CVE-2025-21772

In the Linux kernel, the following vulnerability has been resolved: partitions: mac: fix handling of bogus partition table Fix several issues in partition probing: - The bailout for a bad partoffset must use put_dev_sector(), since the preceding read_part_sector() succeeded. - If the partition table claims a silly sector size like 0xfff bytes (which results in partition table entries straddling sector boundaries), bail out instead of accessing out-of-bounds memory. - We must not assume that the partition table contains proper NUL termination - use strnlen() and strncmp() instead of strlen() and strcmp().

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: add flush_workqueue to prevent uaf

Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism (timer and workqueue).

The race can be demonstrated below:

Thread-1 Thread-2 | nci_dev_up() | nci_open_device() | __nci_request(nci_reset_req) | nci_send_cmd | queue_work(cmd_work) nci_unregister_device() | nci_close_device() | ... del_timer_sync(cmd_timer)[1] | ... | Worker nci_free_device() | nci_cmd_work() kfree(ndev)[3] | mod_timer(cmd_timer)[2]

In short, the cleanup routine thought that the cmd_timer has already been detached by [1] but the mod_timer can re-attach the timer [2], even it is already released [3], resulting in UAF.

This UAF is easy to trigger, crash trace by POC is like below

[ 66.703713] ================================================================== [ 66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490 [ 66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:1/33 [ 66.703974] [ 66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 Not tainted 5.18.0-rc2 #5 [ 66.703974] Workqueue: nfc2_nci_cmd_wq nci_cmd_work [ 66.703974] Call Trace: [ 66.703974] <TASK> [ 66.703974] dump_stack_lvl+0x57/0x7d [ 66.703974] print_report.cold+0x5e/0x5db [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] kasan_report+0xbe/0x1c0 [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] enqueue_timer+0x448/0x490 [ 66.703974] __mod_timer+0x5e6/0xb80 [ 66.703974] ? mark_held_locks+0x9e/0xe0 [ 66.703974] ? try_to_del_timer_sync+0xf0/0xf0 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x17b/0x410 [ 66.703974] ? queue_work_on+0x61/0x80 [ 66.703974] ? lockdep_hardirqs_on+0xbf/0x130 [ 66.703974] process_one_work+0x8bb/0x1510 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 66.703974] ? pwq_dec_nr_in_flight+0x230/0x230 [ 66.703974] ? rwlock_bug.part.0+0x90/0x90 [ 66.703974] ? _raw_spin_lock_irq+0x41/0x50 [ 66.703974] worker_thread+0x575/0x1190 [ 66.703974] ? process_one_work+0x1510/0x1510 [ 66.703974] kthread+0x2a0/0x340 [ 66.703974] ? kthread_complete_and_exit+0x20/0x20 [ 66.703974] ret_from_fork+0x22/0x30 [ 66.703974] </TASK> [ 66.703974] [ 66.703974] Allocated by task 267: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] __kasan_kmalloc+0x81/0xa0 [ 66.703974] nci_allocate_device+0xd3/0x390 [ 66.703974] nfcmrvl_nci_register_dev+0x183/0x2c0 [ 66.703974] nfcmrvl_nci_uart_open+0xf2/0x1dd [ 66.703974] nci_uart_tty_ioctl+0x2c3/0x4a0 [ 66.703974] tty_ioctl+0x764/0x1310 [ 66.703974] __x64_sys_ioctl+0x122/0x190 [ 66.703974] do_syscall_64+0x3b/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 66.703974] [ 66.703974] Freed by task 406: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] kasan_set_track+0x21/0x30 [ 66.703974] kasan_set_free_info+0x20/0x30 [ 66.703974] __kasan_slab_free+0x108/0x170 [ 66.703974] kfree+0xb0/0x330 [ 66.703974] nfcmrvl_nci_unregister_dev+0x90/0xd0 [ 66.703974] nci_uart_tty_close+0xdf/0x180 [ 66.703974] tty_ldisc_kill+0x73/0x110 [ 66.703974] tty_ldisc_hangup+0x281/0x5b0 [ 66.703974] __tty_hangup.part.0+0x431/0x890 [ 66.703974] tty_release+0x3a8/0xc80 [ 66.703974] __fput+0x1f0/0x8c0 [ 66.703974] task_work_run+0xc9/0x170 [ 66.703974] exit_to_user_mode_prepare+0x194/0x1a0 [ 66.703974] syscall_exit_to_user_mode+0x19/0x50 [ 66.703974] …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative.

[ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7 [ 23.734418] shift exponent -1 is negative

Ensuring xlate_pos is a positive or zero before BIT.(CVE-2023-53034)

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()

The "submit->cmd[i].size" and "submit->cmd[i].offset" variables are u32 values that come from the user via the submit_lookup_cmds() function. This addition could lead to an integer wrapping bug so use size_add() to prevent that.

Patchwork: https://patchwork.freedesktop.org/patch/624696/(CVE-2024-52559)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()

Extended the mi_enum_attr() function interface with an additional parameter, struct ntfs_inode *ni, to allow marking the inode as bad as soon as an error is detected.(CVE-2024-52560)

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat/qat_4xxx - fix off by one in uof_get_name()

The fw_objs[] array has "num_objs" elements so the > needs to be >= to prevent an out of bounds read.(CVE-2024-53162)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix use-after-free of signing key

Customers have reported use-after-free in @ses->auth_key.response with SMB2.1 + sign mounts which occurs due to following race:

task A task B cifs_mount() dfs_mount_share() get_session() cifs_mount_get_session() cifs_send_recv() cifs_get_smb_ses() compound_send_recv() cifs_setup_session() smb2_setup_request() kfree_sensitive() smb2_calc_signature() crypto_shash_setkey() UAF

Fix this by ensuring that we have a valid @ses->auth_key.response by checking whether @ses->ses_status is SES_GOOD or SES_EXITING with @ses->ses_lock held. After commit 24a9799aa8ef ("smb: client: fix UAF in smb2_reconnect_server()"), we made sure to call ->logoff() only when @ses was known to be good (e.g. valid ->auth_key.response), so it's safe to access signing key when @ses->ses_status == SES_EXITING.(CVE-2024-53179)

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: bsg: Set bsg_queue to NULL after removal

Currently, this does not cause any issues, but I believe it is necessary to set bsg_queue to NULL after removing it to prevent potential use-after-free (UAF) access.(CVE-2024-54458)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Play nice with protected guests in complete_hypercall_exit()

Use is_64_bit_hypercall() instead of is_64_bit_mode() to detect a 64-bit hypercall when completing said hypercall. For guests with protected state, e.g. SEV-ES and SEV-SNP, KVM must assume the hypercall was made in 64-bit mode as the vCPU state needed to detect 64-bit mode is unavailable.

