CVE-2024-53168

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket

BUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0 Read of size 1 at addr ffff888111f322cd by task swapper/0/0

CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 Call Trace: <IRQ> dump_stack_lvl+0x68/0xa0 print_address_description.constprop.0+0x2c/0x3d0 print_report+0xb4/0x270 kasan_report+0xbd/0xf0 tcp_write_timer_handler+0x156/0x3e0 tcp_write_timer+0x66/0x170 call_timer_fn+0xfb/0x1d0 __run_timers+0x3f8/0x480 run_timer_softirq+0x9b/0x100 handle_softirqs+0x153/0x390 __irq_exit_rcu+0x103/0x120 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 f8 25 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 RSP: 0018:ffffffffa2007e28 EFLAGS: 00000242 RAX: 00000000000f3b31 RBX: 1ffffffff4400fc7 RCX: ffffffffa09c3196 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff9f00590f RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed102360835d R10: ffff88811b041aeb R11: 0000000000000001 R12: 0000000000000000 R13: ffffffffa202d7c0 R14: 0000000000000000 R15: 00000000000147d0 default_idle_call+0x6b/0xa0 cpuidle_idle_call+0x1af/0x1f0 do_idle+0xbc/0x130 cpu_startup_entry+0x33/0x40 rest_init+0x11f/0x210 start_kernel+0x39a/0x420 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0x97/0xa0 common_startup_64+0x13e/0x141 </TASK>

Allocated by task 595: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x87/0x90 kmem_cache_alloc_noprof+0x12b/0x3f0 copy_net_ns+0x94/0x380 create_new_namespaces+0x24c/0x500 unshare_nsproxy_namespaces+0x75/0xf0 ksys_unshare+0x24e/0x4f0 __x64_sys_unshare+0x1f/0x30 do_syscall_64+0x70/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Freed by task 100: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x54/0x70 kmem_cache_free+0x156/0x5d0 cleanup_net+0x5d3/0x670 process_one_work+0x776/0xa90 worker_thread+0x2e2/0x560 kthread+0x1a8/0x1f0 ret_from_fork+0x34/0x60 ret_from_fork_asm+0x1a/0x30

Reproduction script:

mkdir -p /mnt/nfsshare mkdir -p /mnt/nfs/netns_1 mkfs.ext4 /dev/sdb mount /dev/sdb /mnt/nfsshare systemctl restart nfs-server chmod 777 /mnt/nfsshare exportfs -i -o rw,no_root_squash *:/mnt/nfsshare

ip netns add netns_1 ip link add name veth_1_peer type veth peer veth_1 ifconfig veth_1_peer 11.11.0.254 up ip link set veth_1 netns netns_1 ip netns exec netns_1 ifconfig veth_1 11.11.0.1

ip netns exec netns_1 /root/iptables -A OUTPUT -d 11.11.0.254 -p tcp
--tcp-flags FIN FIN -j DROP

(note: In my environment, a DESTROY_CLIENTID operation is always sent immediately, breaking the nfs tcp connection.) ip netns exec netns_1 timeout -s 9 300 mount -t nfs -o proto=tcp,vers=4.1
11.11.0.254:/mnt/nfsshare /mnt/nfs/netns_1

ip netns del netns_1

The reason here is that the tcp socket in netns_1 (nfs side) has been shutdown and closed (done in xs_destroy), but the FIN message (with ack) is discarded, and the nfsd side keeps sending retransmission messages. As a result, when the tcp sock in netns_1 processes the received message, it sends the message (FIN message) in the sending queue, and the tcp timer is re-established. When the network namespace is deleted, the net structure accessed by tcp's timer handler function causes problems.

To fix this problem, let's hold netns refcnt for the tcp kernel socket as done in other modules. This is an ugly hack which can easily be backported to earlier kernels. A proper fix which cleans up the interfaces will follow, but may not be so easy to backport.

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket BUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0 Read of size 1 at addr ffff888111f322cd by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 Call Trace: <IRQ> dump_stack_lvl+0x68/0xa0 print_address_description.constprop.0+0x2c/0x3d0 print_report+0xb4/0x270 kasan_report+0xbd/0xf0 tcp_write_timer_handler+0x156/0x3e0 tcp_write_timer+0x66/0x170 call_timer_fn+0xfb/0x1d0 __run_timers+0x3f8/0x480 run_timer_softirq+0x9b/0x100 handle_softirqs+0x153/0x390 __irq_exit_rcu+0x103/0x120 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 f8 25 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 RSP: 0018:ffffffffa2007e28 EFLAGS: 00000242 RAX: 00000000000f3b31 RBX: 1ffffffff4400fc7 RCX: ffffffffa09c3196 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff9f00590f RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed102360835d R10: ffff88811b041aeb R11: 0000000000000001 R12: 0000000000000000 R13: ffffffffa202d7c0 R14: 0000000000000000 R15: 00000000000147d0 default_idle_call+0x6b/0xa0 cpuidle_idle_call+0x1af/0x1f0 do_idle+0xbc/0x130 cpu_startup_entry+0x33/0x40 rest_init+0x11f/0x210 start_kernel+0x39a/0x420 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0x97/0xa0 common_startup_64+0x13e/0x141 </TASK> Allocated by task 595: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x87/0x90 kmem_cache_alloc_noprof+0x12b/0x3f0 copy_net_ns+0x94/0x380 create_new_namespaces+0x24c/0x500 unshare_nsproxy_namespaces+0x75/0xf0 ksys_unshare+0x24e/0x4f0 __x64_sys_unshare+0x1f/0x30 do_syscall_64+0x70/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 100: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x54/0x70 kmem_cache_free+0x156/0x5d0 cleanup_net+0x5d3/0x670 process_one_work+0x776/0xa90 worker_thread+0x2e2/0x560 kthread+0x1a8/0x1f0 ret_from_fork+0x34/0x60 ret_from_fork_asm+0x1a/0x30 Reproduction script: mkdir -p /mnt/nfsshare mkdir -p /mnt/nfs/netns_1 mkfs.ext4 /dev/sdb mount /dev/sdb /mnt/nfsshare systemctl restart nfs-server chmod 777 /mnt/nfsshare exportfs -i -o rw,no_root_squash *:/mnt/nfsshare ip netns add netns_1 ip link add name veth_1_peer type veth peer veth_1 ifconfig veth_1_peer 11.11.0.254 up ip link set veth_1 netns netns_1 ip netns exec netns_1 ifconfig veth_1 11.11.0.1 ip netns exec netns_1 /root/iptables -A OUTPUT -d 11.11.0.254 -p tcp \ --tcp-flags FIN FIN -j DROP (note: In my environment, a DESTROY_CLIENTID operation is always sent immediately, breaking the nfs tcp connection.) ip netns exec netns_1 timeout -s 9 300 mount -t nfs -o proto=tcp,vers=4.1 \ 11.11.0.254:/mnt/nfsshare /mnt/nfs/netns_1 ip netns del netns_1 The reason here is that the tcp socket in netns_1 (nfs side) has been shutdown and closed (done in xs_destroy), but the FIN message (with ack) is discarded, and the nfsd side keeps sending retransmission messages. As a result, when the tcp sock in netns_1 processes the received message, it sends the message (FIN message) in the sending queue, and the tcp timer is re-established. When the network namespace is deleted, the net structure accessed by tcp's timer handler function causes problems. To fix this problem, let's hold netns refcnt for the tcp kernel socket as done in other modules. This is an ugly hack which can easily be backported to earlier kernels. A proper fix which cleans up the interfaces will follow, but may not be so easy to backport.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:sunrpc: fix one UAF issue caused by sunrpc kernel tcp socketBUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0Read of size 1 at addr ffff888111f322cd by task swapper/0/0CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1Call Trace: <IRQ> dump_stack_lvl+0x68/0xa0 print_address_description.constprop.0+0x2c/0x3d0 print_report+0xb4/0x270 kasan_report+0xbd/0xf0 tcp_write_timer_handler+0x156/0x3e0 tcp_write_timer+0x66/0x170 call_timer_fn+0xfb/0x1d0 __run_timers+0x3f8/0x480 run_timer_softirq+0x9b/0x100 handle_softirqs+0x153/0x390 __irq_exit_rcu+0x103/0x120 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20RIP: 0010:default_idle+0xf/0x20Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 f8 25 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90RSP: 0018:ffffffffa2007e28 EFLAGS: 00000242RAX: 00000000000f3b31 RBX: 1ffffffff4400fc7 RCX: ffffffffa09c3196RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff9f00590fRBP: 0000000000000000 R08: 0000000000000001 R09: ffffed102360835dR10: ffff88811b041aeb R11: 0000000000000001 R12: 0000000000000000R13: ffffffffa202d7c0 R14: 0000000000000000 R15: 00000000000147d0 default_idle_call+0x6b/0xa0 cpuidle_idle_call+0x1af/0x1f0 do_idle+0xbc/0x130 cpu_startup_entry+0x33/0x40 rest_init+0x11f/0x210 start_kernel+0x39a/0x420 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0x97/0xa0 common_startup_64+0x13e/0x141 </TASK>Allocated by task 595: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x87/0x90 kmem_cache_alloc_noprof+0x12b/0x3f0 copy_net_ns+0x94/0x380 create_new_namespaces+0x24c/0x500 unshare_nsproxy_namespaces+0x75/0xf0 ksys_unshare+0x24e/0x4f0 __x64_sys_unshare+0x1f/0x30 do_syscall_64+0x70/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7eFreed by task 100: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x54/0x70 kmem_cache_free+0x156/0x5d0 cleanup_net+0x5d3/0x670 process_one_work+0x776/0xa90 worker_thread+0x2e2/0x560 kthread+0x1a8/0x1f0 ret_from_fork+0x34/0x60 ret_from_fork_asm+0x1a/0x30Reproduction script:mkdir -p /mnt/nfssharemkdir -p /mnt/nfs/netns_1mkfs.ext4 /dev/sdbmount /dev/sdb /mnt/nfssharesystemctl restart nfs-serverchmod 777 /mnt/nfsshareexportfs -i -o rw,no_root_squash *:/mnt/nfsshareip netns add netns_1ip link add name veth_1_peer type veth peer veth_1ifconfig veth_1_peer 11.11.0.254 upip link set veth_1 netns netns_1ip netns exec netns_1 ifconfig veth_1 11.11.0.1ip netns exec netns_1 /root/iptables -A OUTPUT -d 11.11.0.254 -p tcp --tcp-flags FIN FIN -j DROP(note: In my environment, a DESTROY_CLIENTID operation is always sent immediately, breaking the nfs tcp connection.)ip netns exec netns_1 timeout -s 9 300 mount -t nfs -o proto=tcp,vers=4.1 11.11.0.254:/mnt/nfsshare /mnt/nfs/netns_1ip netns del netns_1The reason here is that the tcp socket in netns_1 (nfs side) has beenshutdown and closed (done in xs_destroy), but the FIN message (with ack)is discarded, and the nfsd side keeps sending retransmission messages.As a result, when the tcp sock in netns_1 processes the received message,it sends the message (FIN message) in the sending queue, and the tcp timeris re-established. When the network namespace is deleted, the net structureaccessed by tcp s timer handler function causes problems.To fix this problem, let s hold netns refcnt for the tcp kernel socket asdone in other modules. This is an ugly hack which can easily be backportedto earlier kernels. A proper fix which cleans up the interfaces willfollow, but may not be so easy to backport.(CVE-2024-53168)

