CVE-2024-58013

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543 Read of size 8 at addr ffff88814128f898 by task kworker/u9:4/5961 CPU: 1 UID: 0 PID: 5961 Comm: kworker/u9:4 Not tainted 6.12.0-syzkaller-10684-gf1cd565ce577 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: hci0 hci_cmd_sync_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 16026: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269 mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296 remove_adv_monitor+0x102/0x1b0 net/bluetooth/mgmt.c:5568 hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712 hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:726 sock_write_iter+0x2d7/0x3f0 net/socket.c:1147 new_sync_write fs/read_write.c:586 [inline] vfs_write+0xaeb/0xd30 fs/read_write.c:679 ksys_write+0x18f/0x2b0 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 16022: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2338 [inline] slab_free mm/slub.c:4598 [inline] kfree+0x196/0x420 mm/slub.c:4746 mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259 __mgmt_power_off+0x183/0x430 net/bluetooth/mgmt.c:9550 hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208 hci_dev_do_close net/bluetooth/hci_core.c:483 [inline] hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508 sock_do_ioctl+0x158/0x460 net/socket.c:1209 sock_ioctl+0x626/0x8e0 net/socket.c:1328 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative.

[ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7 [ 23.734418] shift exponent -1 is negative

Ensuring xlate_pos is a positive or zero before BIT.(CVE-2023-53034)

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()

The "submit->cmd[i].size" and "submit->cmd[i].offset" variables are u32 values that come from the user via the submit_lookup_cmds() function. This addition could lead to an integer wrapping bug so use size_add() to prevent that.

Patchwork: https://patchwork.freedesktop.org/patch/624696/(CVE-2024-52559)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()

Extended the mi_enum_attr() function interface with an additional parameter, struct ntfs_inode *ni, to allow marking the inode as bad as soon as an error is detected.(CVE-2024-52560)

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat/qat_4xxx - fix off by one in uof_get_name()

The fw_objs[] array has "num_objs" elements so the > needs to be >= to prevent an out of bounds read.(CVE-2024-53162)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix use-after-free of signing key

Customers have reported use-after-free in @ses->auth_key.response with SMB2.1 + sign mounts which occurs due to following race:

task A task B cifs_mount() dfs_mount_share() get_session() cifs_mount_get_session() cifs_send_recv() cifs_get_smb_ses() compound_send_recv() cifs_setup_session() smb2_setup_request() kfree_sensitive() smb2_calc_signature() crypto_shash_setkey() UAF

Fix this by ensuring that we have a valid @ses->auth_key.response by checking whether @ses->ses_status is SES_GOOD or SES_EXITING with @ses->ses_lock held. After commit 24a9799aa8ef ("smb: client: fix UAF in smb2_reconnect_server()"), we made sure to call ->logoff() only when @ses was known to be good (e.g. valid ->auth_key.response), so it's safe to access signing key when @ses->ses_status == SES_EXITING.(CVE-2024-53179)

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: bsg: Set bsg_queue to NULL after removal

Currently, this does not cause any issues, but I believe it is necessary to set bsg_queue to NULL after removing it to prevent potential use-after-free (UAF) access.(CVE-2024-54458)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Play nice with protected guests in complete_hypercall_exit()

Use is_64_bit_hypercall() instead of is_64_bit_mode() to detect a 64-bit hypercall when completing said hypercall. For guests with protected state, e.g. SEV-ES and SEV-SNP, KVM must assume the hypercall was made in 64-bit mode as the vCPU state needed to detect 64-bit mode is unavailable.

Hacking the sev_smoke_test selftest to generate a KVM_HC_MAP_GPA_RANGE hypercall via VMGEXIT trips the WARN:

------------[ cut here ]------------ WARNING: CPU: 273 PID: 326626 at arch/x86/kvm/x86.h:180 complete_hypercall_exit+0x44/0xe0 [kvm] Modules linked in: kvm_amd kvm ... [last unloaded: kvm] CPU: 273 UID: 0 PID: 326626 Comm: sev_smoke_test Not tainted 6.12.0-smp--392e932fa0f3-feat…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative.

[ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7 [ 23.734418] shift exponent -1 is negative

Ensuring xlate_pos is a positive or zero before BIT.(CVE-2023-53034)

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to shrink read extent node in batches

We use rwlock to protect core structure data of extent tree during its shrink, however, if there is a huge number of extent nodes in extent tree, during shrink of extent tree, it may hold rwlock for a very long time, which may trigger kernel hang issue.

This patch fixes to shrink read extent node in batches, so that, critical region of the rwlock can be shrunk to avoid its extreme long time hold.(CVE-2024-41935)

In the Linux kernel, the following vulnerability has been resolved:

vrf: revert "vrf: Remove unnecessary RCU-bh critical section"

This reverts commit 504fc6f4f7f681d2a03aa5f68aad549d90eab853.

dev_queue_xmit_nit is expected to be called with BH disabled. __dev_queue_xmit has the following:

    /* Disable soft irqs for various locks below. Also
     * stops preemption for RCU.
     */
    rcu_read_lock_bh();

VRF must follow this invariant. The referenced commit removed this protection. Which triggered a lockdep warning:

================================
WARNING: inconsistent lock state
6.11.0 #1 Tainted: G        W
--------------------------------
inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
btserver/134819 [HC0[0]:SC0[0]:HE1:SE1] takes:
ffff8882da30c118 (rlock-AF_PACKET){+.?.}-{2:2}, at: tpacket_rcv+0x863/0x3b30
{IN-SOFTIRQ-W} state was registered at:
  lock_acquire+0x19a/0x4f0
  _raw_spin_lock+0x27/0x40
  packet_rcv+0xa33/0x1320
  __netif_receive_skb_core.constprop.0+0xcb0/0x3a90
  __netif_receive_skb_list_core+0x2c9/0x890
  netif_receive_skb_list_internal+0x610/0xcc0
      [...]

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(rlock-AF_PACKET);
  <Interrupt>
    lock(rlock-AF_PACKET);

 *** DEADLOCK ***

Call Trace:
 <TASK>
 dump_stack_lvl+0x73/0xa0
 mark_lock+0x102e/0x16b0
 __lock_acquire+0x9ae/0x6170
 lock_acquire+0x19a/0x4f0
 _raw_spin_lock+0x27/0x40
 tpacket_rcv+0x863/0x3b30
 dev_queue_xmit_nit+0x709/0xa40
 vrf_finish_direct+0x26e/0x340 [vrf]
 vrf_l3_out+0x5f4/0xe80 [vrf]
 __ip_local_out+0x51e/0x7a0
      [...](CVE-2024-49980)

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()

The "submit->cmd[i].size" and "submit->cmd[i].offset" variables are u32 values that come from the user via the submit_lookup_cmds() function. This addition could lead to an integer wrapping bug so use size_add() to prevent that.

Patchwork: https://patchwork.freedesktop.org/patch/624696/(CVE-2024-52559)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()

Extended the mi_enum_attr() function interface with an additional parameter, struct ntfs_inode *ni, to allow marking the inode as bad as soon as an error is detected.(CVE-2024-52560)

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat/qat_4xxx - fix off by one in uof_get_name()

The fw_objs[] array has "num_objs" elements so the > needs to be >= to…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466) (CVE-2024-53241)

• kernel: exfat: fix out-of-bounds access of directory entries (CVE-2024-53147)

• kernel: zram: fix NULL pointer in comp_algorithm_show() (CVE-2024-53222)

• kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)

• kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662)

• kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675)

• kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY (CVE-2024-56690)

• kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332)

• kernel: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK (CVE-2024-57901)

• kernel: af_packet: fix vlan_get_tci() vs MSG_PEEK (CVE-2024-57902)

• kernel: io_uring/sqpoll: zero sqd->thread on tctx errors (CVE-2025-21633)

• kernel: ipvlan: Fix use-after-free in ipvlan_get_iflink(). (CVE-2025-21652)

• kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647)

• kernel: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (CVE-2025-21655)

• kernel: netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled (CVE-2024-57941)

• kernel: netfs: Fix ceph copy to cache on write-begin (CVE-2024-57942)

• kernel: zram: fix potential UAF of zram table (CVE-2025-21671)

• kernel: pktgen: Avoid out-of-bounds access in get_imix_entries (CVE-2025-21680)

• kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693)

• kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)

• kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696)

• kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)

• kernel: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (CVE-2025-21732)

• kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795)

• kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456)

• kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987)

• kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014)

• kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988)

• kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570)

• kernel: media: intel/ipu6: remove cpu latency qos request on error (CVE-2024-58004)

• kernel: usbnet: ipheth: use static NDP16 location in URB (CVE-2025-21742)

• kernel: usbnet: ipheth: fix possible overflow in DPE length check (CVE-2025-21743)

• kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989)

• kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015)

• kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)

• kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796)

• kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786)

• kernel: tpm: Change to kvalloc() in eventlog/acpi.c (CVE-2024-58005)

• kernel: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (CVE-2024-58013)

• kernel: ring-buffer: Validate the persistent meta data subbuf array (CVE-2025-21777)

• kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738)

• kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections (CVE-2024-57986)

• kernel: padata: avoid UAF for reorder_work (CVE-2025-21726)

• kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791)

• kernel: HID: multitouch: Add NULL check in mt_input_configured…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543 Read of size 8 at addr ffff88814128f898 by task kworker/u9:4/5961 CPU: 1 UID: 0 PID: 5961 Comm: kworker/u9:4 Not tainted 6.12.0-syzkaller-10684-gf1cd565ce577 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: hci0 hci_cmd_sync_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 16026: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269 mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296 remove_adv_monitor+0x102/0x1b0 net/bluetooth/mgmt.c:5568 hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712 hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:726 sock_write_iter+0x2d7/0x3f0 net/socket.c:1147 new_sync_write fs/read_write.c:586 [inline] vfs_write+0xaeb/0xd30 fs/read_write.c:679 ksys_write+0x18f/0x2b0 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 16022: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2338 [inline] slab_free mm/slub.c:4598 [inline] kfree+0x196/0x420 mm/slub.c:4746 mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259 __mgmt_power_off+0x183/0x430 net/bluetooth/mgmt.c:9550 hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208 hci_dev_do_close net/bluetooth/hci_core.c:483 [inline] hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508 sock_do_ioctl+0x158/0x460 net/socket.c:1209 sock_ioctl+0x626/0x8e0 net/socket.c:1328 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466) (CVE-2024-53241)
• kernel: exfat: fix out-of-bounds access of directory entries (CVE-2024-53147)
• kernel: zram: fix NULL pointer in comp_algorithm_show() (CVE-2024-53222)
• kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)
• kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662)
• kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675)
• kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY (CVE-2024-56690)
• kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332)
• kernel: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK (CVE-2024-57901)
• kernel: af_packet: fix vlan_get_tci() vs MSG_PEEK (CVE-2024-57902)
• kernel: io_uring/sqpoll: zero sqd->thread on tctx errors (CVE-2025-21633)
• kernel: ipvlan: Fix use-after-free in ipvlan_get_iflink(). (CVE-2025-21652)
• kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647)
• kernel: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (CVE-2025-21655)
• kernel: netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled (CVE-2024-57941)
• kernel: netfs: Fix ceph copy to cache on write-begin (CVE-2024-57942)
• kernel: zram: fix potential UAF of zram table (CVE-2025-21671)
• kernel: pktgen: Avoid out-of-bounds access in get_imix_entries (CVE-2025-21680)
• kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693)
• kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)
• kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696)
• kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)
• kernel: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (CVE-2025-21732)
• kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795)
• kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456)
• kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987)
• kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014)
• kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988)
• kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570)
• kernel: media: intel/ipu6: remove cpu latency qos request on error (CVE-2024-58004)
• kernel: usbnet: ipheth: use static NDP16 location in URB (CVE-2025-21742)
• kernel: usbnet: ipheth: fix possible overflow in DPE length check (CVE-2025-21743)
• kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989)
• kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015)
• kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)
• kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796)
• kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786)
• kernel: tpm: Change to kvalloc() in eventlog/acpi.c (CVE-2024-58005)
• kernel: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (CVE-2024-58013)
• kernel: ring-buffer: Validate the persistent meta data subbuf array (CVE-2025-21777)
• kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738)
• kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections (CVE-2024-57986)
• kernel: padata: avoid UAF for reorder_work (CVE-2025-21726)
• kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791)
• kernel: HID:…

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync

This fixes the following crash:

================================================================== BUG: KASAN: slab-use-after-free in mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543 Read of size 8 at addr ffff88814128f898 by task kworker/u9:4/5961

