CVE-2024-50279

In the Linux kernel, the following vulnerability has been resolved:

dm cache: fix out-of-bounds access to the dirty bitset when resizing

dm-cache checks the dirty bits of the cache blocks to be dropped when shrinking the fast device, but an index bug in bitset iteration causes out-of-bounds access.

Reproduce steps:

1. create a cache device of 1024 cache blocks (128 bytes dirty bitset)

dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta
/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"

2. shrink the fast device to 512 cache blocks, triggering out-of-bounds access to the dirty bitset (offset 0x80)

dmsetup suspend cache dmsetup reload cdata --table "0 65536 linear /dev/sdc 8192" dmsetup resume cdata dmsetup resume cache

KASAN reports:

BUG: KASAN: vmalloc-out-of-bounds in cache_preresume+0x269/0x7b0 Read of size 8 at addr ffffc900000f3080 by task dmsetup/131

(...snip...) The buggy address belongs to the virtual mapping at [ffffc900000f3000, ffffc900000f5000) created by: cache_ctr+0x176a/0x35f0

(...snip...) Memory state around the buggy address: ffffc900000f2f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900000f3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

ffffc900000f3080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc900000f3100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900000f3180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8

Fix by making the index post-incremented.

In the Linux kernel, the following vulnerability has been resolved: dm cache: fix out-of-bounds access to the dirty bitset when resizing dm-cache checks the dirty bits of the cache blocks to be dropped when shrinking the fast device, but an index bug in bitset iteration causes out-of-bounds access. Reproduce steps: 1. create a cache device of 1024 cache blocks (128 bytes dirty bitset) dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. shrink the fast device to 512 cache blocks, triggering out-of-bounds access to the dirty bitset (offset 0x80) dmsetup suspend cache dmsetup reload cdata --table "0 65536 linear /dev/sdc 8192" dmsetup resume cdata dmsetup resume cache KASAN reports: BUG: KASAN: vmalloc-out-of-bounds in cache_preresume+0x269/0x7b0 Read of size 8 at addr ffffc900000f3080 by task dmsetup/131 (...snip...) The buggy address belongs to the virtual mapping at [ffffc900000f3000, ffffc900000f5000) created by: cache_ctr+0x176a/0x35f0 (...snip...) Memory state around the buggy address: ffffc900000f2f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900000f3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc900000f3080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc900000f3100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900000f3180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 Fix by making the index post-incremented.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: xhci: Handle TD clearing for multiple streams case When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for each, to ensure everything is reset properly and the caches cleared. Change the logic so that any N>1 TDs found active for different streams are deferred until after the first one is processed, calling xhci_invalidate_cancelled_tds() again from xhci_handle_cmd_set_deq() to queue another command until we are done with all of them. Also change the error/"should never happen" paths to ensure we at least clear any affected TDs, even if we can't issue a command to clear the hardware cache, and complain loudly with an xhci_warn() if this ever happens. This problem case dates back to commit e9df17eb1408 ("USB: xhci: Correct assumptions about number of rings per endpoint.") early on in the XHCI driver's life, when stream support was first added. It was then identified but not fixed nor made into a warning in commit 674f8438c121 ("xhci: split handling halted endpoints into two steps"), which added a FIXME comment for the problem case (without materially changing the behavior as far as I can tell, though the new logic made the problem more obvious). Then later, in commit 94f339147fc3 ("xhci: Fix failure to give back some cached cancelled URBs."), it was acknowledged again. [Mathias: commit 94f339147fc3 ("xhci: Fix failure to give back some cached cancelled URBs.") was a targeted regression fix to the previously mentioned patch. Users reported issues with usb stuck after unmounting/disconnecting UAS devices. This rolled back the TD clearing of multiple streams to its original state.] Apparently the commit author was aware of the problem (yet still chose to submit it): It was still mentioned as a FIXME, an xhci_dbg() was added to log the problem condition, and the remaining issue was mentioned in the commit description. The choice of making the log type xhci_dbg() for what is, at this point, a completely unhandled and known broken condition is puzzling and unfortunate, as it guarantees that no actual users would see the log in production, thereby making it nigh undebuggable (indeed, even if you turn on DEBUG, the message doesn't really hint at there being a problem at all). It took me months of random xHC crashes to finally find a reliable repro and be able to do a deep dive debug session, which could all have been avoided had this unhandled, broken condition been actually reported with a warning, as it should have been as a bug intentionally left in unfixed (never mind that it shouldn't have been left in at all). > Another fix to solve clearing the caches of all stream rings with > cancelled TDs is needed, but not as urgent. 3 years after that statement and 14 years after the original bug was introduced, I think it's finally time to fix it. And maybe next time let's not leave bugs unfixed (that are actually worse than the original bug), and let's actually get people to review kernel commits please. Fixes xHC crashes and IOMMU faults with UAS devices when handling errors/faults. Easiest repro is to use hdparm to mark an early sector (e.g. 1024) on a disk as bad, then cat /dev/sdX > /dev/null in a loop. At least in the case of JMicron controllers, the read errors end up having to cancel two TDs (for two queued requests to different streams) and the one that didn't get cleared properly ends up faulting the xHC entirely when it tries to access DMA pages that have since been unmapped, referred to by the stale TDs. This normally happens quickly (after two or three loops). After this fix, I left the cat in a loop running overnight and experienced no xHC failures, with all read errors recovered…

The Linux Kernel, the operating system core itself.

Security Fix(es):

A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set() function. This can result in I2cap connection or broadcast abnormality issue, possibly leading to denial of service.

(CVE-2024-24858)

In the Linux kernel, the following vulnerability has been resolved:

vfio/platform: Create persistent IRQ handlers

The vfio-platform SET_IRQS ioctl currently allows loopback triggering of an interrupt before a signaling eventfd has been configured by the user, which thereby allows a NULL pointer dereference.

Rather than register the IRQ relative to a valid trigger, register all IRQs in a disabled state in the device open path. This allows mask operations on the IRQ to nest within the overall enable state governed by a valid eventfd signal. This decouples @masked, protected by the @locked spinlock from @trigger, protected via the @igate mutex.

In doing so, it's guaranteed that changes to @trigger cannot race the IRQ handlers because the IRQ handler is synchronously disabled before modifying the trigger, and loopback triggering of the IRQ via ioctl is safe due to serialization with trigger changes via igate.

For compatibility, request_irq() failures are maintained to be local to the SET_IRQS ioctl rather than a fatal error in the open device path. This allows, for example, a userspace driver with polling mode support to continue to work regardless of moving the request_irq() call site. This necessarily blocks all SET_IRQS access to the failed index.(CVE-2024-26813)

In the Linux kernel, the following vulnerability has been resolved:

geneve: make sure to pull inner header in geneve_rx()

syzbot triggered a bug in geneve_rx() [1]

Issue is similar to the one I fixed in commit 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()")

We have to save skb->network_header in a temporary variable in order to be able to recompute the network_header pointer after a pskb_inet_may_pull() call.

pskb_inet_may_pull() makes sure the needed headers are in skb->head.