Hacking the sev_smoke_test selftest to generate a KVM_HC_MAP_GPA_RANGE hypercall via VMGEXIT trips the WARN:

------------[ cut here ]------------ WARNING: CPU: 273 PID: 326626 at arch/x86/kvm/x86.h:180 complete_hypercall_exit+0x44/0xe0 [kvm] Modules linked in: kvm_amd kvm ... [last unloaded: kvm] CPU: 273 UID: 0 PID: 326626 Comm: sev_smoke_test Not tainted 6.12.0-smp--392e932fa0f3-feat…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative.

[ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7 [ 23.734418] shift exponent -1 is negative

Ensuring xlate_pos is a positive or zero before BIT.(CVE-2023-53034)

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to shrink read extent node in batches

We use rwlock to protect core structure data of extent tree during its shrink, however, if there is a huge number of extent nodes in extent tree, during shrink of extent tree, it may hold rwlock for a very long time, which may trigger kernel hang issue.

This patch fixes to shrink read extent node in batches, so that, critical region of the rwlock can be shrunk to avoid its extreme long time hold.(CVE-2024-41935)

In the Linux kernel, the following vulnerability has been resolved:

vrf: revert "vrf: Remove unnecessary RCU-bh critical section"

This reverts commit 504fc6f4f7f681d2a03aa5f68aad549d90eab853.

dev_queue_xmit_nit is expected to be called with BH disabled. __dev_queue_xmit has the following:

    /* Disable soft irqs for various locks below. Also
     * stops preemption for RCU.
     */
    rcu_read_lock_bh();

VRF must follow this invariant. The referenced commit removed this protection. Which triggered a lockdep warning:

================================
WARNING: inconsistent lock state
6.11.0 #1 Tainted: G        W
--------------------------------
inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
btserver/134819 [HC0[0]:SC0[0]:HE1:SE1] takes:
ffff8882da30c118 (rlock-AF_PACKET){+.?.}-{2:2}, at: tpacket_rcv+0x863/0x3b30
{IN-SOFTIRQ-W} state was registered at:
  lock_acquire+0x19a/0x4f0
  _raw_spin_lock+0x27/0x40
  packet_rcv+0xa33/0x1320
  __netif_receive_skb_core.constprop.0+0xcb0/0x3a90
  __netif_receive_skb_list_core+0x2c9/0x890
  netif_receive_skb_list_internal+0x610/0xcc0
      [...]

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(rlock-AF_PACKET);
  <Interrupt>
    lock(rlock-AF_PACKET);

 *** DEADLOCK ***

Call Trace:
 <TASK>
 dump_stack_lvl+0x73/0xa0
 mark_lock+0x102e/0x16b0
 __lock_acquire+0x9ae/0x6170
 lock_acquire+0x19a/0x4f0
 _raw_spin_lock+0x27/0x40
 tpacket_rcv+0x863/0x3b30
 dev_queue_xmit_nit+0x709/0xa40
 vrf_finish_direct+0x26e/0x340 [vrf]
 vrf_l3_out+0x5f4/0xe80 [vrf]
 __ip_local_out+0x51e/0x7a0
      [...](CVE-2024-49980)

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()

The "submit->cmd[i].size" and "submit->cmd[i].offset" variables are u32 values that come from the user via the submit_lookup_cmds() function. This addition could lead to an integer wrapping bug so use size_add() to prevent that.

Patchwork: https://patchwork.freedesktop.org/patch/624696/(CVE-2024-52559)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()

Extended the mi_enum_attr() function interface with an additional parameter, struct ntfs_inode *ni, to allow marking the inode as bad as soon as an error is detected.(CVE-2024-52560)

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat/qat_4xxx - fix off by one in uof_get_name()

The fw_objs[] array has "num_objs" elements so the > needs to be >= to…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix potential out of bound read in ext4_fc_replay_scan()

For scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain space less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read when mounting corrupt file system image. ADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this three tags will read data during scan, tag length couldn't less than data length which will read.(CVE-2022-50306)

A use-after-free vulnerability in the Linux kernel s netfilter: nf_tables component can be exploited to achieve local privilege escalation.Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it is possible to underflow the reference counter causing a use-after-free vulnerability.We recommend upgrading past commit 3e91b0ebd994635df2346353322ac51ce84ce6d8.(CVE-2023-4244)

In the Linux kernel, the following vulnerability has been resolved:

HID: multitouch: Correct devm device reference for hidinput input_dev name

Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequently fires a uevent that depends on the name. At the point of firing the uevent, the name would be freed by devres management.

Use devm_kasprintf to simplify the logic for allocating memory and formatting the input_dev name string.(CVE-2023-53454)

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix deletion race condition

System crash when using debug kernel due to link list corruption. The cause of the link list corruption is due to session deletion was allowed to queue up twice. Here's the internal trace that show the same port was allowed to double queue for deletion on different cpu.