In the Linux…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net/tunnel: wait until all sk_user_data reader finish before releasing the sock

There is a race condition in vxlan that when deleting a vxlan device during receiving packets, there is a possibility that the sock is released after getting vxlan_sock vs from sk_user_data. Then in later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got NULL pointer dereference. e.g.

#0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757 #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48 #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542 #6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62 [exception RIP: vxlan_ecn_decapsulate+0x3b] RIP: ffffffffc1014e7b RSP: ffffa25ec6978cb0 RFLAGS: 00010246 RAX: 0000000000000008 RBX: ffff8aa000888000 RCX: 0000000000000000 RDX: 000000000000000e RSI: ffff8a9fc7ab803e RDI: ffff8a9fd1168700 RBP: ffff8a9fc7ab803e R8: 0000000000700000 R9: 00000000000010ae R10: ffff8a9fcb748980 R11: 0000000000000000 R12: ffff8a9fd1168700 R13: ffff8aa000888000 R14: 00000000002a0000 R15: 00000000000010ae ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan] #8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507 #9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45 #10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807 #11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951 #12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde #13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b #14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139 #15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a #16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3 #17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca #18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before releasing the sock.(CVE-2022-50405)

In the Linux kernel, there is a vulnerability in the USB host controller interface (xHCI). When the xHC host is dying or being removed, endpoints are not properly cleaned up, remaining in the bandwidth list when freeing the virtual device. This causes a list_del corruption kernel crash when unbinding xhci-pci, as xhci_mem_cleanup() later attempts to delete already freed endpoints from the bandwidth list. This vulnerability only affects hosts that use software bandwidth checking, which currently is only the xHC in Intel Panther Point PCH (Ivy Bridge).(CVE-2022-50470)

In the Linux kernel, the following vulnerability has been resolved:thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crashWhen CPU 0 is offline and intel_powerclamp is used to injectidle, it generates kernel BUG:BUG: using smp_processor_id() in preemptible [00000000] code: bash/15687caller is debug_smp_processor_id+0x17/0x20CPU: 4 PID: 15687 Comm: bash Not tainted 5.19.0-rc7+ #57Call Trace:<TASK>dump_stack_lvl+0x49/0x63dump_stack+0x10/0x16check_preemption_disabled+0xdd/0xe0debug_smp_processor_id+0x17/0x20powerclamp_set_cur_state+0x7f/0xf9 [intel_powerclamp]......Here CPU 0 is the control CPU by default and changed to the current CPU,if CPU 0 offlined. This check has to be performed under cpus_read_lock(),hence the above warning.Use get_cpu() instead of smp_processor_id() to avoid this BUG. rjw: Subject edits

In the Linux kernel, the following vulnerability has been resolved:iommu/amd: Fix pci device…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix potential out of bound read in ext4_fc_replay_scan()

For scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain space less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read when mounting corrupt file system image. ADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this three tags will read data during scan, tag length couldn't less than data length which will read.(CVE-2022-50306)

A use-after-free vulnerability in the Linux kernel s netfilter: nf_tables component can be exploited to achieve local privilege escalation.Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it is possible to underflow the reference counter causing a use-after-free vulnerability.We recommend upgrading past commit 3e91b0ebd994635df2346353322ac51ce84ce6d8.(CVE-2023-4244)

In the Linux kernel, the following vulnerability has been resolved:

HID: multitouch: Correct devm device reference for hidinput input_dev name

Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequently fires a uevent that depends on the name. At the point of firing the uevent, the name would be freed by devres management.

Use devm_kasprintf to simplify the logic for allocating memory and formatting the input_dev name string.(CVE-2023-53454)

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix deletion race condition

System crash when using debug kernel due to link list corruption. The cause of the link list corruption is due to session deletion was allowed to queue up twice. Here's the internal trace that show the same port was allowed to double queue for deletion on different cpu.