[1] BUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] BUG: KMSAN: uninit-value in geneve_rx drivers/net/geneve.c:279 [inline] BUG: KMSAN: uninit-value in geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391 IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] geneve_rx drivers/net/geneve.c:279 [inline] geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391 udp_queue_rcv_one_skb+0x1d39/0x1f20 net/ipv4/udp.c:2108 udp_queue_rcv_skb+0x6ae/0x6e0 net/ipv4/udp.c:2186 udp_unicast_rcv_skb+0x184/0x4b0 net/ipv4/udp.c:2346 __udp4_lib_rcv+0x1c6b/0x3010 net/ipv4/udp.c:2422 udp_rcv+0x7d/0xa0 net/ipv4/udp.c:2604 ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:461 [inline] ip_rcv_finish net/ipv4/ip_input.c:449 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5534 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648 process_backlog+0x480/0x8b0 net/core/dev.c:5976 __napi_poll+0xe3/0x980 net/core/dev.c:6576 napi_poll net/core/dev.c:6645 [inline] net_rx_action+0x8b8/0x1870 net/core/dev.c:6778 __do_softirq+0x1b7/0x7c5 kernel/softirq.c:553 do_softirq+0x9a/0xf0 kernel/softirq.c:454 __local_bh_enable_ip+0x9b/0xa0 kernel/softirq.c:381 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:820 [inline] __dev_queue_xmit+0x2768/0x51c0 net/core/dev.c:4378 dev_queue_xmit include/linux/netdevice.h:3171 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd…

The Linux Kernel, the operating system core itself.

Security Fix(es):

A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set() function. This can result in I2cap connection or broadcast abnormality issue, possibly leading to denial of service.

(CVE-2024-24858)

In the Linux kernel, the following vulnerability has been resolved:

sched/membarrier: reduce the ability to hammer on sys_membarrier

On some systems, sys_membarrier can be very expensive, causing overall slowdowns for everything. So put a lock on the path in order to serialize the accesses to prevent the ability for this to be called at too high of a frequency and saturate the machine.(CVE-2024-26602)

In the Linux kernel, the following vulnerability has been resolved:

hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed

If hv_netvsc driver is unloaded and reloaded, the NET_DEVICE_REGISTER handler cannot perform VF register successfully as the register call is received before netvsc_probe is finished. This is because we register register_netdevice_notifier() very early( even before vmbus_driver_register()). To fix this, we try to register each such matching VF( if it is visible as a netdevice) at the end of netvsc_probe.(CVE-2024-26820)

In the Linux kernel, the following vulnerability has been resolved:

geneve: make sure to pull inner header in geneve_rx()

syzbot triggered a bug in geneve_rx() [1]

Issue is similar to the one I fixed in commit 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()")

We have to save skb->network_header in a temporary variable in order to be able to recompute the network_header pointer after a pskb_inet_may_pull() call.

pskb_inet_may_pull() makes sure the needed headers are in skb->head.

[1] BUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] BUG: KMSAN: uninit-value in geneve_rx drivers/net/geneve.c:279 [inline] BUG: KMSAN: uninit-value in geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391 IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] geneve_rx drivers/net/geneve.c:279 [inline] geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391 udp_queue_rcv_one_skb+0x1d39/0x1f20 net/ipv4/udp.c:2108 udp_queue_rcv_skb+0x6ae/0x6e0 net/ipv4/udp.c:2186 udp_unicast_rcv_skb+0x184/0x4b0 net/ipv4/udp.c:2346 __udp4_lib_rcv+0x1c6b/0x3010 net/ipv4/udp.c:2422 udp_rcv+0x7d/0xa0 net/ipv4/udp.c:2604 ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:461 [inline] ip_rcv_finish net/ipv4/ip_input.c:449 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5534 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648 process_backlog+0x480/0x8b0 net/core/dev.c:5976 __napi_poll+0xe3/0x980 net/core/dev.c:6576 napi_poll net/core/dev.c:6645 [inline] net_rx_action+0x8b8/0x1870 net/core/dev.c:6778 __do_softirq+0x1b7/0x7c5 kernel/softirq.c:553 do_softirq+0x9a/0xf0 kernel/softirq.c:454 __local_bh_enable_ip+0x9b/0xa0 kernel/softirq.c:381 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:820 [inline] __dev_queue_xmit+0x2768/0x51c0 net/core/dev.c:4378 dev_queue_xmit include/linux/netdevice.h:3171 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min

While the $val/$val2 values passed in from userspace are always >= 0 integers, the limits of the control can be signed integers and the $min can be non-zero and less than zero. To correctly validate $val/$val2 against platform_max, add the $min offset to val first.(CVE-2022-48917)

In the Linux kernel, the following vulnerability has been resolved:

tcp: do not accept ACK of bytes we never sent

This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow.

ACK seq validation is currently following RFC 5961 5.2 guidelines:

The ACK value is considered acceptable only if it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <= SND.NXT). All incoming segments whose ACK value doesn't satisfy the above condition MUST be discarded and an ACK sent back. It needs to be noted that RFC 793 on page 72 (fifth check) says: "If the ACK is a duplicate (SEG.ACK < SND.UNA), it can be ignored. If the ACK acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an ACK, drop the segment, and return". The "ignored" above implies that the processing of the incoming data segment continues, which means the ACK value is treated as acceptable. This mitigation makes the ACK check more stringent since any ACK < SND.UNA wouldn't be accepted, instead only ACKs that are in the range ((SND.UNA - MAX.SND.WND) <= SEG.ACK <= SND.NXT) get through.

This can be refined for new (and possibly spoofed) flows, by not accepting ACK for bytes that were never sent.

This greatly improves TCP security at a little cost.

I added a Fixes: tag to make sure this patch will reach stable trees, even if the 'blamed' patch was adhering to the RFC.

tp->bytes_acked was added in linux-4.2

Following packetdrill test (courtesy of Yepeng Pan) shows the issue at hand:

0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0 +0 listen(3, 1024) = 0

// ---------------- Handshake ------------------- //

// when window scale is set to 14 the window size can be extended to // 65535 * (2^14) = 1073725440. Linux would accept an ACK packet // with ack number in (Server_ISN+1-1073725440. Server_ISN+1) // ,though this ack number acknowledges some data never // sent by the server.