20808683956 015 qla2xxx [0000:13:00.1]-e801:4: Scheduling sess ffff93ebf9306800 for deletion 50:06:0e:80:12:48:ff:50 fc4_type 1 20808683957 027 qla2xxx [0000:13:00.1]-e801:4: Scheduling sess ffff93ebf9306800 for deletion 50:06:0e:80:12:48:ff:50 fc4_type 1

Move the clearing/setting of deleted flag lock.(CVE-2023-53615)

In the Linux kernel, the following vulnerability has been resolved:

scsi: ses: Fix possible desc_ptr out-of-bounds accesses

Sanitize possible desc_ptr out-of-bounds accesses in ses_enclosure_data_process().(CVE-2023-53675)

In the Linux kernel, the following vulnerability has been resolved:

NFS: Fix a potential data corruption

We must ensure that the subrequests are joined back into the head before we can retransmit a request. If the head was not on the commit lists, because the server wrote it synchronously, we still need to add it back to the retransmission list. Add a call that mirrors the effect of nfs_cancel_remove_inode() for O_DIRECT.(CVE-2023-53711)

In the Linux kernel, the following vulnerability has been resolved: md: raid1: fix potential OOB in raid1_remove_disk(). If rddev->raid_disk is greater than mddev->raid_disks, there will be an out-of-bounds in raid1_remove_disk(). We have already found similar reports as follows: 1) commit d17f744e883b ("md-raid10: fix KASAN warning") 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk"). Fix this bug by checking whether the "number" variable is valid.(CVE-2023-53722)

In the Linux kernel, the following vulnerability has been resolved:posix-timers: Ensure timer ID search-loop limit is validposix_timer_add() tries to allocate a posix timer ID by starting from thecached ID which was stored by the last successful allocation.This is done in a loop searching the ID space for a free slot one byone. The loop has to terminate when the search wrapped around to thestarting point.But that s racy vs. establishing the…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix potential out of bound read in ext4_fc_replay_scan()

For scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain space less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read when mounting corrupt file system image. ADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this three tags will read data during scan, tag length couldn't less than data length which will read.(CVE-2022-50306)

In the Linux kernel, the following vulnerability has been resolved:posix-timers: Ensure timer ID search-loop limit is validposix_timer_add() tries to allocate a posix timer ID by starting from thecached ID which was stored by the last successful allocation.This is done in a loop searching the ID space for a free slot one byone. The loop has to terminate when the search wrapped around to thestarting point.But that s racy vs. establishing the starting point. That is read outlockless, which leads to the following problem:CPU0 CPU1posix_timer_add() start = sig->posix_timer_id; lock(hash_lock); ... posix_timer_add() if (++sig->posix_timer_id < 0) start = sig->posix_timer_id; sig->posix_timer_id = 0;So CPU1 can observe a negative start value, i.e. -1, and the loop breaknever happens because the condition can never be true: if (sig->posix_timer_id == start) break;While this is unlikely to ever turn into an endless loop as the ID space ishuge (INT_MAX), the racy read of the start value caught the attention ofKCSAN and Dmitry unearthed that incorrectness.Rewrite it so that all id operations are under the hash lock.(CVE-2023-53728)

In the Linux kernel, the following vulnerability has been resolved:posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()If get_clock_desc() succeeds, it calls fget() for the clockid s fd,and get the clk->rwsem read lock, so the error path should releasethe lock to make the lock balance and fput the clockid s fd to makethe refcount balance and release the fd related resource.However the below commit left the error path locked behind resulting inunbalanced locking. Check timespec64_valid_strict() beforeget_clock_desc() to fix it, because the ts is not changedafter that.[email protected]: fixed commit message typo

In the Linux kernel, the following vulnerability has been resolved:sunrpc: fix one UAF issue caused by sunrpc kernel tcp socketBUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0Read of size 1 at addr ffff888111f322cd by task swapper/0/0CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1Call Trace: <IRQ> dump_stack_lvl+0x68/0xa0 print_address_description.constprop.0+0x2c/0x3d0 print_report+0xb4/0x270 kasan_report+0xbd/0xf0 tcp_write_timer_handler+0x156/0x3e0 tcp_write_timer+0x66/0x170 call_timer_fn+0xfb/0x1d0 __run_timers+0x3f8/0x480 run_timer_softirq+0x9b/0x100 handle_softirqs+0x153/0x390 __irq_exit_rcu+0x103/0x120 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20RIP: 0010:default_idle+0xf/0x20Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 f8 25 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90RSP: 0018:ffffffffa2007e28 EFLAGS: 00000242RAX: 00000000000f3b31 RBX: 1ffffffff4400fc7 RCX: ffffffffa09c3196RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff9f00590fRBP: 0000000000000000 R08: 0000000000000001 R09: ffffed102360835dR10: ffff88811b041aeb R11: 0000000000000001 R12: 0000000000000000R13: ffffffffa202d7c0 R14: 0000000000000000 R15: 00000000000147d0 default_idle_call+0x6b/0xa0…

Root has patched CVE-2025-21772 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: partitions: mac: fix handling of bogus partition table Fix several issues in partition probing: - The bailout for a bad partoffset must use put_dev_sector(), since the preceding read_part_sector() succeeded. - If the partition table claims a silly sector size like 0xfff bytes (which results in partition table entries straddling sector boundaries), bail out instead of accessing out-of-bounds memory. - We must not assume that the partition table contains proper NUL termination - use strnlen() and strncmp() instead of strlen() and strcmp().

