVE-2024-49883, CVE-2024-49851, CVE-2024-44931, CVE-2024-49949, CVE-2024-47747, CVE-2024-46853, CVE-2024-50233, CVE-2024-49924, CVE-2024-50033, CVE-2024-50024, CVE-2024-49995, CVE-2024-47737, CVE-2024-50194, CVE-2024-47712, CVE-2024-50273, CVE-2024-50229, CVE-2024-49896, CVE-2024-50199, CVE-2024-50202, CVE-2024-49868, CVE-2024-50035, CVE-2024-50184, CVE-2024-49882, CVE-2024-49962, CVE-2024-50299, CVE-2024-35887, CVE-2024-50287, CVE-2024-50265, CVE-2024-50148, CVE-2024-47757, CVE-2024-47742, CVE-2024-49902, CVE-2024-50302, CVE-2024-50096, CVE-2024-49952, CVE-2024-50099, CVE-2024-49963, CVE-2024-49900, CVE-2024-46731, CVE-2024-50131, CVE-2024-47723, CVE-2024-50237, CVE-2024-50269, CVE-2024-50142, CVE-2024-49867, CVE-2024-49985, CVE-2024-47670, CVE-2024-50008, CVE-2024-49938, CVE-2024-49878, CVE-2024-49955, CVE-2024-53104, CVE-2024-49894, CVE-2024-50039, CVE-2024-50279, CVE-2024-50006, CVE-2024-40953, CVE-2024-50180, CVE-2024-49860, CVE-2024-50117, CVE-2024-47701, CVE-2024-47698, CVE-2024-50171, CVE-2024-50151, CVE-2024-50082, CVE-2024-50290, CVE-2024-49975, CVE-2024-49903, CVE-2024-38544, CVE-2024-50218, CVE-2024-49948, CVE-2024-50282, CVE-2024-49965, CVE-2024-49959, CVE-2024-42252, CVE-2024-47749, CVE-2024-47756, CVE-2024-47672, CVE-2024-50127, CVE-2024-46854, CVE-2024-50230, CVE-2024-41066, CVE-2024-49957, CVE-2024-47713, CVE-2023-52458, CVE-2024-50167, CVE-2024-49997, CVE-2024-47685, CVE-2024-49879, CVE-2024-53059, CVE-2024-53101, CVE-2024-49958, CVE-2024-47710, CVE-2024-47706, CVE-2024-50074, CVE-2024-50296, CVE-2024-49892, CVE-2024-46849, CVE-2024-50205, CVE-2024-50168, CVE-2024-50267, CVE-2024-50262, CVE-2024-47709, CVE-2024-50195, CVE-2024-35896, CVE-2024-47696, CVE-2024-47740, CVE-2024-40911, CVE-2024-49966, CVE-2021-47469, CVE-2024-49981, CVE-2024-50234, CVE-2024-50179, CVE-2024-47697, CVE-2024-50150, CVE-2023-52917, CVE-2024-50040,…