+0 < S 0:0(0) win 65535 <mss 1400,nop,wscale 14> +0 > S. 0:0(0) ack 1 <...> +0 < . 1:1(0) ack 1 win 65535 +0 accept(3, ..., ...) = 4

// For the established connection, we send an ACK packet, // the ack packet uses ack number 1 - 1073725300 + 2^32, // where 2^32 is used to wrap around. // Note: we used 1073725300 instead of 1073725440 to avoid possible // edge cases. // 1 - 1073725300 + 2^32 = 3221241997

// Oops, old kernels happily accept this packet. +0 < . 1:1001(1000) ack 3221241997 win 65535

// After the kernel fix the following will be replaced by a challenge ACK, // and prior malicious frame would be dropped. +0 > . 1:1(0) ack 1001(CVE-2023-52881)

A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.

(CVE-2024-24857)

A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function. This can result in a bluetooth sniffing exception issue, possibly leading denial of service.

(CVE-2024-24859)

In the Linux kernel, the following vulnerability has been resolved:

cgroup/cpuset: Prevent UAF in proc_cpuset_show()

An UAF can happen when /proc/cpuset is read as reported in [1].

This can be reproduced by the following…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:usb: musb: sunxi: Fix accessing an released usb phyCommit 6ed05c68cbca ( usb: musb: sunxi: Explicitly release USB PHY onexit ) will cause that usb phy @glue->xceiv is accessed after released.1) register platform driver @sunxi_musb_driver// get the usb phy @glue->xceivsunxi_musb_probe() -> devm_usb_get_phy().2) register and unregister platform driver @musb_drivermusb_probe() -> sunxi_musb_init()use the phy here//the phy is released heremusb_remove() -> sunxi_musb_exit() -> devm_usb_put_phy()3) register @musb_driver againmusb_probe() -> sunxi_musb_init()use the phy here but the phy has been released at 2)....Fixed by reverting the commit, namely, removing devm_usb_put_phy()from sunxi_musb_exit().(CVE-2024-50269)

In the Linux kernel, the following vulnerability has been resolved:dm cache: fix out-of-bounds access to the dirty bitset when resizingdm-cache checks the dirty bits of the cache blocks to be dropped whenshrinking the fast device, but an index bug in bitset iteration causesout-of-bounds access.Reproduce steps:1. create a cache device of 1024 cache blocks (128 bytes dirty bitset)dmsetup create cmeta --table 0 8192 linear /dev/sdc 0 dmsetup create cdata --table 0 131072 linear /dev/sdc 8192 dmsetup create corig --table 0 524288 linear /dev/sdc 262144 dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=directdmsetup create cache --table 0 524288 cache /dev/mapper/cmeta /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0 2. shrink the fast device to 512 cache blocks, triggering out-of-bounds access to the dirty bitset (offset 0x80)dmsetup suspend cachedmsetup reload cdata --table 0 65536 linear /dev/sdc 8192 dmsetup resume cdatadmsetup resume cacheKASAN reports: BUG: KASAN: vmalloc-out-of-bounds in cache_preresume+0x269/0x7b0 Read of size 8 at addr ffffc900000f3080 by task dmsetup/131 (...snip...) The buggy address belongs to the virtual mapping at [ffffc900000f3000, ffffc900000f5000) created by: cache_ctr+0x176a/0x35f0 (...snip...) Memory state around the buggy address: ffffc900000f2f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900000f3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc900000f3080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc900000f3100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900000f3180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8Fix by making the index post-incremented.(CVE-2024-50279)

In the Linux kernel, the following vulnerability has been resolved:iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table()If per_time_scales[i] or per_time_gains[i] kcalloc fails in the for loopof iio_gts_build_avail_scale_table(), the err_free_out will fail to callkfree() each time when i is reduced to 0, so all the per_time_scales[0]and per_time_gains[0] will not be freed, which will cause memory leaks.Fix it by checking if i >= 0.(CVE-2024-53076)

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath10k: avoid NULL pointer error during sdio remove

When running 'rmmod ath10k', ath10k_sdio_remove() will free sdio workqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON is set to yes, kernel panic will happen: Call trace: destroy_workqueue+0x1c/0x258 ath10k_sdio_remove+0x84/0x94 sdio_bus_remove+0x50/0x16c device_release_driver_internal+0x188/0x25c device_driver_detach+0x20/0x2c

This is because during 'rmmod ath10k', ath10k_sdio_remove() will call ath10k_core_destroy() before destroy_workqueue(). wiphy_dev_release() will finally be called in ath10k_core_destroy(). This function will free struct cfg80211_registered_device *rdev and all its members, including wiphy, dev and the pointer of sdio workqueue. Then the pointer of sdio workqueue…

In the Linux kernel, the following vulnerability has been resolved: dm cache: fix out-of-bounds access to the dirty bitset when resizing dm-cache checks the dirty bits of the cache blocks to be dropped when shrinking the fast device, but an index bug in bitset iteration causes out-of-bounds access. Reproduce steps: 1. create a cache device of 1024 cache blocks (128 bytes dirty bitset) dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. shrink the fast device to 512 cache blocks, triggering out-of-bounds access to the dirty bitset (offset 0x80) dmsetup suspend cache dmsetup reload cdata --table "0 65536 linear /dev/sdc 8192" dmsetup resume cdata dmsetup resume cache KASAN reports: BUG: KASAN: vmalloc-out-of-bounds in cache_preresume+0x269/0x7b0 Read of size 8 at addr ffffc900000f3080 by task dmsetup/131 (...snip...) The buggy address belongs to the virtual mapping at [ffffc900000f3000, ffffc900000f5000) created by: cache_ctr+0x176a/0x35f0 (...snip...) Memory state around the buggy address: ffffc900000f2f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900000f3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc900000f3080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc900000f3100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900000f3180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 Fix by making the index post-incremented.