• sctp: sysctl: auth_enable: avoid using current->nsproxy
• sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy {CVE-2025-21640}
• bpf: Use preempt_count() directly in bpf_send_signal_common()
• Revert "sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy"
• jfs: fix slab-out-of-bounds read in ea_get()
• serial: 8250_dma: terminate correct DMA in tx_dma_flush()
• Revert "sctp: sysctl: auth_enable: avoid using current->nsproxy"
• net: usb: usbnet: restore usb%d name exception for local mac addresses
• vlan: fix memory leak in vlan_newlink() {CVE-2022-49636}
• rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity
• LTS tag: v5.4.291
• eeprom: digsy_mtc: Make GPIO lookup table match the device
• slimbus: messaging: Free transaction ID in delayed interrupt scenario {CVE-2025-21914}
• intel_th: pci: Add Panther Lake-P/U support
• intel_th: pci: Add Panther Lake-H support
• intel_th: pci: Add Arrow Lake support
• Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
• xhci: pci: Fix indentation in the PCI device ID definitions
• usb: gadget: Check bmAttributes only if configuration is valid
• usb: gadget: Fix setting self-powered state on suspend
• usb: gadget: Set self-powered based on MaxPower and bmAttributes
• usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality
• usb: typec: ucsi: increase timeout for PPM reset operations
• usb: atm: cxacru: fix a flaw in existing endpoint checks {CVE-2025-21916}
• usb: renesas_usbhs: Flush the notify_hotplug_work {CVE-2025-21917}
• usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader
• usb: renesas_usbhs: Use devm_usb_get_phy()
• usb: renesas_usbhs: Call clk_put()
• Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"
• gpio: rcar: Fix missing of_node_put() call
• net: ipv6: fix missing dst ref drop in ila lwtunnel
• net: ipv6: fix dst ref loop in ila lwtunnel
• net-timestamp: support TCP GSO case for a few missing flags
• vlan: enforce underlying device type {CVE-2025-21920}
• ppp: Fix KMSAN uninit-value warning with bpf {CVE-2025-21922}
• be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
• drm/sched: Fix preprocessor guard
• hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()
• llc: do not use skb_get() before dev_queue_xmit() {CVE-2025-21925}
• hwmon: (ad7314) Validate leading zero bits and return error
• hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
• hwmon: (pmbus) Initialise page count in pmbus_identify()
• caif_virtio: fix wrong pointer check in cfv_probe() {CVE-2025-21904}
• net: gso: fix ownership in __udp_gso_segment {CVE-2025-21926}
• HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
• HID: google: fix unused variable warning under !CONFIG_ACPI
• wifi: iwlwifi: limit printed string from FW file {CVE-2025-21905}
• mm/page_alloc: fix uninitialized variable
• rapidio: fix an API misues when rio_add_net() fails {CVE-2025-21934}
• rapidio: add check for rio_add_net() in rio_scan_alloc_net()
• wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
• wifi: cfg80211: regulatory: improve invalid hints checking {CVE-2025-21910}
• x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
• x86/cpu: Validate CPUID leaf 0x2 EDX output
• x86/cacheinfo: Validate CPUID leaf 0x2 EDX output
• platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
• drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
• ALSA: hda/realtek: update ALC222 depop optimize
• ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
• HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
• Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'"
• drm/amdgpu: disable BAR resize on Dell G5 SE
• drm/amdgpu: Check extended configuration space register when system uses large bar
• drm/amdgpu: skip BAR resizing if the bios already…

• CVE-url: https://ubuntu.com/security/CVE-2025-21811
  • nilfs2: protect access to buffers with no active references
• CVE-url: https://ubuntu.com/security/CVE-2025-21715
  • net: davicom: fix UAF in dm9000_drv_remove
• CVE-url: https://ubuntu.com/security/CVE-2024-58083
  • KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
• CVE-url: https://ubuntu.com/security/CVE-2024-57979
  • pps: Fix a use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2025-21898
  • ftrace: Avoid potential division by zero in function_stat_show()
• CVE-url: https://ubuntu.com/security/CVE-2025-21993
  • iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
• CVE-url: https://ubuntu.com/security/CVE-2025-21653
  • netlink: add attribute range validation to policy
  • net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
• CVE-url: https://ubuntu.com/security/CVE-2024-53148
  • comedi: Flush partial mappings in error case
• CVE-url: https://ubuntu.com/security/CVE-2022-49541
  • cifs: fix potential double free during failed mount
• CVE-url: https://ubuntu.com/security/CVE-2024-35937
  • wifi: cfg80211: check A-MSDU format more carefully
• CVE-url: https://ubuntu.com/security/CVE-2021-47211
  • ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
• CVE-url: https://ubuntu.com/security/CVE-2025-21772
  • partitions: mac: fix handling of bogus partition table
• CVE-url: https://ubuntu.com/security/CVE-2025-21753
  • btrfs: fix use-after-free when attempting to join an aborted transaction
• CVE-url: https://ubuntu.com/security/CVE-2025-21934
  • rapidio: fix an API misues when rio_add_net() fails

[ Ubuntu: 4.15.0-248.259 ]

• CVE-url: https://ubuntu.com/security/CVE-2025-21811
  • nilfs2: protect access to buffers with no active references
• CVE-url: https://ubuntu.com/security/CVE-2025-21715
  • net: davicom: fix UAF in dm9000_drv_remove
• CVE-url: https://ubuntu.com/security/CVE-2024-58083
  • KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
• CVE-url: https://ubuntu.com/security/CVE-2024-57979
  • pps: Fix a use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2025-21898
  • ftrace: Avoid potential division by zero in function_stat_show()
• CVE-url: https://ubuntu.com/security/CVE-2025-21993
  • iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
• CVE-url: https://ubuntu.com/security/CVE-2025-21653
  • netlink: add attribute range validation to policy
  • net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
• CVE-url: https://ubuntu.com/security/CVE-2024-53148
  • comedi: Flush partial mappings in error case
• CVE-url: https://ubuntu.com/security/CVE-2022-49541
  • cifs: fix potential double free during failed mount
• CVE-url: https://ubuntu.com/security/CVE-2024-35937
  • wifi: cfg80211: check A-MSDU format more carefully
• CVE-url: https://ubuntu.com/security/CVE-2021-47211
  • ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
• CVE-url: https://ubuntu.com/security/CVE-2025-21772
  • partitions: mac: fix handling of bogus partition table
• CVE-url: https://ubuntu.com/security/CVE-2025-21753
  • btrfs: fix use-after-free when attempting to join an aborted transaction
• CVE-url: https://ubuntu.com/security/CVE-2025-21934
  • rapidio: fix an API misues when rio_add_net() fails