20808683956 015 qla2xxx [0000:13:00.1]-e801:4: Scheduling sess ffff93ebf9306800 for deletion 50:06:0e:80:12:48:ff:50 fc4_type 1 20808683957 027 qla2xxx [0000:13:00.1]-e801:4: Scheduling sess ffff93ebf9306800 for deletion 50:06:0e:80:12:48:ff:50 fc4_type 1

Move the clearing/setting of deleted flag lock.(CVE-2023-53615)

In the Linux kernel, the following vulnerability has been resolved:

scsi: ses: Fix possible desc_ptr out-of-bounds accesses

Sanitize possible desc_ptr out-of-bounds accesses in ses_enclosure_data_process().(CVE-2023-53675)

In the Linux kernel, the following vulnerability has been resolved:

NFS: Fix a potential data corruption

We must ensure that the subrequests are joined back into the head before we can retransmit a request. If the head was not on the commit lists, because the server wrote it synchronously, we still need to add it back to the retransmission list. Add a call that mirrors the effect of nfs_cancel_remove_inode() for O_DIRECT.(CVE-2023-53711)

In the Linux kernel, the following vulnerability has been resolved: md: raid1: fix potential OOB in raid1_remove_disk(). If rddev->raid_disk is greater than mddev->raid_disks, there will be an out-of-bounds in raid1_remove_disk(). We have already found similar reports as follows: 1) commit d17f744e883b ("md-raid10: fix KASAN warning") 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk"). Fix this bug by checking whether the "number" variable is valid.(CVE-2023-53722)

In the Linux kernel, the following vulnerability has been resolved:posix-timers: Ensure timer ID search-loop limit is validposix_timer_add() tries to allocate a posix timer ID by starting from thecached ID which was stored by the last successful allocation.This is done in a loop searching the ID space for a free slot one byone. The loop has to terminate when the search wrapped around to thestarting point.But that s racy vs. establishing the…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix potential out of bound read in ext4_fc_replay_scan()

For scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain space less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read when mounting corrupt file system image. ADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this three tags will read data during scan, tag length couldn't less than data length which will read.(CVE-2022-50306)

In the Linux kernel, the following vulnerability has been resolved:posix-timers: Ensure timer ID search-loop limit is validposix_timer_add() tries to allocate a posix timer ID by starting from thecached ID which was stored by the last successful allocation.This is done in a loop searching the ID space for a free slot one byone. The loop has to terminate when the search wrapped around to thestarting point.But that s racy vs. establishing the starting point. That is read outlockless, which leads to the following problem:CPU0 CPU1posix_timer_add() start = sig->posix_timer_id; lock(hash_lock); ... posix_timer_add() if (++sig->posix_timer_id < 0) start = sig->posix_timer_id; sig->posix_timer_id = 0;So CPU1 can observe a negative start value, i.e. -1, and the loop breaknever happens because the condition can never be true: if (sig->posix_timer_id == start) break;While this is unlikely to ever turn into an endless loop as the ID space ishuge (INT_MAX), the racy read of the start value caught the attention ofKCSAN and Dmitry unearthed that incorrectness.Rewrite it so that all id operations are under the hash lock.(CVE-2023-53728)

In the Linux kernel, the following vulnerability has been resolved:posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()If get_clock_desc() succeeds, it calls fget() for the clockid s fd,and get the clk->rwsem read lock, so the error path should releasethe lock to make the lock balance and fput the clockid s fd to makethe refcount balance and release the fd related resource.However the below commit left the error path locked behind resulting inunbalanced locking. Check timespec64_valid_strict() beforeget_clock_desc() to fix it, because the ts is not changedafter that.[email protected]: fixed commit message typo

In the Linux kernel, the following vulnerability has been resolved:sunrpc: fix one UAF issue caused by sunrpc kernel tcp socketBUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0Read of size 1 at addr ffff888111f322cd by task swapper/0/0CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1Call Trace: <IRQ> dump_stack_lvl+0x68/0xa0 print_address_description.constprop.0+0x2c/0x3d0 print_report+0xb4/0x270 kasan_report+0xbd/0xf0 tcp_write_timer_handler+0x156/0x3e0 tcp_write_timer+0x66/0x170 call_timer_fn+0xfb/0x1d0 __run_timers+0x3f8/0x480 run_timer_softirq+0x9b/0x100 handle_softirqs+0x153/0x390 __irq_exit_rcu+0x103/0x120 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20RIP: 0010:default_idle+0xf/0x20Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 f8 25 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90RSP: 0018:ffffffffa2007e28 EFLAGS: 00000242RAX: 00000000000f3b31 RBX: 1ffffffff4400fc7 RCX: ffffffffa09c3196RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff9f00590fRBP: 0000000000000000 R08: 0000000000000001 R09: ffffed102360835dR10: ffff88811b041aeb R11: 0000000000000001 R12: 0000000000000000R13: ffffffffa202d7c0 R14: 0000000000000000 R15: 00000000000147d0 default_idle_call+0x6b/0xa0…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:sunrpc: fix one UAF issue caused by sunrpc kernel tcp socketBUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0Read of size 1 at addr ffff888111f322cd by task swapper/0/0CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1Call Trace: <IRQ> dump_stack_lvl+0x68/0xa0 print_address_description.constprop.0+0x2c/0x3d0 print_report+0xb4/0x270 kasan_report+0xbd/0xf0 tcp_write_timer_handler+0x156/0x3e0 tcp_write_timer+0x66/0x170 call_timer_fn+0xfb/0x1d0 __run_timers+0x3f8/0x480 run_timer_softirq+0x9b/0x100 handle_softirqs+0x153/0x390 __irq_exit_rcu+0x103/0x120 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20RIP: 0010:default_idle+0xf/0x20Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 f8 25 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90RSP: 0018:ffffffffa2007e28 EFLAGS: 00000242RAX: 00000000000f3b31 RBX: 1ffffffff4400fc7 RCX: ffffffffa09c3196RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff9f00590fRBP: 0000000000000000 R08: 0000000000000001 R09: ffffed102360835dR10: ffff88811b041aeb R11: 0000000000000001 R12: 0000000000000000R13: ffffffffa202d7c0 R14: 0000000000000000 R15: 00000000000147d0 default_idle_call+0x6b/0xa0 cpuidle_idle_call+0x1af/0x1f0 do_idle+0xbc/0x130 cpu_startup_entry+0x33/0x40 rest_init+0x11f/0x210 start_kernel+0x39a/0x420 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0x97/0xa0 common_startup_64+0x13e/0x141 </TASK>Allocated by task 595: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x87/0x90 kmem_cache_alloc_noprof+0x12b/0x3f0 copy_net_ns+0x94/0x380 create_new_namespaces+0x24c/0x500 unshare_nsproxy_namespaces+0x75/0xf0 ksys_unshare+0x24e/0x4f0 __x64_sys_unshare+0x1f/0x30 do_syscall_64+0x70/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7eFreed by task 100: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x54/0x70 kmem_cache_free+0x156/0x5d0 cleanup_net+0x5d3/0x670 process_one_work+0x776/0xa90 worker_thread+0x2e2/0x560 kthread+0x1a8/0x1f0 ret_from_fork+0x34/0x60 ret_from_fork_asm+0x1a/0x30Reproduction script:mkdir -p /mnt/nfssharemkdir -p /mnt/nfs/netns_1mkfs.ext4 /dev/sdbmount /dev/sdb /mnt/nfssharesystemctl restart nfs-serverchmod 777 /mnt/nfsshareexportfs -i -o rw,no_root_squash *:/mnt/nfsshareip netns add netns_1ip link add name veth_1_peer type veth peer veth_1ifconfig veth_1_peer 11.11.0.254 upip link set veth_1 netns netns_1ip netns exec netns_1 ifconfig veth_1 11.11.0.1ip netns exec netns_1 /root/iptables -A OUTPUT -d 11.11.0.254 -p tcp --tcp-flags FIN FIN -j DROP(note: In my environment, a DESTROY_CLIENTID operation is always sent immediately, breaking the nfs tcp connection.)ip netns exec netns_1 timeout -s 9 300 mount -t nfs -o proto=tcp,vers=4.1 11.11.0.254:/mnt/nfsshare /mnt/nfs/netns_1ip netns del netns_1The reason here is that the tcp socket in netns_1 (nfs side) has beenshutdown and closed (done in xs_destroy), but the FIN message (with ack)is discarded, and the nfsd side keeps sending retransmission messages.As a result, when the tcp sock in netns_1 processes the received message,it sends the message (FIN message) in the sending queue, and the tcp timeris re-established. When the network namespace is deleted, the net structureaccessed by tcp s timer handler function causes problems.To fix this problem, let s hold netns refcnt for the tcp kernel socket asdone in other modules. This is an ugly hack which can easily be backportedto earlier kernels. A proper fix which cleans up the interfaces willfollow, but may not be so easy to backport.(CVE-2024-53168)