• HID: core: zero-initialize the report buffer {CVE-2024-50302}
• net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
• bus: mhi: host: Add alignment check for event ring read pointer {CVE-2023-52494}
• net: sched: fix ets qdisc OOB Indexing {CVE-2025-21692}
• parport: Proper fix for array out-of-bounds access {CVE-2024-50074}
• udf: fix uninit-value use in udf_get_fileshortad {CVE-2024-50143}
• security/keys: fix slab-out-of-bounds in key_task_permission {CVE-2024-50301}
• usb: typec: altmode should keep reference to parent {CVE-2024-50150}
• dm cache: fix potential out-of-bounds access on the first resume {CVE-2024-50278}
• dm cache: optimize dirty bit checking with find_next_bit when resizing {CVE-2024-50278}
• dm cache: fix out-of-bounds access to the dirty bitset when resizing {CVE-2024-50279}
• spi: nxp-fspi: fix the KASAN report out-of-bounds bug {CVE-2024-46853}
• smb: client: fix OOBs when building SMB2_IOCTL request {CVE-2024-50151}
• net: sched: fix use-after-free in taprio_change() {CVE-2024-50127}
• USB: serial: io_edgeport: fix use after free in debug printk {CVE-2024-50267}
• wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() {CVE-2024-53059}
• wifi: iwlwifi: mvm: disconnect station vifs if recovery failed {CVE-2024-53059}
• tracing: Consider the NULL character when validating the event length {CVE-2024-50131}
• crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612}
• NFSD: fix hang in nfsd4_shutdown_callback {CVE-2025-21795}
• NFSD: add courteous server support for thread with only delegation {CVE-2025-21795}
• mptcp: refactor passive socket initialization {CVE-2024-26782}
• mptcp: implement delayed seq generation for passive fastopen {CVE-2024-26782}
• smb: client: fix potential UAF in smb2_is_valid_lease_break() {CVE-2024-35864}
• smb: client: fix potential UAF in cifs_dump_full_key() {CVE-2024-35866}
• cifs: fix session state check in reconnect to avoid use-after-free issue {CVE-2024-35866}
• smb: client: fix potential UAF in smb2_is_network_name_deleted() {CVE-2024-35862}
• smb: client: fix potential UAF in is_valid_oplock_break() {CVE-2024-35863}
• smb: client: fix potential UAF in cifs_stats_proc_show() {CVE-2024-35867}
• bpf: Protect against int overflow for stack access size {CVE-2024-35905}
• bpf: Fix verification of indirect var-off stack access {CVE-2024-35905}
• devlink: fix possible use-after-free and memory leaks in devlink_init() {CVE-2024-26734}
• leds: trigger: Unregister sysfs attributes before calling deactivate() {CVE-2024-43830}
• ionic: fix use after netif_napi_del() {CVE-2024-39502}
• ionic: clean interrupt before enabling queue to avoid credit race {CVE-2024-39502}
• net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink {CVE-2024-44970}
• vt_ioctl: fix array_index_nospec in vt_setactivate {CVE-2022-48804}
• hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() {CVE-2022-49011}
• raid1: fix use-after-free for original bio in raid1_write_request() {CVE-2024-35979}
• md/raid1: free the r1bio before waiting for blocked rdev {CVE-2024-35979}
• drm/amdgpu: fix usage slab after free {CVE-2024-56551}
• drm/amd: Use amdgpu_ucode_* helpers for GPU info bin {CVE-2024-56551}
• drm/amd: Add a new helper for loading/validating microcode {CVE-2024-56551}
• drm/amd: check num of link levels when update pcie param {CVE-2023-52812}
• drm/amd: Update update_pcie_parameters functions to use uint8_t arguments {CVE-2023-52812}
• drm/amd: Disable PP_PCIE_DPM_MASK when dynamic speed switching not supported {CVE-2023-52812}
• drm/amd: Fix logic error in sienna_cichlid_update_pcie_parameters() {CVE-2023-52812}
• drm/amd: Use amdgpu_device_pcie_dynamic_switching_supported() for SMU7 {CVE-2023-52812}
• drm/amd: Align SMU11 SMU_MSG_OverridePcieParameters implementation with SMU13 {CVE-2023-52812}
• drm/amd/pm: conditionally disable pcie lane switching for some sienna_cichlid SKUs {CVE-2023-52812}
• drm/amd: Move helper for dynamic speed switch check out…

• sctp: sysctl: auth_enable: avoid using current->nsproxy
• sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy {CVE-2025-21640}
• bpf: Use preempt_count() directly in bpf_send_signal_common()
• Revert "sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy"
• jfs: fix slab-out-of-bounds read in ea_get()
• serial: 8250_dma: terminate correct DMA in tx_dma_flush()
• Revert "sctp: sysctl: auth_enable: avoid using current->nsproxy"
• net: usb: usbnet: restore usb%d name exception for local mac addresses
• vlan: fix memory leak in vlan_newlink() {CVE-2022-49636}
• rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity
• LTS tag: v5.4.291
• eeprom: digsy_mtc: Make GPIO lookup table match the device
• slimbus: messaging: Free transaction ID in delayed interrupt scenario {CVE-2025-21914}
• intel_th: pci: Add Panther Lake-P/U support
• intel_th: pci: Add Panther Lake-H support
• intel_th: pci: Add Arrow Lake support
• Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
• xhci: pci: Fix indentation in the PCI device ID definitions
• usb: gadget: Check bmAttributes only if configuration is valid
• usb: gadget: Fix setting self-powered state on suspend
• usb: gadget: Set self-powered based on MaxPower and bmAttributes
• usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality
• usb: typec: ucsi: increase timeout for PPM reset operations
• usb: atm: cxacru: fix a flaw in existing endpoint checks {CVE-2025-21916}
• usb: renesas_usbhs: Flush the notify_hotplug_work {CVE-2025-21917}
• usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader
• usb: renesas_usbhs: Use devm_usb_get_phy()
• usb: renesas_usbhs: Call clk_put()
• Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"
• gpio: rcar: Fix missing of_node_put() call
• net: ipv6: fix missing dst ref drop in ila lwtunnel
• net: ipv6: fix dst ref loop in ila lwtunnel
• net-timestamp: support TCP GSO case for a few missing flags
• vlan: enforce underlying device type {CVE-2025-21920}
• ppp: Fix KMSAN uninit-value warning with bpf {CVE-2025-21922}
• be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
• drm/sched: Fix preprocessor guard
• hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()
• llc: do not use skb_get() before dev_queue_xmit() {CVE-2025-21925}
• hwmon: (ad7314) Validate leading zero bits and return error
• hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
• hwmon: (pmbus) Initialise page count in pmbus_identify()
• caif_virtio: fix wrong pointer check in cfv_probe() {CVE-2025-21904}
• net: gso: fix ownership in __udp_gso_segment {CVE-2025-21926}
• HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
• HID: google: fix unused variable warning under !CONFIG_ACPI
• wifi: iwlwifi: limit printed string from FW file {CVE-2025-21905}
• mm/page_alloc: fix uninitialized variable
• rapidio: fix an API misues when rio_add_net() fails {CVE-2025-21934}
• rapidio: add check for rio_add_net() in rio_scan_alloc_net()
• wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
• wifi: cfg80211: regulatory: improve invalid hints checking {CVE-2025-21910}
• x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
• x86/cpu: Validate CPUID leaf 0x2 EDX output
• x86/cacheinfo: Validate CPUID leaf 0x2 EDX output
• platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
• drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
• ALSA: hda/realtek: update ALC222 depop optimize
• ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
• HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
• Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'"
• drm/amdgpu: disable BAR resize on Dell G5 SE
• drm/amdgpu: Check extended configuration space register when system uses large bar
• drm/amdgpu: skip BAR resizing if the bios already…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070)
• CVE-2024-50205: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (bsc#1233293).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233453).
• CVE-2024-50267: USB: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).
• CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).
• CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).