• wifi: mwifiex: Fix OOB and integer underflow when rx packets {CVE-2023-53226} {CVE-2023-53226}
• wifi: mac80211: check S1G action frame size {CVE-2023-53257} {CVE-2023-53257}
• wifi: cfg80211: fix use-after-free in cmp_bss() {CVE-2025-39864} {CVE-2025-39864}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772} {CVE-2025-21772}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014} {CVE-2024-58014}
• wifi: at76c50x: fix use after free access in at76_disconnect {CVE-2025-37796} {CVE-2025-37796}
• dma-direct: Leak pages on dma_set_decrypted() failure {CVE-2024-35939} {CVE-2024-35939}
• Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386} {CVE-2022-50386}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817} {CVE-2025-39817}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937} {CVE-2024-35937}
• nfs: fix UAF in direct writes {CVE-2024-26958} {CVE-2024-26958}
• wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921} {CVE-2024-36921}
• net/smc: avoid data corruption caused by decline {CVE-2023-52775} {CVE-2023-52775}
• bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() {CVE-2024-39487} {CVE-2024-39487}
• scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978} {CVE-2024-40978}
• mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961} {CVE-2024-26961}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864} {CVE-2023-52864}
• net/sched: act_mirred: don't override retval if we already lost the skb {CVE-2024-26739} {CVE-2024-26739}
• drm/dp_mst: Fix resetting msg rx state after topology removal {CVE-2024-57876} {CVE-2024-57876}
• net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556} {CVE-2024-38556}
• of: Fix double free in of_parse_phandle_with_args_map {CVE-2023-52679} {CVE-2023-52679}
• xhci: Handle TD clearing for multiple streams case {CVE-2024-40927} {CVE-2024-40927}
• wifi: mac80211: fix potential key use-after-free {CVE-2023-52530} {CVE-2023-52530}
• net: openvswitch: Fix Use-After-Free in ovs_ct_exit {CVE-2024-27395} {CVE-2024-27395}
• r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586} {CVE-2024-38586}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764} {CVE-2023-52764}
• media: bttv: fix use after free error due to btv->timeout timer {CVE-2023-52847} {CVE-2023-52847}
• vsock: Fix transport_* TOCTOU {CVE-2025-38461} {CVE-2025-38461}
• ppdev: Add an error check in register_device {CVE-2024-36015} {CVE-2024-36015}
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556} {CVE-2025-38556}
• iio: adc: at91: call input_free_device() on allocated iio_dev {CVE-2024-57904} {CVE-2024-57904}
• perf/aux: Fix AUX buffer serialization {CVE-2024-46713} {CVE-2024-46713}
• net_sched: hfsc: Fix a UAF vulnerability in class handling {CVE-2025-37797} {CVE-2025-37797}
• wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072} {CVE-2024-58072}
• wifi: rtlwifi: remove unused dualmac control leftovers {CVE-2024-58072} {CVE-2024-58072}
• wifi: rtlwifi: remove unused timer and related code {CVE-2024-58072} {CVE-2024-58072}
• ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() {CVE-2025-22121} {CVE-2025-22121}
• ext4: move where set the MAY_INLINE_DATA flag is set {CVE-2025-22121} {CVE-2025-22121}
• ext4: introduce ITAIL helper {CVE-2025-22121} {CVE-2025-22121}
• ext4: improve xattr consistency checking and error reporting {CVE-2025-22121} {CVE-2025-22121}
• mm: fix zswap writeback race condition {CVE-2023-53178} {CVE-2023-53178}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-50367} {CVE-2022-50367}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757} {CVE-2025-39757}
• smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527} {CVE-2025-38527} -…

• media: bttv: fix use after free error due to btv->timeout timer {CVE-2023-52847} {CVE-2023-52847}
• firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails {CVE-2022-50087} {CVE-2022-50087}
• wifi: mwifiex: Fix OOB and integer underflow when rx packets {CVE-2023-53226} {CVE-2023-53226}
• vsock: Fix transport_* TOCTOU {CVE-2025-38461} {CVE-2025-38461}
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757} {CVE-2025-39757}
• locking/ww_mutex/test: Fix potential workqueue corruption {CVE-2023-52836} {CVE-2023-52836}
• media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621} {CVE-2024-38621}
• ath10k: skip ath10k_halt during suspend for driver state RESTARTING {CVE-2022-49519} {CVE-2022-49519}
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() {CVE-2022-48738} {CVE-2022-48738}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772} {CVE-2025-21772}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292} {CVE-2022-49292}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704} {CVE-2025-21704}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214} {CVE-2024-53214}
• ppdev: Add an error check in register_device {CVE-2024-36015} {CVE-2024-36015}
• scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675} {CVE-2023-53675}
• enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659} {CVE-2024-38659}
• dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929} {CVE-2024-57929}
• dlm: fix plock invalid read {CVE-2022-49407} {CVE-2022-49407}
• rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev {CVE-2022-48759} {CVE-2022-48759}
• bpf: Don't use tnum_range on array range checking for poke descriptors {CVE-2022-49985} {CVE-2022-49985}
• net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001} {CVE-2025-38001}
• wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes {CVE-2023-53185} {CVE-2023-53185}
• dm integrity: fix memory corruption when tag_size is less than digest size {CVE-2022-49044} {CVE-2022-49044}
• drm/radeon: possible buffer overflow {CVE-2023-52867} {CVE-2023-52867}
• ata: sata_dwc_460ex: Fix crash due to OOB write {CVE-2022-49073} {CVE-2022-49073}
• fs/jfs: Add validity check for db_maxag and db_agpref {CVE-2023-52804} {CVE-2023-52804}
• net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581} {CVE-2023-53581}
• thermal: core: prevent potential string overflow {CVE-2023-52868} {CVE-2023-52868}
• ACPI: CPPC: Avoid out of bounds access when parsing _CPC data {CVE-2022-49145} {CVE-2022-49145}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817} {CVE-2025-39817}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332} {CVE-2024-52332}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498} {CVE-2025-38498}
• drm/amd/display: Skip finding free audio for unknown engine_id {CVE-2024-42119} {CVE-2024-42119}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408} {CVE-2022-50408}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014} {CVE-2024-58014}
• wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229} {CVE-2023-53229}
• ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570} {CVE-2024-56570}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125} {CVE-2023-53125}
• net: stmmac: fix dma queue left shift overflow issue {CVE-2022-49592} {CVE-2022-49592}
• iio: adc: at91: call input_free_device() on allocated iio_dev {CVE-2024-57904} {CVE-2024-57904}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373} {CVE-2023-53373}
• sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718} {CVE-2025-38718}
• KVM: SVM: Don't BUG if userspace…