In the Linux…

Root has patched CVE-2024-53168 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2024-53168 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2024-53168 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket BUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0 Read of size 1 at addr ffff888111f322cd by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 Call Trace: <IRQ> dump_stack_lvl+0x68/0xa0 print_address_description.constprop.0+0x2c/0x3d0 print_report+0xb4/0x270 kasan_report+0xbd/0xf0 tcp_write_timer_handler+0x156/0x3e0 tcp_write_timer+0x66/0x170 call_timer_fn+0xfb/0x1d0 __run_timers+0x3f8/0x480 run_timer_softirq+0x9b/0x100 handle_softirqs+0x153/0x390 __irq_exit_rcu+0x103/0x120 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 f8 25 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 RSP: 0018:ffffffffa2007e28 EFLAGS: 00000242 RAX: 00000000000f3b31 RBX: 1ffffffff4400fc7 RCX: ffffffffa09c3196 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff9f00590f RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed102360835d R10: ffff88811b041aeb R11: 0000000000000001 R12: 0000000000000000 R13: ffffffffa202d7c0 R14: 0000000000000000 R15: 00000000000147d0 default_idle_call+0x6b/0xa0 cpuidle_idle_call+0x1af/0x1f0 do_idle+0xbc/0x130 cpu_startup_entry+0x33/0x40 rest_init+0x11f/0x210 start_kernel+0x39a/0x420 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0x97/0xa0 common_startup_64+0x13e/0x141 </TASK> Allocated by task 595: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x87/0x90 kmem_cache_alloc_noprof+0x12b/0x3f0 copy_net_ns+0x94/0x380 create_new_namespaces+0x24c/0x500 unshare_nsproxy_namespaces+0x75/0xf0 ksys_unshare+0x24e/0x4f0 __x64_sys_unshare+0x1f/0x30 do_syscall_64+0x70/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 100: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x54/0x70 kmem_cache_free+0x156/0x5d0 cleanup_net+0x5d3/0x670 process_one_work+0x776/0xa90 worker_thread+0x2e2/0x560 kthread+0x1a8/0x1f0 ret_from_fork+0x34/0x60 ret_from_fork_asm+0x1a/0x30 Reproduction script: mkdir -p /mnt/nfsshare mkdir -p /mnt/nfs/netns_1 mkfs.ext4 /dev/sdb mount /dev/sdb /mnt/nfsshare systemctl restart nfs-server chmod 777 /mnt/nfsshare exportfs -i -o rw,no_root_squash *:/mnt/nfsshare ip netns add netns_1 ip link add name veth_1_peer type veth peer veth_1 ifconfig veth_1_peer 11.11.0.254 up ip link set veth_1 netns netns_1 ip netns exec netns_1 ifconfig veth_1 11.11.0.1 ip netns exec netns_1 /root/iptables -A OUTPUT -d 11.11.0.254 -p tcp \ --tcp-flags FIN FIN -j DROP (note: In my environment, a DESTROY_CLIENTID operation is always sent immediately, breaking the nfs tcp connection.) ip netns exec netns_1 timeout -s 9 300 mount -t nfs -o proto=tcp,vers=4.1 \ 11.11.0.254:/mnt/nfsshare /mnt/nfs/netns_1 ip netns del netns_1 The reason here is that the tcp socket in netns_1 (nfs side) has been shutdown and closed (done in xs_destroy), but the FIN message (with ack) is discarded, and the nfsd side keeps sending retransmission messages. As a result, when the tcp sock in netns_1 processes the received message, it sends the message (FIN message) in the sending queue, and the tcp timer is re-established. When the network namespace is deleted, the net structure accessed by tcp's timer handler function causes problems. To fix this problem, let's hold netns refcnt for the tcp kernel socket as done in other modules. This is an ugly hack which can easily be backported to earlier kernels. A proper fix which cleans up the interfaces will follow, but may not be so easy to backport.

• Bionic update: upstream stable patchset 2022-04-13 (LP: #1968932) // CVE- url: https://ubuntu.com/security/CVE-2022-23041
  • xen/gnttab: fix gnttab_end_foreign_access() without page specified
• Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596) // CVE- url: https://ubuntu.com/security/CVE-2022-49850
  • nilfs2: fix deadlock in nilfs_count_free_blocks()
• CVE-url: https://ubuntu.com/security/CVE-2024-42305
  • ext4: check dot and dotdot of dx_root before making dir indexed
• CVE-url: https://ubuntu.com/security/CVE-2024-53168
  • sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
• CVE-url: https://ubuntu.com/security/CVE-2024-26915
  • drm/amdgpu: Add check to prevent IH overflow
  • drm/amdgpu: Reset IH OVERFLOW_CLEAR bit
• CVE-url: https://ubuntu.com/security/CVE-2024-56770
  • net/sched: netem: account for backlog updates from child qdisc
  • netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47587
  • net: systemport: Add global locking for descriptor lifecycle
• Bionic update: upstream stable patchset 2021-06-01 (LP: #1930472) // CVE- url: https://ubuntu.com/security/CVE-2021-46959
  • spi: Fix use-after-free with devm_spi_alloc_*
• CVE-url: https://ubuntu.com/security/CVE-2024-26689
  • ceph: prevent use-after-free in encode_cap_msg()
• CVE-url: https://ubuntu.com/security/CVE-2024-53066
  • nfs: Fix KMSAN warning in decode_getfattr_attrs()
• CVE-url: https://ubuntu.com/security/CVE-2024-49944
  • sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
• CVE-url: https://ubuntu.com/security/CVE-2024-50237
  • wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
• CVE-url: https://ubuntu.com/security/CVE-2024-46780
  • nilfs2: protect references to superblock parameters exposed in sysfs
• CVE-url: https://ubuntu.com/security/CVE-2024-53063
  • media: dvbdev: prevent the risk of out of memory access
  • media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
• CVE-url: https://ubuntu.com/security/CVE-2021-47150
  • net: fec: fix the potential memory leak in fec_enet_init()
• CVE-url: https://ubuntu.com/security/CVE-2024-53140
  • netlink: terminate outstanding dump on socket close
• CVE-url: https://ubuntu.com/security/CVE-2025-21971
  • net_sched: Prevent creation of classes with TC_H_ROOT
• CVE-url: https://ubuntu.com/security/CVE-2023-52572
  • cifs: Fix UAF in cifs_demultiplex_thread()
• CVE-url: https://ubuntu.com/security/CVE-2025-37785
  • ext4: fix OOB read when checking dotdot dir
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47277
  • kvm: avoid speculation-based attacks from out-of-range memslot accesses
• CVE-url: https://ubuntu.com/security/CVE-2022-49740
  • wifi: brcmfmac: Check the count value of channel spec to prevent out-of- bounds reads
• Bionic update: upstream stable patchset 2022-07-25 (LP: #1982782) // CVE- url: https://ubuntu.com/security/CVE-2022-49404
  • RDMA/hfi1: Fix potential integer multiplication overflow errors
• Bionic update: upstream stable patchset 2023-03-03 (LP: #2009237) // CVE- url: https://ubuntu.com/security/CVE-2022-49757
  • EDAC/highbank: Fix memory leak in highbank_mc_probe()
• Bionic update: upstream stable patchset 2022-07-25 (LP: #1982782) // CVE- url: https://ubuntu.com/security/CVE-2022-49395
  • um: Fix out-of-bounds read in LDT setup
• CVE-url: https://ubuntu.com/security/CVE-2022-49738
  • f2fs: fix to do sanity check on summary info
  • f2fs: should put a page when checking the summary info
  • f2fs: fix to do sanity check on i_extra_isize in is_alive()
• CVE-url:…