The following non-security bugs were fixed:

• Update config files (bsc#1218644).
• e1000e: Correct NVM checksum verification flow (jsc#SLE-8100).
• e1000e: Correct NVM checksum verification flow (jsc#SLE-8100).
• e1000e: Do not take care about recovery NVM checksum (jsc#SLE-8100).
• e1000e: Do not take care about recovery NVM checksum (jsc#SLE-8100).
• ena: Remove rcu_read_lock() around XDP program invocation (bsc#1198778).
• ethernet: amazon: ena: A typo fix in the file ena_com.h (bsc#1198778).
• initramfs: avoid filename buffer overrun (bsc#1232436).
• kernel-binary: Enable livepatch package only when livepatch is enabled Otherwise the filelist may be empty failing the build (bsc#1218644).
• net: ena: Add capabilities field with support for ENI stats capability (bsc#1198778).
• net: ena: Add debug prints for invalid req_id resets (bsc#1198778).
• net: ena: Change ENI stats support check to use capabilities field (bsc#1198778).
• net: ena: Change return value of ena_calc_io_queue_size() to void (bsc#1198778).
• net: ena: Change the name of bad_csum variable (bsc#1198778).
• net: ena: Extract recurring driver reset code into a function (bsc#1198778).
• net: ena: Flush XDP packets on error (bsc#1198778).
• net: ena: Improve error logging in driver (bsc#1198778).
• net: ena: Move reset completion print to the reset function (bsc#1198778).
• net: ena: Remove ena_calc_queue_size_ctx struct (bsc#1198778).
• net: ena: Remove module param and change message severity (bsc#1198778).
• net: ena: Remove redundant return code check (bsc#1198778).
• net: ena: Remove unused code (bsc#1198778).
• net: ena: Set tx_info->xdpf value to NULL (bsc#1198778).
• net: ena: Update XDP verdict upon failure (bsc#1198778).
• net: ena: Use bitmask to indicate packet redirection (bsc#1198778).
• net: ena: Use dev_alloc() in RX buffer allocation (bsc#1198778).
• net: ena: add device distinct log prefix to files (bsc#1198778).
• net: ena: add jiffies of last napi call to stats (bsc#1198778).
• net: ena: aggregate doorbell common operations into a function (bsc#1198778).
• net: ena: aggregate stats increase into a function (bsc#1198778).
• net: ena: fix DMA mapping function issues in XDP (bsc#1198778).
• net: ena: fix coding style nits (bsc#1198778).
• net: ena: fix inaccurate print type (bsc#1198778).
• net: ena: introduce XDP redirect…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-47703: bpf, lsm: add check for BPF LSM return value (bsc#1231946).
• CVE-2024-49852: scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del() (bsc#1232819).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49881: ext4: update orig_path in ext4_find_extent() (bsc#1232201).
• CVE-2024-49883: ext4: aovid use-after-free in ext4_ext_insert_extent() (bsc#1232199).
• CVE-2024-49894: drm/amd/display: Fix index out of bounds in degamma hardware format translation (bsc#1232354).
• CVE-2024-49895: drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation (bsc#1232352).
• CVE-2024-49897: drm/amd/display: Check phantom_stream before it is used (bsc#1232355).
• CVE-2024-49899: drm/amd/display: Initialize denominators' default to 1 (bsc#1232358).
• CVE-2024-49901: drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs (bsc#1232305).
• CVE-2024-49909: drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func (bsc#1232337).
• CVE-2024-49911: drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func (bsc#1232366).
• CVE-2024-49912: drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream' (bsc#1232367).
• CVE-2024-49913: drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream (bsc#1232307).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49922:…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
• CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
• CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-47745: mm: call the security_mmap_file() LSM hook in remap_file_pages() (bsc#1232135).
• CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49934: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (bsc#1232387).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
• CVE-2024-49968: ext4: filesystems without casefold feature cannot be mounted with siphash (bsc#1232264).
• CVE-2024-49983: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (bsc#1232096).
• CVE-2024-49989: drm/amd/display: fix double free issue during amdgpu module unload (bsc#1232483).
• CVE-2024-50009: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (bsc#1232318).
• CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
• CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50093: thermal: intel: int340x: processor: Fix warning during module unload (bsc#1232877).
• CVE-2024-50098: scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down (bsc#1232881).
• CVE-2024-50108: drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too (bsc#1232884).
• CVE-2024-50110: xfrm: fix one more kernel-infoleak in algo dumping (bsc#1232885).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-47703: bpf, lsm: add check for BPF LSM return value (bsc#1231946).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49888: bpf: Fix a sdiv overflow issue (bsc#1232208).
• CVE-2024-49899: drm/amd/display: Initialize denominators' default to 1 (bsc#1232358).
• CVE-2024-49911: drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func (bsc#1232366).
• CVE-2024-49912: drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream' (bsc#1232367).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49922: drm/amd/display: Check null pointers before using them (bsc#1232374).
• CVE-2024-49923: drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags (bsc#1232361).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49933: blk_iocost: fix more out of bound shifts (bsc#1232368).
• CVE-2024-49934: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (bsc#1232387).
• CVE-2024-49944: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start (bsc#1232166).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
• CVE-2024-49968: ext4: filesystems without casefold feature cannot be mounted with siphash (bsc#1232264).
• CVE-2024-49983:…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52524: net: nfc: llcp: Add lock when modifying device list (bsc#1220927).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50205: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (bsc#1233293).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233453).
• CVE-2024-50267: usb: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).
• CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).
• CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).

The following non-security bugs were fixed:

• e1000e: Correct NVM checksum verification flow (jsc#SLE-8100).
• e1000e: Do not take care about recovery NVM checksum (jsc#SLE-8100).
• ena: Remove rcu_read_lock() around XDP program invocation (bsc#1198778).
• ethernet: amazon: ena: A typo fix in the file ena_com.h (bsc#1198778).
• initramfs: avoid filename buffer overrun (bsc#1232436).
• kernel-binary: Enable livepatch package only when livepatch is enabled (bsc#1218644).
• net: ena: Add capabilities field with support for ENI stats capability (bsc#1198778).
• net: ena: Add debug prints for invalid req_id resets (bsc#1198778).
• net: ena: Change ENI stats support check to use capabilities field (bsc#1198778).
• net: ena: Change return value of ena_calc_io_queue_size() to void (bsc#1198778).
• net: ena: Change the name of bad_csum variable (bsc#1198778).
• net: ena: Extract recurring driver reset code into a function (bsc#1198778).
• net: ena: Flush XDP packets on error (bsc#1198778).
• net: ena: Improve error logging in driver (bsc#1198778).
• net: ena: Move reset completion print to the reset function (bsc#1198778).
• net: ena: Remove ena_calc_queue_size_ctx struct (bsc#1198778).
• net: ena: Remove module param and change message severity (bsc#1198778).
• net: ena: Remove redundant return code check (bsc#1198778).
• net: ena: Remove unused code (bsc#1198778).
• net: ena: Set tx_info->xdpf value to NULL (bsc#1198778).
• net: ena: Update XDP verdict upon failure (bsc#1198778).
• net: ena: Use bitmask to indicate packet redirection (bsc#1198778).
• net: ena: Use dev_alloc() in RX buffer allocation (bsc#1198778).
• net: ena: add device distinct log prefix to files (bsc#1198778).
• net: ena: add jiffies of last napi call to stats (bsc#1198778).
• net: ena: aggregate doorbell common operations into a function (bsc#1198778).
• net: ena: aggregate stats increase into a function (bsc#1198778).
• net: ena: fix DMA mapping function issues in XDP (bsc#1198778).
• net: ena: fix coding style nits (bsc#1198778).
• net: ena: fix inaccurate print type (bsc#1198778).
• net: ena: introduce XDP redirect implementation (bsc#1198778).
• net: ena: introduce ndo_xdp_xmit() function for XDP_REDIRECT (bsc#1198778).
• net: ena: make symbol 'ena_alloc_map_page' static (bsc#1198778).
• net: ena: re-organize code to improve…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-53095: smb: client: Fix use-after-free of network namespace (bsc#1233642).
• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2023-6270: aoe: fix the potential use-after-free problem in more places (bsc#1218562).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46828: sched: sch_cake: fix bulk flow accounting logic for host fairness (bsc#1231114).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50205: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (bsc#1233293).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
• CVE-2024-50259: netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() (bsc#1233214).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233453).
• CVE-2024-50267: usb: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).
• CVE-2024-50274: idpf: avoid vport access in idpf_get_link_ksettings (bsc#1233463).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).
• CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).
• CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).
• CVE-2024-53068: firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() (bsc#1233561).

The following non-security bugs were fixed:

• Update config files (bsc#1218644).
• Update config files. Enabled IDPF for ARM64 (bsc#1221309)
• initramfs: avoid filename buffer overrun (bsc#1232436).
• kernel-binary: Enable livepatch package only when livepatch is enabled Otherwise the filelist may be empty failing the build (bsc#1218644).
• mm/memory: add non-anonymous page check in the copy_present_page() (bsc#1231646).
• rpm/scripts: Remove obsolete Symbols.list Symbols.list is not longer needed by the new klp-convert implementation. (bsc#1218644)
• x86/kexec: Add EFI config table identity mapping for kexec kernel (bsc#1220382).
• x86/mm/ident_map: Use gbpages only where full GB page should be mapped (bsc#1220382).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
• CVE-2024-50154: tcp: Fix use-after-free of nreq in reqsk_timer_handler() (bsc#1233070).
• CVE-2024-50205: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (bsc#1233293).
• CVE-2024-50259: netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() (bsc#1233214).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233453).
• CVE-2024-50267: USB: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).
• CVE-2024-50274: idpf: avoid vport access in idpf_get_link_ksettings (bsc#1233463).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).
• CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).
• CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).
• CVE-2024-53068: firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() (bsc#1233561).

The following non-security bugs were fixed:

• Update config files (bsc#1218644).
• Update config files. Enabled IDPF for ARM64 (bsc#1221309)
• kernel-binary: Enable livepatch package only when livepatch is enabled Otherwise the filelist may be empty failing the build (bsc#1218644).
• mm/memory: add non-anonymous page check in the copy_present_page() (bsc#1231646).
• rpm/scripts: Remove obsolete Symbols.list Symbols.list is not longer needed by the new klp-convert implementation. (bsc#1218644)

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
• CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48957: dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() (bsc#1231973).
• CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
• CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
• CVE-2022-48980: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() (bsc#1232233).
• CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
• CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2022-49017: tipc: re-fetch skb cb after tipc_msg_validate (bsc#1232004).
• CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
• CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB (bsc#1228709).
• CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005).
• CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837).
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46716: dmaengine: altera-msgdma:…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48853: swiotlb: fix info leak with DMA_FROM_DEVICE (bsc#1228015).
• CVE-2024-26801: Bluetooth: Avoid potential use-after-free in hci_error_reset (bsc#1222413).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2024-26886: Bluetooth: af_bluetooth: Fix deadlock (bsc#1223044).
• CVE-2024-27051: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value (bsc#1223769).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-46771: can: bcm: Remove proc entry when dev is unregistered (bsc#1230766).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47660: fsnotify: clear PARENT_WATCHED flags lazily (bsc#1231439).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-49858: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption (bsc#1232251).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49938: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit (bsc#1232552).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
• CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
• CVE-2024-50044: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (bsc#1231904).
• CVE-2024-50055: driver core: bus: Fix double free in driver API bus_register() (bsc#1232329).
• CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
• CVE-2024-50074: parport: Proper fix for array out-of-bounds access (bsc#1232507).
• CVE-2024-50095: RDMA/mad: Improve handling of timed out WRs of mad agent (bsc#1232873).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50117: drm/amd: Guard against bad data for ATIF ACPI method (bsc#1232897).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50135: nvme-pci: fix race condition between reset and nvme_dev_disable() (bsc#1232888).
• CVE-2024-50148: Bluetooth: bnep: fix wild-memory-access in proto_unregister (bsc#1233063).
• CVE-2024-50150: usb: typec: altmode should keep reference to parent (bsc#1233051).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50167: be2net: fix potential memory leak in be_xmit() (bsc#1233049).
• CVE-2024-50171: net: systemport: fix potential memory leak in bcm_sysport_xmit() (bsc#1233057).
• CVE-2024-50183: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (bsc#1233130).
• CVE-2024-50187: drm/vc4: Stop the active perfmon before being destroyed (bsc#1233108).
• CVE-2024-50195: posix-clock: Fix missing timespec64 check in pc_clock_settime() (bsc#1233103).
• CVE-2024-50218: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
• CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
• CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: explicitly exit when ext4_find_inline_entry returns an error (bsc#1231920).
• CVE-2024-47745: mm: split critical region in remap_file_pages() and invoke LSMs in between (bsc#1232135).
• CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49934: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (bsc#1232387).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
• CVE-2024-49968: ext4: fix error message when rejecting the default hash (bsc#1232264).
• CVE-2024-49983: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (bsc#1232096).
• CVE-2024-49989: drm/amd/display: fix double free issue during amdgpu module unload (bsc#1232483).
• CVE-2024-50009: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (bsc#1232318).
• CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
• CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50093: thermal: intel: int340x: processor: Fix warning during module unload (bsc#1232877).
• CVE-2024-50098: scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down (bsc#1232881).
• CVE-2024-50108: drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too (bsc#1232884).
• CVE-2024-50110: xfrm: fix one more kernel-infoleak in algo dumping (bsc#1232885).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix…

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2023-6270: aoe: fix the potential use-after-free problem in more places (bsc#1218562).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46828: sched: sch_cake: fix bulk flow accounting logic for host fairness (bsc#1231114).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs: do not BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() (bsc#1231094).
• CVE-2024-46843: scsi: ufs: core: Remove SCSI host only if added…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50205: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (bsc#1233293).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233453).
• CVE-2024-50267: usb: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).
• CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).
• CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).