• media: bttv: fix use after free error due to btv->timeout timer {CVE-2023-52847}
• firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails {CVE-2022-50087}
• wifi: mwifiex: Fix OOB and integer underflow when rx packets {CVE-2023-53226}
• vsock: Fix transport_* TOCTOU {CVE-2025-38461}
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
• perf/aux: Fix AUX buffer serialization {CVE-2024-46713}
• locking/ww_mutex/test: Fix potential workqueue corruption {CVE-2023-52836}
• media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621}
• ath10k: skip ath10k_halt during suspend for driver state RESTARTING {CVE-2022-49519}
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() {CVE-2022-48738}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
• ppdev: Add an error check in register_device {CVE-2024-36015}
• scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
• enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659}
• dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929}
• dlm: fix plock invalid read {CVE-2022-49407}
• rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev {CVE-2022-48759}
• bpf: Don't use tnum_range on array range checking for poke descriptors {CVE-2022-49985}
• net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001}
• wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes {CVE-2023-53185}
• dm integrity: fix memory corruption when tag_size is less than digest size {CVE-2022-49044}
• drm/radeon: possible buffer overflow {CVE-2023-52867}
• ata: sata_dwc_460ex: Fix crash due to OOB write {CVE-2022-49073}
• fs/jfs: Add validity check for db_maxag and db_agpref {CVE-2023-52804}
• net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581}
• thermal: core: prevent potential string overflow {CVE-2023-52868}
• ACPI: CPPC: Avoid out of bounds access when parsing _CPC data {CVE-2022-49145}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
• drm/amd/display: Skip finding free audio for unknown engine_id {CVE-2024-42119}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229}
• ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
• net: stmmac: fix dma queue left shift overflow issue {CVE-2022-49592}
• iio: adc: at91: call input_free_device() on allocated iio_dev {CVE-2024-57904}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
• sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
• KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 {CVE-2022-50228}
• soundwire: cadence: fix invalid PDI offset {CVE-2024-38635}
• wifi: at76c50x: fix use after free access in at76_disconnect {CVE-2025-37796}
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans {CVE-2023-53034}
• Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297}
• scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
• smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527}
• NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730}
• scsi:…

• Focal update: v5.4.291 upstream stable release (LP: #2106002) // CVE-2025-21772
  • partitions: mac: fix handling of bogus partition table
• CVE-url: https://ubuntu.com/security/CVE-2025-22079
  • ocfs2: validate l_tree_depth to avoid out-of-bounds access
• CVE-url: https://ubuntu.com/security/CVE-2024-58014
  • wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
• CVE-url: https://ubuntu.com/security/CVE-2024-41042
  • netfilter: nf_tables: prefer nft_chain_validate
• CVE-url: https://ubuntu.com/security/CVE-2024-46713
  • perf/aux: Fix AUX buffer serialization
• CVE-url: https://ubuntu.com/security/CVE-2025-38352
  • posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
• CVE-url: https://ubuntu.com/security/CVE-2025-38477
  • net/sched: sch_qfq: Fix race condition on qfq_aggregate
• Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52804
  • fs/jfs: Add check for negative db_l2nbperpage
  • fs/jfs: Add validity check for db_maxag and db_agpref
• Focal update: v5.4.251 upstream stable release (LP: #2034918) // CVE-url: https://ubuntu.com/security/CVE-2023-52804
  • jfs: jfs_dmap: Validate db_l2nbperpage while mounting
• Bionic update: upstream stable patchset 2023-02-06 (LP: #2006403) // CVE- url: https://ubuntu.com/security/CVE-2023-52804
  • fs: jfs: fix shift-out-of-bounds in dbAllocAG
• CVE-url: https://ubuntu.com/security/CVE-2022-25265
  • x86/elf: Add table to document READ_IMPLIES_EXEC
  • x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK
  • x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit
• Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740) // CVE- url: https://ubuntu.com/security/CVE-2021-47153
  • i2c: i801: Don't generate an interrupt on bus reset
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48757
  • net: fix information leakage in /proc/net/ptype
• Focal update: v5.4.279 upstream stable release (LP: #2073621) // CVE-url: https://ubuntu.com/security/CVE-2024-37078
  • nilfs2: fix potential kernel bug due to lack of writeback flag waiting
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48760
  • USB: core: Fix hang in usb_kill_urb by adding memory barriers
• Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE- url: https://ubuntu.com/security/CVE-2021-47383
  • tty: Fix out-of-bound vmalloc access in imageblit
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE- url: https://ubuntu.com/security/CVE-2022-49145
  • ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
• Bionic update: upstream stable patchset 2021-11-23 (LP: #1951997) // CVE- url: https://ubuntu.com/security/CVE-2021-47458
  • ocfs2: mount fails with buffer overflow in strlen
• CVE-url: https://ubuntu.com/security/CVE-2022-49170
  • f2fs: fix to do sanity check on curseg->alloc_type
• CVE-url: https://ubuntu.com/security/CVE-2021-47479
  • staging: rtl8712: fix use-after-free in rtl8712_dl_fw
• Bionic update: upstream stable patchset 2021-12-03 (LP: #1953202) // CVE- url: https://ubuntu.com/security/CVE-2021-47477
  • comedi: dt9812: fix DMA buffers on stack
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE- url: https://ubuntu.com/security/CVE-2021-47642
  • video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
• Bionic update: upstream stable patchset 2022-01-06 (LP: #1956614) // CVE- url: https://ubuntu.com/security/CVE-2021-47565
  • scsi: mpt3sas: Fix kernel panic during drive powercycle test
• Bionic update: upstream stable patchset 2022-01-06…