CPU: 1 UID: 0 PID: 5961 Comm: kworker/u9:4 Not tainted 6.12.0-syzkaller-10684-gf1cd565ce577 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: hci0 hci_cmd_sync_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>

Allocated by task 16026: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269 mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296 remove_adv_monitor+0x102/0x1b0 net/bluetooth/mgmt.c:5568 hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712 hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:726 sock_write_iter+0x2d7/0x3f0 net/socket.c:1147 new_sync_write fs/read_write.c:586 [inline] vfs_write+0xaeb/0xd30 fs/read_write.c:679 ksys_write+0x18f/0x2b0 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 16022: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2338 [inline] slab_free mm/slub.c:4598 [inline] kfree+0x196/0x420 mm/slub.c:4746 mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259 __mgmt_power_off+0x183/0x430 net/bluetooth/mgmt.c:9550 hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208 hci_dev_do_close net/bluetooth/hci_core.c:483 [inline] hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508 sock_do_ioctl+0x158/0x460 net/socket.c:1209 sock_ioctl+0x626/0x8e0 net/socket.c:1328 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f

• HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
• fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
• ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
• Bluetooth: ISO: Fix possible UAF on iso_conn_free {CVE-2025-40141}
• Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once {CVE-2025-40318}
• smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
• pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
• ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
• fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• bus: mhi: host: Detect events pointing to unexpected TREs {CVE-2025-39790}
• nvmet: fix out-of-bounds access in nvmet_enable_port {CVE-2025-37825}
• drm/xe: Make dma-fences compliant with the safe access rules {CVE-2025-38703}
• libceph: fix invalid accesses to ceph_connection_v1_info {CVE-2025-39880}
• fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass {CVE-2025-38396}
• anon_inode: explicitly block ->setattr()
• anon_inode: use a proper mode internally
• dynamic_dname(): drop unused dentry argument
• anon_inode: raise SB_I_NODEV and SB_I_NOEXEC
• Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete {CVE-2025-38118}
• Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync {CVE-2024-58013}
• drm/xe: Fix vm_bind_ioctl double free bug {CVE-2025-38731}
• media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
• HID: core: ensure __hid_request reserves the report ID as the first byte
• wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691}
• drm/i915: Protect access to driver and timeline name
• sync_file: Protect access to driver and timeline name
• dma-fence: Add safe access helpers and document the rules
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• net: phylink: add lock for serializing concurrent pl->phydev writes with resolver {CVE-2025-39905}
• HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() {CVE-2025-39806}
• vsock: Do not allow binding to VMADDR_PORT_ANY {CVE-2025-38618}
• mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory {CVE-2025-39883}
• md/raid1: Fix stack memory use after return in raid1_reshape {CVE-2025-38445}
• drm/i915/gt: Fix timeline left held on VMA alloc error {CVE-2025-38389}
• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• i40e: remove read access to debugfs files {CVE-2025-39901}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• bnxt_en: Fix memory corruption when FW resources change during ifdown {CVE-2025-39810}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• nbd: fix uaf in nbd_genl_connect() error path {CVE-2025-38443}
• Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
• regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods {CVE-2025-38395}
• virtio-net: ensure the received length does not exceed allocated size {CVE-2025-38375}
• ftrace: Fix UAF when lookup kallsym after ftrace disabled {CVE-2025-38346}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• software node: Correct a OOB check in software_node_get_reference_args() {CVE-2025-38342}
• net: atm: add lec_mutex {CVE-2025-38323} -…