The following non-security bugs were fixed:

• Update config files (bsc#1218644).
• initramfs: avoid filename buffer overrun (bsc#1232436).
• kernel-binary: Enable livepatch package only when livepatch is enabled Otherwise the filelist may be empty failing the build (bsc#1218644).
• rpm/scripts: Remove obsolete Symbols.list Symbols.list is not longer needed by the new klp-convert implementation. (bsc#1218644)

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48853: swiotlb: fix info leak with DMA_FROM_DEVICE (bsc#1228015).
• CVE-2024-26801: Bluetooth: Avoid potential use-after-free in hci_error_reset (bsc#1222413).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2024-26886: Bluetooth: af_bluetooth: Fix deadlock (bsc#1223044).
• CVE-2024-27051: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value (bsc#1223769).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-46771: can: bcm: Remove proc entry when dev is unregistered (bsc#1230766).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47660: fsnotify: clear PARENT_WATCHED flags lazily (bsc#1231439).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-49858: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption (bsc#1232251).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49938: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit (bsc#1232552).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
• CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
• CVE-2024-50044: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (bsc#1231904).
• CVE-2024-50055: driver core: bus: Fix double free in driver API bus_register() (bsc#1232329).
• CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
• CVE-2024-50074: parport: Proper fix for array out-of-bounds access (bsc#1232507).
• CVE-2024-50095: RDMA/mad: Improve handling of timed out WRs of mad agent (bsc#1232873).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50117: drm/amd: Guard against bad data for ATIF ACPI method (bsc#1232897).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50135: nvme-pci: fix race condition between reset and nvme_dev_disable() (bsc#1232888).
• CVE-2024-50148: Bluetooth: bnep: fix wild-memory-access in proto_unregister (bsc#1233063).
• CVE-2024-50150: usb: typec: altmode should keep reference to parent (bsc#1233051).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50167: be2net: fix potential memory leak in be_xmit() (bsc#1233049).
• CVE-2024-50171: net: systemport: fix potential memory leak in bcm_sysport_xmit() (bsc#1233057).
• CVE-2024-50183: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (bsc#1233130).
• CVE-2024-50187: drm/vc4: Stop the active perfmon before being destroyed (bsc#1233108).
• CVE-2024-50195: posix-clock: Fix missing timespec64 check in pc_clock_settime() (bsc#1233103).
• CVE-2024-50218: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).
• CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).
• CVE-2024-36915: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies (bsc#1225758).
• CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
• CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).
• CVE-2024-44996: vsock: fix recursive ->recvmsg calls (bsc#1230205).
• CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).
• CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).
• CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).
• CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).
• CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).
• CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).
• CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467).
• CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).
• CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558).
• CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).
• CVE-2024-53099: bpf: Check validity of link->type in bpf_link_show_fdinfo() (bsc#1233772).
• CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).
• CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).
• CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).
• CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).
• CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).
• CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).
• CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).
• CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).
• CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)
• CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).
• CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
• CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).
• CVE-2024-53161: EDAC/bluefield: Fix potential integer overflow (bsc#1234856).
• CVE-2024-53179: smb: client: fix use-after-free of signing key (bsc#1234921).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235004).
• CVE-2024-53216: nfsd: fix UAF when access ex_uuid or ex_stats (bsc#1235003).
• CVE-2024-53222: zram: fix NULL pointer in comp_algorithm_show() (bsc#1234974).
• CVE-2024-53234: erofs: handle NONHEAD !delta[1] lclusters gracefully (bsc#1235045).
• CVE-2024-53240: xen/netfront: fix crash when removing device (bsc#1234281).
• CVE-2024-53241: x86/xen: use new hypercall functions instead of hypercall page (bsc#1234282).
• CVE-2024-56549: cachefiles: Fix NULL pointer dereference in object->file (bsc#1234912).
• CVE-2024-56566: mm/slub: Avoid list corruption when removing a slab from the full list (bsc#1235033).
• CVE-2024-56582: btrfs: fix use-after-free in…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).
• CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).
• CVE-2024-36915: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies (bsc#1225758).
• CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
• CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).
• CVE-2024-44996: vsock: fix recursive ->recvmsg calls (bsc#1230205).
• CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).
• CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).
• CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).
• CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).
• CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).
• CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).
• CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).
• CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
• CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).
• CVE-2024-53095: smb: client: Fix use-after-free of network namespace (bsc#1233642).
• CVE-2024-53099: bpf: Check validity of link->type in bpf_link_show_fdinfo() (bsc#1233772).
• CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).
• CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).
• CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).
• CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).
• CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).
• CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).
• CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).
• CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).
• CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)
• CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).
• CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
• CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).
• CVE-2024-53161: EDAC/bluefield: Fix potential integer overflow (bsc#1234856).
• CVE-2024-53179: smb: client: fix use-after-free of signing key (bsc#1234921).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235004).
• CVE-2024-53216: nfsd: fix UAF when access ex_uuid or ex_stats (bsc#1235003).
• CVE-2024-53222: zram: fix NULL pointer in comp_algorithm_show() (bsc#1234974).
• CVE-2024-53234: erofs: handle NONHEAD !delta[1] lclusters gracefully (bsc#1235045).
• CVE-2024-53240: xen/netfront: fix crash when removing device (XSA-465 bsc#1234281).
• CVE-2024-53241: x86/xen: use new hypercall functions instead of hypercall page (XSA-466 bsc#1234282).
• CVE-2024-56549: cachefiles: Fix…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-48742: rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() (bsc#1226694).
• CVE-2022-49033: btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (bsc#1232045).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-33951: Fixed a race condition that could have led to an information disclosure inside the vmwgfx driver (bsc#1211593).
• CVE-2023-33952: Fixed a double free that could have led to a local privilege escalation inside the vmwgfx driver (bsc#1211595).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2024-26886: Bluetooth: af_bluetooth: Fix deadlock (bsc#1223044).
• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-36915: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies (bsc#1225758).
• CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).
• CVE-2024-47666: scsi: pm80xx: Set phy->enable_completion only when we wait for it (bsc#1231453).
• CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).
• CVE-2024-49944: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start (bsc#1232166).
• CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
• CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).
• CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).
• CVE-2024-50166: fsl/fman: Fix refcount handling of fman-related devices (bsc#1233050).
• CVE-2024-50181: clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D (bsc#1233127).
• CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).
• CVE-2024-50211: udf: refactor inode_bmap() to handle error (bsc#1233096).
• CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).
• CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).
• CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).
• CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50296: net: hns3: fix kernel crash when uninstalling driver (bsc#1233485).
• CVE-2024-53051: drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (bsc#1233547).
• CVE-2024-53055: wifi: iwlwifi: mvm: fix 6 GHz scan construction (bsc#1233550).
• CVE-2024-53056: drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() (bsc#1233568).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
• CVE-2024-53072: platform/x86/amd/pmc: Detect when STB is not available (bsc#1233564).
• CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).
• CVE-2024-53095: smb: client: Fix use-after-free of network namespace (bsc#1233642).
• CVE-2024-53101: fs: Fix uninitialized value issue in from_kuid and from_kgid (bsc#1233769).
• CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).
• CVE-2024-53114: x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client (bsc#1234072).
• CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).
• CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).
• CVE-2024-53131: nilfs2: fix…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-48742: rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() (bsc#1226694).
• CVE-2022-49033: btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (bsc#1232045).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-33951: Fixed a race condition that could have led to an information disclosure inside the vmwgfx driver (bsc#1211593).
• CVE-2023-33952: Fixed a double free that could have led to a local privilege escalation inside the vmwgfx driver (bsc#1211595).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2024-26886: Bluetooth: af_bluetooth: Fix deadlock (bsc#1223044).
• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-36915: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies (bsc#1225758).
• CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).
• CVE-2024-47666: scsi: pm80xx: Set phy->enable_completion only when we wait for it (bsc#1231453).
• CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).
• CVE-2024-49944: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start (bsc#1232166).
• CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
• CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).
• CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).
• CVE-2024-50166: fsl/fman: Fix refcount handling of fman-related devices (bsc#1233050).
• CVE-2024-50181: clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D (bsc#1233127).
• CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).
• CVE-2024-50211: udf: refactor inode_bmap() to handle error (bsc#1233096).
• CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).
• CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).
• CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).
• CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50296: net: hns3: fix kernel crash when uninstalling driver (bsc#1233485).
• CVE-2024-53051: drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (bsc#1233547).
• CVE-2024-53055: wifi: iwlwifi: mvm: fix 6 GHz scan construction (bsc#1233550).
• CVE-2024-53056: drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() (bsc#1233568).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
• CVE-2024-53072: platform/x86/amd/pmc: Detect when STB is not available (bsc#1233564).
• CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).
• CVE-2024-53095: smb: client: Fix use-after-free of network namespace (bsc#1233642).
• CVE-2024-53101: fs: Fix uninitialized value issue in from_kuid and from_kgid (bsc#1233769).
• CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).
• CVE-2024-53114: x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client (bsc#1234072).
• CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).
• CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).
• CVE-2024-53131: nilfs2: fix…