• CVE-url: https://ubuntu.com/security/CVE-2021-47352
  • virtio-net: Add validation for used length
• CVE-url: https://ubuntu.com/security/CVE-2024-46745
  • Input: uinput - reject requests with unreasonable number of slots
• CVE-url: https://ubuntu.com/security/CVE-2024-44952
  • driver core: Fix uevent_show() vs driver detach race
• CVE-url: https://ubuntu.com/security/CVE-2024-42304
  • ext4: make sure the first directory block is not a hole
• CVE-url: https://ubuntu.com/security/CVE-2024-42305
  • ext4: check dot and dotdot of dx_root before making dir indexed
• CVE-url: https://ubuntu.com/security/CVE-2024-53168
  • sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
• CVE-url: https://ubuntu.com/security/CVE-2024-49925
  • driver core: add dev_groups to all drivers
  • driver core: Fix error return code in really_probe()
  • fbdev: efifb: Register sysfs groups through driver core
• CVE-url: https://ubuntu.com/security/CVE-2024-56661
  • tipc: fix NULL deref in cleanup_bearer()
• CVE-url: https://ubuntu.com/security/CVE-2024-56642
  • tipc: Fix use-after-free of kernel socket in cleanup_bearer().
• CVE-url: https://ubuntu.com/security/CVE-2021-47163
  • tipc: wait and exit until all work queues are done
• CVE-url: https://ubuntu.com/security/CVE-2024-26915
  • drm/amdgpu: fix IH overflow on Vega10 v2
  • drm/amdgpu: Add check to prevent IH overflow
  • drm/amdgpu: Reset IH OVERFLOW_CLEAR bit
• CVE-url: https://ubuntu.com/security/CVE-2024-56770
  • net/sched: netem: account for backlog updates from child qdisc
  • netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
• CVE-url: https://ubuntu.com/security/CVE-2024-50296
  • net: hns3: fix kernel crash when uninstalling driver
• CVE-url: https://ubuntu.com/security/CVE-2024-53066
  • nfs: Fix KMSAN warning in decode_getfattr_attrs()
• CVE-url: https://ubuntu.com/security/CVE-2024-49944
  • sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
• CVE-url: https://ubuntu.com/security/CVE-2024-50237
  • wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
• CVE-url: https://ubuntu.com/security/CVE-2024-46780
  • nilfs2: protect references to superblock parameters exposed in sysfs
• CVE-url: https://ubuntu.com/security/CVE-2024-53063
  • media: dvbdev: prevent the risk of out of memory access
  • media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
• CVE-url: https://ubuntu.com/security/CVE-2023-52927
  • netfilter: allow exp not to be removed in nf_ct_find_expectation
• CVE-url: https://ubuntu.com/security/CVE-2021-47150
  • net: fec: fix the potential memory leak in fec_enet_init()
• CVE-url: https://ubuntu.com/security/CVE-2024-53140
  • netlink: terminate outstanding dump on socket close
• CVE-url: https://ubuntu.com/security/CVE-2025-21971
  • net_sched: Prevent creation of classes with TC_H_ROOT
• CVE-url: https://ubuntu.com/security/CVE-2025-37785
  • ext4: fix OOB read when checking dotdot dir
• CVE-url: https://ubuntu.com/security/CVE-2023-52572
  • cifs: Fix UAF in cifs_demultiplex_thread()
• CVE-url: https://ubuntu.com/security/CVE-2022-49738
  • f2fs: fix to do sanity check on summary info
  • f2fs: should put a page when checking the summary info
  • f2fs: fix to do sanity check on i_extra_isize in is_alive()
• CVE-url: https://ubuntu.com/security/CVE-2022-49740
  • wifi: brcmfmac: Check the count value of channel spec to prevent out-of- bounds reads
• CVE-url: https://ubuntu.com/security/
  • ipv6: Define dscp_t and stop taking ECN bits into account in fib6-rules
• CVE-url: https://ubuntu.com/security/CVE-2023-53020
  • l2tp: close all race conditions in l2tp_tunnel_register()
• CVE-url: https://ubuntu.com/security/CVE-2025-21957
  • scsi: qla1280: Fix kernel oops when debug level > 2 *…

[ Ubuntu: 4.15.0-247.258 ]

• CVE-url: https://ubuntu.com/security/CVE-2021-47352
  • virtio-net: Add validation for used length
• CVE-url: https://ubuntu.com/security/CVE-2024-46745
  • Input: uinput - reject requests with unreasonable number of slots
• CVE-url: https://ubuntu.com/security/CVE-2024-44952
  • driver core: Fix uevent_show() vs driver detach race
• CVE-url: https://ubuntu.com/security/CVE-2024-42304
  • ext4: make sure the first directory block is not a hole
• CVE-url: https://ubuntu.com/security/CVE-2024-42305
  • ext4: check dot and dotdot of dx_root before making dir indexed
• CVE-url: https://ubuntu.com/security/CVE-2024-53168
  • sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
• CVE-url: https://ubuntu.com/security/CVE-2024-49925
  • driver core: add dev_groups to all drivers
  • driver core: Fix error return code in really_probe()
  • fbdev: efifb: Register sysfs groups through driver core
• CVE-url: https://ubuntu.com/security/CVE-2024-56661
  • tipc: fix NULL deref in cleanup_bearer()
• CVE-url: https://ubuntu.com/security/CVE-2024-56642
  • tipc: Fix use-after-free of kernel socket in cleanup_bearer().
• CVE-url: https://ubuntu.com/security/CVE-2021-47163
  • tipc: wait and exit until all work queues are done
• CVE-url: https://ubuntu.com/security/CVE-2024-26915
  • drm/amdgpu: fix IH overflow on Vega10 v2
  • drm/amdgpu: Add check to prevent IH overflow
  • drm/amdgpu: Reset IH OVERFLOW_CLEAR bit
• CVE-url: https://ubuntu.com/security/CVE-2024-56770
  • net/sched: netem: account for backlog updates from child qdisc
  • netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
• CVE-url: https://ubuntu.com/security/CVE-2024-50296
  • net: hns3: fix kernel crash when uninstalling driver
• CVE-url: https://ubuntu.com/security/CVE-2024-53066
  • nfs: Fix KMSAN warning in decode_getfattr_attrs()
• CVE-url: https://ubuntu.com/security/CVE-2024-49944
  • sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
• CVE-url: https://ubuntu.com/security/CVE-2024-50237
  • wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
• CVE-url: https://ubuntu.com/security/CVE-2024-46780
  • nilfs2: protect references to superblock parameters exposed in sysfs
• CVE-url: https://ubuntu.com/security/CVE-2024-53063
  • media: dvbdev: prevent the risk of out of memory access
  • media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
• CVE-url: https://ubuntu.com/security/CVE-2023-52927
  • netfilter: allow exp not to be removed in nf_ct_find_expectation
• CVE-url: https://ubuntu.com/security/CVE-2021-47150
  • net: fec: fix the potential memory leak in fec_enet_init()
• CVE-url: https://ubuntu.com/security/CVE-2024-53140
  • netlink: terminate outstanding dump on socket close
• CVE-url: https://ubuntu.com/security/CVE-2025-21971
  • net_sched: Prevent creation of classes with TC_H_ROOT
• CVE-url: https://ubuntu.com/security/CVE-2025-37785
  • ext4: fix OOB read when checking dotdot dir
• CVE-url: https://ubuntu.com/security/CVE-2023-52572
  • cifs: Fix UAF in cifs_demultiplex_thread()
• CVE-url: https://ubuntu.com/security/CVE-2022-49738
  • f2fs: fix to do sanity check on summary info
  • f2fs: should put a page when checking the summary info
  • f2fs: fix to do sanity check on i_extra_isize in is_alive()
• CVE-url: https://ubuntu.com/security/CVE-2022-49740
  • wifi: brcmfmac: Check the count value of channel spec to prevent out-of- bounds reads
• CVE-url: https://ubuntu.com/security/
  • ipv6: Define dscp_t and stop taking ECN bits into account in fib6-rules
• CVE-url: https://ubuntu.com/security/CVE-2023-53020
  • l2tp: close all race conditions in l2tp_tunnel_register()
• CVE-url: https://ubuntu.com/security/CVE-2025-21957
  • scsi: qla1280: Fix kernel oops…