• net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit {CVE-2025-39766}
• NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• KVM: x86: use array_index_nospec with indices that come from guest {CVE-2025-39823}
• ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
• ext4: improve error handling from ext4_dirhash() {CVE-2023-53473}
• rcu: Protect ->defer_qs_iw_pending from data race {CVE-2025-39749}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
• ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
• Bluetooth: ISO: Fix possible UAF on iso_conn_free {CVE-2025-40141}
• pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
• lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
• ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
• fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
• fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• libceph: fix invalid accesses to ceph_connection_v1_info {CVE-2025-39880}
• bus: mhi: host: Detect events pointing to unexpected TREs {CVE-2025-39790}
• nvmet: fix out-of-bounds access in nvmet_enable_port {CVE-2025-37825}
• net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() {CVE-2023-54155}
• wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
• fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691}
• net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device {CVE-2023-54015}
• x86/sev: Make enc_dec_hypercall() accept a size instead of npages {CVE-2023-53996}
• page_pool: Fix use-after-free in page_pool_recycle_in_ring {CVE-2025-38129}
• page_pool: fix inconsistency for page_pool_ring_[un]lock()
• net: page_pool: use in_softirq() instead {CVE-2025-38129}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• vsock: avoid to close connected socket after the timeout {CVE-2025-40248}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• smb: client: let recv_done verify data_offset, data_length and remaining_data_length {CVE-2025-39933}
• net: phylink: add lock for serializing concurrent pl->phydev writes with resolver {CVE-2025-39905}
• i40e: validate ring_len parameter against hardware-specific values
• i40e: add validation for ring_len param {CVE-2025-39973}
• i40e: increase max descriptors for XL710
• i40e: remove read access to debugfs files {CVE-2025-39901}
• mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory {CVE-2025-39883}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• i2c: tegra: check msg length in SMBUS block read {CVE-2025-38425}
• regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods {CVE-2025-38395}
• virtio-net: ensure the received length does not exceed allocated size {CVE-2025-38375}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow {CVE-2023-54102}
• tcp: fix a signed-integer-overflow bug in tcp_add_backlog() {CVE-2022-50865}
• tcp: minor optimization in tcp_add_backlog() {CVE-2022-50865}
• block, bfq: fix uaf for bfqq in bic_set_bfqq() {CVE-2023-52983}
• block, bfq: replace 0/1 with…

Root has patched CVE-2024-58013 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2024-58013 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

This update for the Linux Kernel 6.4.0-150600_10_17 fixes several issues.

The following security issues were fixed:

• CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236701).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 6.4.0-150600_8 fixes several issues.

The following security issues were fixed:

• CVE-2024-49855: nbd: fix race between timeout and normal completion (bsc#1232900).
• CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236701).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 6.4.0-150600_10_20 fixes several issues.

The following security issues were fixed:

• CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236701).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 6.4.0-150600_10_14 fixes several issues.

The following security issues were fixed:

• CVE-2024-49855: nbd: fix race between timeout and normal completion (bsc#1232900).
• CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236701).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.14.21-150500_55_68 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-49855: nbd: fix race between timeout and normal completion (bsc#1232900).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.14.21-150500_55_80 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-49855: nbd: fix race between timeout and normal completion (bsc#1232900).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.14.21-150500_55_91 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.14.21-150500_55_94 fixes several issues.

The following security issues were fixed:

• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 5.14.21-150500_55_97 fixes several issues.

The following security issues were fixed:

• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-43869: perf: Fix hang while freeing sigtrap event (bsc#1229491).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
• CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
• CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
• CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
• CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
• CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
• CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
• CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086). -…

This update for the Linux Kernel 6.4.0-150600_23_22 fixes several issues.

The following security issues were fixed:

• CVE-2024-49855: nbd: fix race between timeout and normal completion (bsc#1232900).
• CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236701).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 6.4.0-150600_23_14 fixes several issues.

The following security issues were fixed:

• CVE-2024-49855: nbd: fix race between timeout and normal completion (bsc#1232900).
• CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236701).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 6.4.0-150600_23_30 fixes several issues.

The following security issues were fixed:

• CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236701).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 6.4.0-150600_23_38 fixes several issues.

The following security issues were fixed:

• CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236701).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

This update for the Linux Kernel 6.4.0-150600_23_33 fixes several issues.

The following security issues were fixed:

• CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236701).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239077).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239095).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• Revert 'gfs2: Fix inode height consistency check (git-fixes).
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• cifs: Add a laundromat thread for cached directories (git-fixes).
• cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path (git-fixes).
• gfs2: Fix inode height consistency check (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• sched/membarrier: Fix redundant load of membarrier_state (bsc#1232743).
• smb3: allow controlling length of time directory entries are cached with dir leases (git-fixes).
• smb3: do not start laundromat thread when dir leases disabled (git-fixes).
• smb3: retrying on failed server close (git-fixes).
• smb: client: destroy cfid_put_wq on module exit (git-fixes).
• smb: client: disable directory caching when dir_cache_timeout is zero (git-fixes).
• smb: client: do not start laundromat thread on nohandlecache (git-fixes).
• smb: client: make laundromat a delayed worker (git-fixes).
• smb: client: properly close cfids on umount (bsc#1231432, bsc#1232299, bsc#1235599, bsc#1234896).
• tpm: send_data: Wait longer for the TPM to become ready (bsc#1235870).