This update for the Linux Kernel 6.4.0-150600_8 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-56582: btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235129).
• CVE-2024-53208: Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (bsc#1236244).
• CVE-2024-50257: netfilter: Fix use-after-free in get_info() (bsc#1233245).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232908).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2024-50124: Bluetooth: ISO: Fix UAF on iso_sock_timeout (bsc#1232927).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227903).

This update for the Linux Kernel 6.4.0-150600_10_8 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-53074: wifi: iwlwifi: mvm: do not leak a link on AP removal (bsc#1235086).
• CVE-2024-56582: btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235129).
• CVE-2024-53208: Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (bsc#1236244).
• CVE-2024-50257: netfilter: Fix use-after-free in get_info() (bsc#1233245).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232908).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2024-50124: Bluetooth: ISO: Fix UAF on iso_sock_timeout (bsc#1232927).

This update for the Linux Kernel 6.4.0-150600_10_17 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-56582: btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235129).
• CVE-2024-53208: Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (bsc#1236244).
• CVE-2024-50257: netfilter: Fix use-after-free in get_info() (bsc#1233245).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232908).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2024-50124: Bluetooth: ISO: Fix UAF on iso_sock_timeout (bsc#1232927).

This update for the Linux Kernel 4.12.14-122_225 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238730).
• CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1241331).

This update for the Linux Kernel 6.4.0-150600_10_5 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-56582: btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235129).
• CVE-2024-53208: Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (bsc#1236244).
• CVE-2024-50257: netfilter: Fix use-after-free in get_info() (bsc#1233245).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232908).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2024-50124: Bluetooth: ISO: Fix UAF on iso_sock_timeout (bsc#1232927).

This update for the Linux Kernel 6.4.0-150600_10_11 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-53074: wifi: iwlwifi: mvm: do not leak a link on AP removal (bsc#1235086).
• CVE-2024-56582: btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235129).
• CVE-2024-53208: Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (bsc#1236244).
• CVE-2024-50257: netfilter: Fix use-after-free in get_info() (bsc#1233245).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232908).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2024-50124: Bluetooth: ISO: Fix UAF on iso_sock_timeout (bsc#1232927).

This update for the Linux Kernel 4.12.14-122_216 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227903).
• CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238730).
• CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1241331).

This update for the Linux Kernel 4.12.14-122_228 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238730).
• CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1241331).

This update for the Linux Kernel 4.12.14-122_231 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238730).
• CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1241331).

This update for the Linux Kernel 5.14.21-150500_55_62 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232908).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-53208: Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (bsc#1236244).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2024-50124: Bluetooth: ISO: Fix UAF on iso_sock_timeout (bsc#1232927).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227903).

This update for the Linux Kernel 5.14.21-150500_55_73 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-53208: Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (bsc#1236244).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232908).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2024-50124: Bluetooth: ISO: Fix UAF on iso_sock_timeout (bsc#1232927).

This update for the Linux Kernel 5.14.21-150400_24_128 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232908).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).

This update for the Linux Kernel 5.14.21-150400_24_136 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232908).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).

This update for the Linux Kernel 5.14.21-150500_55_83 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-53208: Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (bsc#1236244).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232908).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2024-50124: Bluetooth: ISO: Fix UAF on iso_sock_timeout (bsc#1232927).

This update for the Linux Kernel 6.4.0-150600_23_22 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-53074: wifi: iwlwifi: mvm: do not leak a link on AP removal (bsc#1235086).
• CVE-2024-56582: btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235129).
• CVE-2024-53208: Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (bsc#1236244).
• CVE-2024-50257: netfilter: Fix use-after-free in get_info() (bsc#1233245).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232908).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2024-50124: Bluetooth: ISO: Fix UAF on iso_sock_timeout (bsc#1232927).

This update for the Linux Kernel 6.4.0-150600_21 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232908).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-56582: btrfs: fix use-after-free in btrfs_encoded_read_endio() (bsc#1235129).
• CVE-2024-53208: Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (bsc#1236244).
• CVE-2024-50257: netfilter: Fix use-after-free in get_info() (bsc#1233245).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2024-50124: Bluetooth: ISO: Fix UAF on iso_sock_timeout (bsc#1232927).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227903).

This update for the Linux Kernel 5.3.18-150300_59_164 fixes several issues.

The following security issues were fixed:

• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232908).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227903).
• CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238730).