• ext4: fix OOB read when checking dotdot dir {CVE-2025-37785}
• wifi: iwlwifi: limit printed string from FW file {CVE-2025-21905}
• drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' {CVE-2024-27042}
• dm-crypt: don't modify the data when using authenticated encryption {CVE-2024-26763}
• sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• veth: Fix use after free in XDP_REDIRECT {CVE-2023-53107}
• firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() {CVE-2024-53068}
• arm64/sve: Discard stale CPU state when handling SVE traps {CVE-2024-50275}
• Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd {CVE-2025-21969}
• wifi: mt76: mt7921e: fix use-after-free in free_irq() {CVE-2024-26892}
• rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read {CVE-2024-58069}
• nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() {CVE-2025-21927}
• pfifo_tail_enqueue: Drop new packet when sch->limit == 0 {CVE-2025-21702}
• net_sched: sch_fifo: implement lockless __fifo_dump() {CVE-2025-21702}
• iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() {CVE-2025-21993}
• vlan: enforce underlying device type {CVE-2025-21920}
• HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
• watch_queue: Actually free the watch {CVE-2022-49256}
• can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
• netfilter: nf_set_pipapo: fix initial map fill {CVE-2024-57947}
• hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations {CVE-2021-47098}
• aio: fix use-after-free due to missing POLLFREE handling {CVE-2021-47505}
• aio: keep poll requests on waitqueue until completed {CVE-2021-47505}
• smb: client: fix potential deadlock when releasing mids {CVE-2023-52757}
• cifs: remove useless DeleteMidQEntry() {CVE-2023-52757}
• media: uvcvideo: Remove dangling pointers {CVE-2024-58002}
• media: uvcvideo: Only save async fh if success {CVE-2024-58002}
• media: uvcvideo: Refactor iterators {CVE-2024-58002}
• drm: nv04: Fix out of bounds access {CVE-2024-27008}
• drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() {CVE-2025-21780}
• arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array {CVE-2025-21785}
• net: rose: fix timer races against user threads {CVE-2025-21718}
• media: uvcvideo: Fix double free in error path {CVE-2024-57980}
• vrf: use RCU protection in l3mdev_l3_out() {CVE-2025-21791}
• geneve: Fix use-after-free in geneve_find_dev(). {CVE-2025-21858}
• afs: Increase buffer size in afs_update_volume_status() {CVE-2024-26736}
• net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
• bpf: Check validity of link->type in bpf_link_show_fdinfo() {CVE-2024-53099}

• vsock: Keep the binding until socket destruction {CVE-2025-21756}
• mt76: fix use-after-free by removing a non-RCU wcid pointer {CVE-2022-49328}
• bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• net: sched: Fix use after free in red_enqueue() {CVE-2022-49921}
• udf: Fix a slab-out-of-bounds write bug in udf_find_entry() {CVE-2022-49846}
• ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892}
• dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• mac80211: fix potential double free on mesh join {CVE-2022-49290}
• wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416}
• ext4: fix OOB read when checking dotdot dir {CVE-2025-37785}
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
• tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
• wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}
• mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths {CVE-2022-48991}
• cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}
• media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init {CVE-2022-49478}
• HID: elan: Fix potential double free in elan_input_configured {CVE-2022-49508}
• bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers {CVE-2023-52621}
• drm/amd/pm: fix double free in si_parse_power_table() {CVE-2022-49530}
• drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() {CVE-2025-21780}
• crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612}
• sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168}
• net: make sock_inuse_add() available {CVE-2024-53168}

• vsock: Keep the binding until socket destruction {CVE-2025-21756}
• mt76: fix use-after-free by removing a non-RCU wcid pointer {CVE-2022-49328}
• bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• net: sched: Fix use after free in red_enqueue() {CVE-2022-49921}
• udf: Fix a slab-out-of-bounds write bug in udf_find_entry() {CVE-2022-49846}
• ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892}
• dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• mac80211: fix potential double free on mesh join {CVE-2022-49290}
• wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416}
• ext4: fix OOB read when checking dotdot dir {CVE-2025-37785}
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
• tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
• wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}
• mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths {CVE-2022-48991}
• cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}
• media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init {CVE-2022-49478}
• HID: elan: Fix potential double free in elan_input_configured {CVE-2022-49508}
• bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers {CVE-2023-52621}
• drm/amd/pm: fix double free in si_parse_power_table() {CVE-2022-49530}
• drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() {CVE-2025-21780}
• crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612}
• sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168}
• net: make sock_inuse_add() available {CVE-2024-53168}

• udf: Fix a slab-out-of-bounds write bug in udf_find_entry() {CVE-2022-49846}
• Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set {CVE-2022-49136}
• Bluetooth: Fix use after free in hci_send_acl {CVE-2022-49111}
• NFSv4/pnfs: Fix a use-after-free bug in open {CVE-2022-50072}
• NFSv4: Don't hold the layoutget locks across multiple RPC calls {CVE-2022-50072}
• ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764}
• cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}
• udmabuf: fix a buf size overflow issue during udmabuf creation {CVE-2025-37803}
• um: Fix out-of-bounds read in LDT setup {CVE-2022-49395}
• rtw89: cfo: check mac_id to avoid out-of-bounds {CVE-2022-49471}
• vsock: Keep the binding until socket destruction {CVE-2025-21756}
• net/mlx5: Always stop health timer during driver removal {CVE-2024-40906}
• ext4: fix OOB read when checking dotdot dir {CVE-2025-37785}
• Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd {CVE-2025-21969}
• drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() {CVE-2025-21780}
• drm: nv04: Fix out of bounds access {CVE-2024-27008}
• parport: Proper fix for array out-of-bounds access {CVE-2024-50074}
• sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168}
• net: make sock_inuse_add() available {CVE-2024-53168}
• drm/amdgpu: fix possible UAF in amdgpu_cs_pass1() {CVE-2023-52921}

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix use-after-free due to delegation race A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback is done with it, without ever being removed from del_recall_lru. Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread. I suspect aba2072f4523 'nfsd: grant read delegations to clients holding writes' made this bug easier to hit, but I looked as far back as v3.0 and it looks to me it already had the same problem. So I'm not sure where the bug was introduced; it may have been there from the beginning.)(CVE-2021-47506)

Jann Horn discovered that the watch_queue event notification subsystem in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or escalate their privileges.)(CVE-2022-0995)

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: eliminate double free in error handling logic Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called multiple times on same ring, if system is under stress and got memory allocation error. Ring pointer was used as an indicator of failure, but this is not correct since only ring data is allocated/deallocated. Ring itself is an array member. Changing ring allocation functions to return error code directly. This simplifies error handling and eliminates aq_ring_free on higher layer.)(CVE-2023-52664)