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
• CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
• CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
• CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
• CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
• CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
• CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
• CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
• CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58012: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (bsc#1239104).
• CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2025-21635: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy (bsc#1236111).
• CVE-2025-21659: netdev: prevent accessing NAPI instances from another namespace (bsc#1236206).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21701: net: avoid race between device unregistration and ethnl ops (bsc#1237164).
• CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
• CVE-2025-21706: mptcp: pm: only set fullmesh for subflow endp (bsc#1238528).
• CVE-2025-21739: kABI: ufshcd: add ufshcd_dealloc_host back (bsc#1238506).
• CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
• CVE-2025-21759: ipv6: mcast: extend RCU protection in igmp6_send() (bsc#1238738).
• CVE-2025-21760: ndisc: extend RCU protection in ndisc_send_skb() (bsc#1238763).
• CVE-2025-21761: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() (bsc#1238775).
• CVE-2025-21762: arp: use RCU protection in arp_xmit() (bsc#1238780).
• CVE-2025-21763:…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
• CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
• CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
• CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
• CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
• CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
• CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
• CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
• CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
• CVE-2024-57979: kABI workaround for pps changes (bsc#1238521).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58012: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (bsc#1239104).
• CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2025-21635: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy (bsc#1236111).
• CVE-2025-21659: netdev: prevent accessing NAPI instances from another namespace (bsc#1236206).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21701: net: avoid race between device unregistration and ethnl ops (bsc#1237164).
• CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
• CVE-2025-21706: mptcp: pm: only set fullmesh for subflow endp (bsc#1238528).
• CVE-2025-21733: tracing/osnoise: Fix resetting of tracepoints (bsc#1238494).
• CVE-2025-21739: kABI: ufshcd: add ufshcd_dealloc_host back (bsc#1238506).
• CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
• CVE-2025-21754: btrfs: fix assertion failure when splitting ordered extent after transaction abort (bsc#1238496).
• CVE-2025-21759: ipv6: mcast: extend RCU protection in igmp6_send() (bsc#1238738). -…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
• CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
• CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
• CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
• CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
• CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
• CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
• CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
• CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
• CVE-2024-57979: kABI workaround for pps changes (bsc#1238521).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58012: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (bsc#1239104).
• CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2025-21635: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy (bsc#1236111).
• CVE-2025-21659: netdev: prevent accessing NAPI instances from another namespace (bsc#1236206).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21701: net: avoid race between device unregistration and ethnl ops (bsc#1237164).
• CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
• CVE-2025-21706: mptcp: pm: only set fullmesh for subflow endp (bsc#1238528).
• CVE-2025-21733: tracing/osnoise: Fix resetting of tracepoints (bsc#1238494).
• CVE-2025-21739: kABI: ufshcd: add ufshcd_dealloc_host back (bsc#1238506).
• CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
• CVE-2025-21754: btrfs: fix assertion failure when splitting ordered extent after transaction abort (bsc#1238496).
• CVE-2025-21759: ipv6: mcast: extend RCU protection in igmp6_send() (bsc#1238738). -…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239095).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• cifs: Add a laundromat thread for cached directories (git-fixes).
• cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path (git-fixes).
• gfs2: Fix inode height consistency check (git-fixes).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• sched/membarrier: Fix redundant load of membarrier_state (bsc#1232743).
• smb: client: destroy cfid_put_wq on module exit (git-fixes).
• smb: client: disable directory caching when dir_cache_timeout is zero (git-fixes).
• smb: client: do not start laundromat thread on nohandlecache (git-fixes).
• smb: client: make laundromat a delayed worker (git-fixes).
• smb: client: properly close cfids on umount (bsc#1231432, bsc#1232299, bsc#1235599, bsc#1234896).
• smb3: allow controlling length of time directory entries are cached with dir leases (git-fixes).
• smb3: do not start laundromat thread when dir leases disabled (git-fixes).
• smb3: retrying on failed server close (git-fixes).
• tpm: send_data: Wait longer for the TPM to become ready (bsc#1235870).

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
• CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
• CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
• CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
• CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
• CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
• CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
• CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
• CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
• CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
• CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free…

This update for kernel-livepatch-MICRO-6-0-RT_Update_2 fixes the following issues:

• CVE-2024-49855: nbd: fix race between timeout and normal completion (bsc#1232900)
• CVE-2025-21680: pktgen: avoid out-of-bounds access in get_imix_entries (bsc#1236701)
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096)
• CVE-2024-57996: net_sched: sch_sfq: don't allow 1 packet limit References: (bsc#1239077)

This update for kernel-livepatch-MICRO-6-0-RT_Update_4 fixes the following issues:

• CVE-2025-21680: pktgen: avoid out-of-bounds access in get_imix_entries (bsc#1236701)
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096)
• CVE-2024-57996: net_sched: sch_sfq: don't allow 1 packet limit References: (bsc#1239077)

This update for kernel-livepatch-MICRO-6-0-RT_Update_5 fixes the following issues:

• CVE-2025-21680: pktgen: avoid out-of-bounds access in get_imix_entries (bsc#1236701)
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096)
• CVE-2024-57996: net_sched: sch_sfq: don't allow 1 packet limit References: (bsc#1239077)

This update for kernel-livepatch-MICRO-6-0-RT_Update_3 fixes the following issues:

• CVE-2024-49855: nbd: fix race between timeout and normal completion (bsc#1232900)
• CVE-2025-21680: pktgen: avoid out-of-bounds access in get_imix_entries (bsc#1236701)
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096)
• CVE-2024-57996: net_sched: sch_sfq: don't allow 1 packet limit References: (bsc#1239077)

This update for kernel-livepatch-MICRO-6-0_Update_2 fixes the following issues:

• CVE-2024-49855: nbd: fix race between timeout and normal completion (bsc#1232900)
• CVE-2025-21680: pktgen: avoid out-of-bounds access in get_imix_entries (bsc#1236701)
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096)
• CVE-2024-57996: net_sched: sch_sfq: don't allow 1 packet limit References: (bsc#1239077)

This update for kernel-livepatch-MICRO-6-0_Update_4 fixes the following issues:

• CVE-2025-21680: pktgen: avoid out-of-bounds access in get_imix_entries (bsc#1236701)
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096)
• CVE-2024-57996: net_sched: sch_sfq: don't allow 1 packet limit References: (bsc#1239077)

This update for kernel-livepatch-MICRO-6-0_Update_3 fixes the following issues:

• CVE-2024-49855: nbd: fix race between timeout and normal completion (bsc#1232900)
• CVE-2025-21680: pktgen: avoid out-of-bounds access in get_imix_entries (bsc#1236701)
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096)
• CVE-2024-57996: net_sched: sch_sfq: don't allow 1 packet limit References: (bsc#1239077)

This update for kernel-livepatch-MICRO-6-0_Update_5 fixes the following issues:

• CVE-2025-21680: pktgen: avoid out-of-bounds access in get_imix_entries (bsc#1236701)
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096)
• CVE-2024-57996: net_sched: sch_sfq: don't allow 1 packet limit References: (bsc#1239077)

This update for kernel-livepatch-MICRO-6-0_Update_2 fixes the following issues:

• CVE-2024-49855: nbd: fix race between timeout and normal completion (bsc#1232900)
• CVE-2025-21680: pktgen: avoid out-of-bounds access in get_imix_entries (bsc#1236701)
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096)
• CVE-2024-57996: net_sched: sch_sfq: don't allow 1 packet limit References: (bsc#1239077)

This update for kernel-livepatch-MICRO-6-0_Update_4 fixes the following issues:

• CVE-2025-21680: pktgen: avoid out-of-bounds access in get_imix_entries (bsc#1236701)
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096)
• CVE-2024-57996: net_sched: sch_sfq: don't allow 1 packet limit References: (bsc#1239077)

This update for kernel-livepatch-MICRO-6-0_Update_5 fixes the following issues:

• CVE-2025-21680: pktgen: avoid out-of-bounds access in get_imix_entries (bsc#1236701)
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239096)
• CVE-2024-57996: net_sched: sch_sfq: don't allow 1 packet limit References: (bsc#1239077)