In the Linux kernel, the following vulnerability has been resolved: ceph: prevent use-after-free in encode_cap_msg() In fs/ceph/caps.c, in encode_cap_msg(), 'use after free' error was caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This implies before the refcount could be increment here, it was freed. In same file, in 'handle_cap_grant()' refcount is decremented by this line - 'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race occurred and resource was freed by the latter line before the former line could increment it. encode_cap_msg() is called by __send_cap() and __send_cap() is called by ceph_check_caps() after calling __prep_cap(). __prep_cap() is where arg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot where the refcount must be increased to prevent 'use after free' error.)(CVE-2024-26689)

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_valid_lease_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.)(CVE-2024-35864)

In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero- initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.)(CVE-2024-50302)

In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: prevent the risk of out of memory access The dvbdev contains a static variable used to store dvb minors. The behavior of it depends if CONFIG_DVB_DYNAMIC_MINORS is set or not. When not set, dvb_register_device() won't check for boundaries, as it will rely that a previous call to dvb_register_adapter() would already be enforcing it. On a similar way, dvb_device_open() uses the assumption that the register functions already did the needed checks. This can be fragile if some device ends using different calls. This also generate warnings on static check analysers like Coverity. So, add explicit guards to prevent potential risk of OOM issues.)(CVE-2024-53063)

In the Linux kernel, the following vulnerability has been…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49110: netfilter: conntrack: revisit gc autotuning (bsc#1237981).
• CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
• CVE-2022-49767: 9p/trans_fd: always use O_NONBLOCK read/write (bsc#1242493).
• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21888: RDMA/mlx5: Fix a WARN during dereg_mr for DM type (bsc#1240177).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
• CVE-2025-23138: watch_queue: fix pipe accounting mismatch (bsc#1241648).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).

The following non-security bugs were fixed:

• Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• Refresh fixes for cBPF issue (bsc#1242778)
• Remove debug flavor (bsc#1243919)
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• scsi: storvsc: Set correct data length for sending SCSI command without payload (git-fixes).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).

The following non-security bugs were fixed:

• Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• Remove debug flavor (bsc#1243919).
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• net :mana :Add remaining GDMA stats for MANA to ethtool (bsc#1234395).
• net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (bsc#1234395).
• net: mana: Add gdma stats to ethtool output for mana (bsc#1234395).
• nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (bsc#1223096).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• tcp: Dump bound-only sockets in inet_diag (bsc#1204562).
• tpm, tpm_tis: Workaround failed command reception on Infineon devices (bsc#1235870).
• tpm: tis: Double the timeout B to 4s (bsc#1235870).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-32399: Fixed a race condition when removing the HCI controller (bsc#1184611).
• CVE-2022-49110: netfilter: conntrack: revisit gc autotuning (bsc#1237981).
• CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
• CVE-2022-49320: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type (bsc#1238394).
• CVE-2022-49767: 9p/trans_fd: always use O_NONBLOCK read/write (bsc#1242493).
• CVE-2022-49769: gfs2: Check sb_bsize_shift after reading superblock (bsc#1242440).
• CVE-2022-49770: ceph: avoid putting the realm twice when decoding snaps fails (bsc#1242597).
• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2022-49789: scsi: zfcp: Fix double free of FSF request when qdio send fails (bsc#1242366).
• CVE-2023-53039: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function (bsc#1242745).
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2024-56705: media: atomisp: add check for rgby_data memory allocation failure (bsc#1235568).
• CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22028: media: vimc: skip .s_stream() for stopped entities (bsc#1241362).
• CVE-2025-22121: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (bsc#1241593).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
• CVE-2025-37846: arm64: mops: Do not dereference src reg for a set operation (bsc#1242963).
• CVE-2025-40364: io_uring: fix io_req_prep_async with provided buffers (bsc#1241637).

The following non-security bugs were fixed:

• blk: Drop a couple of block layer git-fixes (bsc#1170891 bsc#1173139).
• x86/entry: Remove skip_r11rcx (bsc#1201644, bsc#1201664, bsc#1201672, bsc#1201673, bsc#1201676).
• HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc (bsc#1242745)
• kernel: Remove debug flavor (bsc#1243919).
• devm-helpers: Add resource managed version of work init (bsc#1242745).
• rpm: fixup 'rpm: support gz and zst compression methods' once more (bsc#1190428, bsc#1190358).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode() (git-fixes).
• usb: typec: tps6598x: Fix return value check in tps6598x_probe() (git-fixes).
• workqueue: Add resource managed version of delayed work init (bsc#1242745)

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47670: can: peak_usb: fix use after free bugs (bsc#1241407).
• CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
• CVE-2022-49145: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (bsc#1238162).
• CVE-2022-49168: btrfs: do not clean up repair bio if submit fails (bsc#1238109).
• CVE-2022-49190: kernel/resource: fix kfree() of bootmem memory again (bsc#1238130).
• CVE-2022-49212: mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init (bsc#1238331).
• CVE-2022-49216: drm/tegra: Fix reference leak in tegra_dsi_ganged_probe (bsc#1238338).
• CVE-2022-49235: ath9k_htc: fix uninit value bugs (bsc#1238333).
• CVE-2022-49248: ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction (bsc#1238284).
• CVE-2022-49253: media: usb: go7007: s2250-board: fix leak in probe() (bsc#1238420).
• CVE-2022-49320: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type (bsc#1238394).
• CVE-2022-49326: rtl818x: Prevent using not initialized queues (bsc#1238646).
• CVE-2022-49371: driver core: fix deadlock in __device_attach (bsc#1238546).
• CVE-2022-49382: soc: rockchip: Fix refcount leak in rockchip_grf_init (bsc#1238306).
• CVE-2022-49396: phy: qcom-qmp: fix reset-controller leak on probe errors (bsc#1238289).
• CVE-2022-49420: net: annotate races around sk->sk_bound_dev_if (bsc#1238887).
• CVE-2022-49441: tty: fix deadlock caused by calling printk() under tty_port->lock (bsc#1238263).
• CVE-2022-49445: pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() (bsc#1238019).
• CVE-2022-49460: PM / devfreq: rk3399_dmc: Disable edev on remove() (bsc#1238892).
• CVE-2022-49467: drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() (bsc#1238815).
• CVE-2022-49474: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout (bsc#1238071).
• CVE-2022-49491: drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() (bsc#1238539).
• CVE-2022-49503: ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix (bsc#1238868).
• CVE-2022-49592: net: stmmac: fix dma queue left shift overflow issue (bsc#1238311).
• CVE-2022-49625: sfc: fix kernel panic when creating VF (bsc#1238411).
• CVE-2022-49635: drm/i915/selftests: fix subtraction overflow bug (bsc#1238806).
• CVE-2022-49652: dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate (bsc#1238871).
• CVE-2022-49715: irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions (bsc#1238818).
• CVE-2022-49728: kABI workaround for changeing the variable length type to size_t (bsc#1239111).
• CVE-2022-49729: nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred (bsc#1239060).
• CVE-2022-49751: w1: fix WARNING after calling w1_process() (bsc#1240254).
• CVE-2022-49761: btrfs: always report error in run_one_delayed_ref() (bsc#1240261).
• CVE-2022-49772: ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (bsc#1242147).
• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2022-49776: macvlan: enforce a consistent minimal mtu (bsc#1242248).
• CVE-2022-49787: mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (bsc#1242352).
• CVE-2022-49788: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (bsc#1242353).
• CVE-2022-49813: net: ena: Fix error handling in ena_init() (bsc#1242497).
• CVE-2022-49821: mISDN: fix possible memory leak in mISDN_dsp_element_register() (bsc#1242542).
• CVE-2022-49826: ata: libata-transport: fix double ata_host_put() in ata_tport_add() (bsc#1242549).
• CVE-2022-49829: drm/scheduler: fix fence ref counting (bsc#1242691).
• CVE-2022-49832: pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (bsc#1242154).
• CVE-2022-49835: ALSA: hda: fix potential memleak in…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49110: netfilter: conntrack: revisit gc autotuning (bsc#1237981).
• CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
• CVE-2022-49767: 9p/trans_fd: always use O_NONBLOCK read/write (bsc#1242493).
• CVE-2022-49769: gfs2: Check sb_bsize_shift after reading superblock (bsc#1242440).
• CVE-2022-49770: ceph: avoid putting the realm twice when decoding snaps fails (bsc#1242597).
• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2022-49789: scsi: zfcp: Fix double free of FSF request when qdio send fails (bsc#1242366).
• CVE-2023-53039: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function (bsc#1242745).
• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).

The following non-security bugs were fixed:

• HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc (bsc#1242745).
• devm-helpers: Add resource managed version of work init (bsc#1242745).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• workqueue: Add resource managed version of delayed work init (bsc#1242745).
• Remove debug flavor (bsc#1243919).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
• CVE-2024-28956: x86/its: Add support for ITS-safe indirect thunk (bsc#1242006).
• CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).

The following non-security bugs were fixed:

• Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• Move upstreamed sched/membarrier patch into sorted section
• Remove debug flavor (bsc#1243919). This is only released in Leap, and we do not have Leap 15.4 anymore.
• Remove debug flavor (bsc#1243919). This is only released in Leap, and we do not have Leap 15.5 anymore.
• Use gcc-13 for build on SLE16 (jsc#PED-10028).
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• net :mana :Add remaining GDMA stats for MANA to ethtool (bsc#1234395).
• net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (bsc#1234395).
• net: mana: Add gdma stats to ethtool output for mana (bsc#1234395).
• nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (bsc#1223096).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• rpm/kernel-binary.spec.in: Also order against update-bootloader (boo#1228659, boo#1240785, boo#1241038).
• rpm/kernel-binary.spec.in: Fix missing 20-kernel-default-extra.conf (bsc#1239986)
• rpm/kernel-binary.spec.in: fix KMPs build on 6.13+ (bsc#1234454)
• rpm/kernel-docs.spec.in: Workaround for reproducible builds (bsc#1238303)
• rpm/release-projects: Update the ALP projects again (bsc#1231293).
• rpm/split-modules: Fix optional splitting with usrmerge (bsc#1238570)
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• tcp: Dump bound-only sockets in inet_diag (bsc#1204562).
• tpm, tpm_tis: Workaround failed command reception on Infineon devices (bsc#1235870).
• tpm: tis: Double the timeout B to 4s (bsc#1235870).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49110: netfilter: conntrack: revisit gc autotuning (bsc#1237981).
• CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
• CVE-2022-49767: 9p/trans_fd: always use O_NONBLOCK read/write (bsc#1242493).
• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2022-49858: octeontx2-pf: Fix SQE threshold checking (bsc#1242589).
• CVE-2023-53058: net/mlx5: E-Switch, Fix an Oops in error handling code (bsc#1242237).
• CVE-2023-53060: igb: revert rtnl_lock() that causes deadlock (bsc#1242241).
• CVE-2023-53064: iavf: Fix hang on reboot with ice (bsc#1242222).
• CVE-2023-53066: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info (bsc#1242227).
• CVE-2023-53079: net/mlx5: Fix steering rules cleanup (bsc#1242765).
• CVE-2023-53114: i40e: Fix kernel crash during reboot when adapter is in recovery mode (bsc#1242398).
• CVE-2023-53134: bnxt_en: Avoid order-5 memory allocation for TPA data (bsc#1242380)
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21888: RDMA/mlx5: Fix a WARN during dereg_mr for DM type (bsc#1240177).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
• CVE-2025-23138: watch_queue: fix pipe accounting mismatch (bsc#1241648).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).

The following non-security bugs were fixed:

• Refresh fixes for cBPF issue (bsc#1242778)
• Remove debug flavor (bsc#1243919).
• Update metadata and put them into the sorted part of the series
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• scsi: storvsc: Set correct data length for sending SCSI command without payload (git-fixes).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52489: mm/sparsemem: fix race in accessing memory_section->usage (bsc#1221326).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).
• CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).
• CVE-2024-36915: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies (bsc#1225758).
• CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
• CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).
• CVE-2024-44996: vsock: fix recursive ->recvmsg calls (bsc#1230205).
• CVE-2024-45828: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request (bsc#1235705).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).
• CVE-2024-48881: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again (bsc#1235727).
• CVE-2024-49944: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start (bsc#1232166).
• CVE-2024-49951: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (bsc#1232158).
• CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
• CVE-2024-49998: net: dsa: improve shutdown sequence (bsc#1232087).
• CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).
• CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).
• CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).
• CVE-2024-50151: smb: client: fix OOBs when building SMB2_IOCTL request (bsc#1233055).
• CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unuse_vma (bsc#1233112).
• CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).
• CVE-2024-50252: mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address (bsc#1233201).
• CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).
• CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).
• CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).
• CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50296: net: hns3: fix kernel crash when uninstalling driver (bsc#1233485).
• CVE-2024-50299: sctp: properly validate chunk size in sctp_sf_ootb() (bsc#1233488).
• CVE-2024-53043: mctp i2c: handle NULL header address (bsc#1233523).
• CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).
• CVE-2024-53051: drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (bsc#1233547).
• CVE-2024-53055: wifi: iwlwifi: mvm: fix 6 GHz scan construction (bsc#1233550).
• CVE-2024-53056: drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() (bsc#1233568).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
• CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).
• CVE-2024-53091: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (bsc#1233638).
• CVE-2024-53099: bpf: Check validity of link->type in bpf_link_show_fdinfo() (bsc#1233772).
• CVE-2024-53105: mm: page_alloc: move mlocked flag…

This update for the Linux Kernel 6.4.0-150600_10_8 fixes several issues.

The following security issues were fixed:

• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233072).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).
• CVE-2025-38089: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (bsc#1245509).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237048).

This update for the Linux Kernel 6.4.0-150600_10_14 fixes several issues.

The following security issues were fixed:

• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233072).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).
• CVE-2025-38089: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (bsc#1245509).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237048).

This update for the Linux Kernel 6.4.0-150600_10_20 fixes several issues.

The following security issues were fixed:

• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).
• CVE-2025-38089: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (bsc#1245509).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237048).

This update for the Linux Kernel 4.12.14-122_237 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).

This update for the Linux Kernel 4.12.14-122_228 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233072).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).

This update for the Linux Kernel 4.12.14-122_255 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).

This update for the Linux Kernel 6.4.0-150600_10_11 fixes several issues.

The following security issues were fixed:

• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233072).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).
• CVE-2025-38089: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (bsc#1245509).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237048).

This update for the Linux Kernel 4.12.14-122_247 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).

This update for the Linux Kernel 4.12.14-122_258 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).

This update for the Linux Kernel 5.3.18-150300_59_174 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233072).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237048).

This update for the Linux Kernel 5.3.18-150300_59_185 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237048).

This update for the Linux Kernel 5.3.18-150300_59_182 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233072).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237048).

This update for the Linux Kernel 5.3.18-150300_59_204 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).

This update for the Linux Kernel 5.3.18-150300_59_195 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237048).

This update for the Linux Kernel 5.3.18-150300_59_198 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).

This update for the Linux Kernel 5.3.18-150300_59_188 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237048).

This update for the Linux Kernel 5.14.21-150400_24_141 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233072).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237048).

This update for the Linux Kernel 5.14.21-150400_24_153 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).

This update for the Linux Kernel 5.14.21-150400_24_144 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237048).

This update for the Linux Kernel 5.14.21-150400_24_133 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233072).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).
• CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237048).

This update for the Linux Kernel 5.14.21-150400_24_164 fixes several issues.

The following security issues were fixed:

• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).