• perf/aux: Fix AUX buffer serialization {CVE-2024-46713}
• block: fix uaf for flush rq while iterating tags {CVE-2024-53170}
• zram: fix potential UAF of zram table {CVE-2025-21671}
• sched: sch_cake: add bounds checks to host bulk flow fairness counts {CVE-2025-21647}
• bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors {CVE-2024-56675}
• net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• sctp: detect and prevent references to a freed transport in sendmsg {CVE-2025-23142}
• ipv6: sr: Fix MAC comparison to be constant-time {CVE-2025-39702}
• RDMA/rxe: Fix incomplete state save in rxe_requester {CVE-2023-53539}
• crypto: xts - Handle EBUSY correctly {CVE-2023-53494}
• Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync {CVE-2023-53252}
• af_unix: Fix data-races around user->unix_inflight. {CVE-2023-53204}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-50367}
• wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072}
• wifi: rtlwifi: remove unused dualmac control leftovers
• wifi: rtlwifi: remove unused timer and related code
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• ipmr: do not call mr_mfc_uses_dev() for unres entries {CVE-2025-21719}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• net: mdio: validate parameter addr in mdiobus_get_phy() {CVE-2023-53019}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
• NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730}
• net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581}
• null_blk: Always check queue mode setting from configfs {CVE-2023-53576}
• ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559}
• rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic() {CVE-2023-53558}
• pstore/ram: Check start of empty przs during init {CVE-2023-53331}
• wifi: ath11k: fix memory leak in WMI firmware stats {CVE-2023-53602}
• wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229}
• net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() {CVE-2022-50486}
• RDMA/core: Make sure "ib_port" is valid when access sysfs node {CVE-2022-50475}
• RDMA/rxe: Fix mr->map double free {CVE-2022-50543}
• scsi: qla2xxx: Fix end of loop test
• scsi: qla2xxx: Fix mem access after free
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• scsi: target: Fix multiple LUN_RESET handling {CVE-2023-53586}
• scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
• scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses {CVE-2023-53675}
• scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() {CVE-2023-53675}
• scsi: lpfc: Fix buffer free/clear order in deferred receive path {CVE-2025-39841}
• nbd: fix incomplete validation of ioctl arg {CVE-2023-53513}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
• bnxt: avoid overflow in bnxt_get_nvram_directory() {CVE-2023-53661}

• scsi: target: iscsi: Fix timeout on deleted connection {CVE-2025-38075}
• tls: wait for pending async decryptions if tls_strp_msg_hold fails {CVE-2025-40176}
• clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns {CVE-2025-38499}
• rcu: Fix rcu_read_unlock() deadloop due to IRQ work {CVE-2025-39744}
• page_pool: Fix use-after-free in page_pool_recycle_in_ring {CVE-2025-38129}
• rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access {CVE-2025-38704}
• bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors {CVE-2024-56675}
• padata: Fix pd UAF once and for all {CVE-2025-38584}
• padata: do not leak refcount in reorder_work {CVE-2025-38031}
• Bluetooth: MGMT: Fix possible UAFs {CVE-2025-39981}
• Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• Bluetooth: MGMT: Remove unused mgmt_pending_find_data
• Bluetooth: MGMT: set_mesh: update LE scan interval and window
• Bluetooth: hci_sync: fix set_local_name race condition {CVE-2025-39797}
• xfrm: Duplicate SPI Handling {CVE-2025-39797}
• kernfs: Fix UAF in polling when open file is released {CVE-2025-39881}
• OPP: add index check to assert to avoid buffer overflow in _read_freq() {CVE-2024-57998}
• block: fix uaf for flush rq while iterating tags {CVE-2024-58072} {CVE-2024-53170}
• wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() {CVE-2025-21631}
• net: af_can: do not leave a dangling sk pointer in can_create() {CVE-2024-40954}
• Squashfs: sanity check symbolic link size {CVE-2024-46744}
• e1000e: fix heap overflow in e1000_set_eeprom {CVE-2025-39898}
• wifi: cfg80211: fix use-after-free in cmp_bss() {CVE-2025-39864}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• i40e: fix idx validation in config queues msg {CVE-2025-39971}
• NFS: Fix a race when updating an existing write {CVE-2025-39697}
• tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-39955}
• wifi: mt76: fix linked list corruption {CVE-2025-39918}
• io_uring/waitid: always prune wait queue entry in io_waitid_wait() {CVE-2025-40047}
• Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync {CVE-2025-39982}
• workqueue: Put the pwq after detaching the rescuer from the pool {CVE-2025-21786}
• zram: fix potential UAF of zram table {CVE-2025-21671}
• sched: sch_cake: add bounds checks to host bulk flow fairness counts {CVE-2025-21647}
• wifi: mt76: mt7925: fix off by one in mt7925_load_clc() {CVE-2024-57990}
• blk-cgroup: Fix UAF in blkcg_unpin_online() {CVE-2024-56672}
• NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() {CVE-2024-54456}
• nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• x86/tdx: Fix "in-kernel MMIO" check {CVE-2024-47727}
• drm/amd/display: Check dce_hwseq before dereferencing it {CVE-2025-38361}
• dm-bufio: don't schedule in atomic context {CVE-2025-37928}
• usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
• KVM: arm64: Tear down vGIC on failed vCPU creation {CVE-2025-37849}
• usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
• drm/amd/display: Fix out-of-bound accesses {CVE-2025-21985}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• pfifo_tail_enqueue: Drop new packet when sch->limit == 0 {CVE-2025-21702}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• ipmr: do not call mr_mfc_uses_dev() for unres entries {CVE-2025-21719}
• net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• sctp: detect and prevent references to a freed transport in sendmsg {CVE-2025-23142}
• iommu/amd: Fix…

• Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
• firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
• wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• spec: merge oraclelinux6els changes
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918}
• ipvs: use explicitly signed chars
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-48900}
• netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• mtd: inftlcore: Add error check for inftl_read_oob() {CVE-2025-37892}
• igb: Do not free q_vector unless new one was allocated {CVE-2022-50252}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• md-raid10: fix KASAN warning {CVE-2022-50211}
• usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}

• Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
• firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
• wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• spec: merge oraclelinux6els changes
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918}
• ipvs: use explicitly signed chars
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-48900}
• netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• mtd: inftlcore: Add error check for inftl_read_oob() {CVE-2025-37892}
• igb: Do not free q_vector unless new one was allocated {CVE-2022-50252}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• md-raid10: fix KASAN warning {CVE-2022-50211}
• usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}

• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
• drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
• Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
• net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2022-50410}
• i40e: add validation for ring_len param {CVE-2025-39973}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}

• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
• drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
• Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
• net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2022-50410}
• i40e: add validation for ring_len param {CVE-2025-39973}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}

• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
• drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
• Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
• net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2022-50410}
• i40e: add validation for ring_len param {CVE-2025-39973}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47659: drm/plane: Move range check for format_count earlier (bsc#1237839).
• CVE-2022-49044: dm integrity: fix memory corruption when tag_size is less than digest size (bsc#1237840).
• CVE-2022-49055: drm/amdkfd: Check for potential null return of kmalloc_array() (bsc#1237868).
• CVE-2022-49060: net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() (bsc#1237845).
• CVE-2022-49086: net: openvswitch: fix leak of nested actions (bsc#1238037).
• CVE-2022-49111: Bluetooth: Fix use after free in hci_send_acl (bsc#1237984).
• CVE-2022-49118: scsi: hisi_sas: Free irq vectors in order for v3 HW (bsc#1237979).
• CVE-2022-49121: scsi: pm8001: Fix tag leaks on error (bsc#1237926).
• CVE-2022-49137: drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj (bsc#1238155).
• CVE-2022-49175: PM: core: keep irq flags in device_pm_check_callbacks() (bsc#1238099).
• CVE-2022-49176: bfq: fix use-after-free in bfq_dispatch_request (bsc#1238097).
• CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1238092).
• CVE-2022-49188: remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region (bsc#1238138).
• CVE-2022-49197: af_netlink: Fix shift out of bounds in group mask calculation (bsc#1238455).
• CVE-2022-49205: bpf, sockmap: Fix double uncharge the mem of sk_msg (bsc#1238335).
• CVE-2022-49232: drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() (bsc#1238139).
• CVE-2022-49290: mac80211: fix potential double free on mesh join (bsc#1238156).
• CVE-2022-49305: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() (bsc#1238645).
• CVE-2022-49325: tcp: add accessors to read/set tp->snd_cwnd (bsc#1238398).
• CVE-2022-49335: drm/amdgpu/cs: make commands with 0 chunks illegal behaviour (bsc#1238377).
• CVE-2022-49351: net: altera: Fix refcount leak in altera_tse_mdio_create (bsc#1237939).
• CVE-2022-49385: driver: base: fix UAF when driver_attach failed (bsc#1237951).
• CVE-2022-49390: macsec: fix UAF bug for real_dev (bsc#1238233).
• CVE-2022-49411: bfq: Make sure bfqg for which we are queueing requests is online (bsc#1238307).
• CVE-2022-49442: drivers/base/node.c: fix compaction sysfs file leak (bsc#1238243).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49478: media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init (bsc#1238000).
• CVE-2022-49489: drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume (bsc#1238244).
• CVE-2022-49504: scsi: lpfc: Inhibit aborts if external loopback plug is inserted (bsc#1238835).
• CVE-2022-49521: scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() (bsc#1238938).
• CVE-2022-49525: media: cx25821: Fix the warning when removing the module (bsc#1238022).
• CVE-2022-49534: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT (bsc#1238893).
• CVE-2022-49535: scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI (bsc#1238937).
• CVE-2022-49536: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock (bsc#1238838).
• CVE-2022-49537: scsi: lpfc: Fix call trace observed during I/O with CMF enabled (bsc#1238930).
• CVE-2022-49542: scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() (bsc#1238722).
• CVE-2022-49561: netfilter: conntrack: re-fetch conntrack after insertion (bsc#1238537).
• CVE-2022-49590: igmp: Fix data-races around sysctl_igmp_llm_reports (bsc#1238844).
• CVE-2022-49658: bpf, selftests: Add verifier test case for imm=0,umin=0,umax=1 scalar (bsc#1238803).
• CVE-2022-49668: PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events (bsc#1237957).
• CVE-2022-49693: drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf (bsc#1237954).
• CVE-2022-49725: i40e: Fix call trace in setup_tx_descriptors…

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-43869: perf: Fix hang while freeing sigtrap event (bsc#1229491).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
• CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
• CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
• CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
• CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
• CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
• CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
• CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086). -…

The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49570: drm/xe/tracing: Fix a potential TP_printk UAF (bsc#1238782).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
• CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
• CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
• CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
• CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
• CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
• CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
• CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2024-58074: drm/i915: Grab intel_display from the encoder to avoid potential (bsc#1238972).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510). -…

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49570: drm/xe/tracing: Fix a potential TP_printk UAF (bsc#1238782).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
• CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
• CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
• CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
• CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
• CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
• CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
• CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2024-58074: drm/i915: Grab intel_display from the encoder to avoid potential (bsc#1238972).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510). -…

This update for the Linux Kernel 6.4.0-150600_10_26 fixes several issues.

The following security issues were fixed:

• CVE-2025-22115: btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (bsc#1241579).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).

This update for the Linux Kernel 6.4.0-150600_10_20 fixes several issues.

The following security issues were fixed:

• CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234854).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
• CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages (bsc#1235921).
• CVE-2025-22115: btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (bsc#1241579).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).
• CVE-2024-53166: block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234885).
• CVE-2024-57793: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (bsc#1235769).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1243648).

This update for the Linux Kernel 6.4.0-150600_10_5 fixes several issues.

The following security issues were fixed:

• CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234854).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
• CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages (bsc#1235921).
• CVE-2024-50250: fsdax: dax_unshare_iter needs to copy entire blocks (bsc#1233227).
• CVE-2025-22115: btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (bsc#1241579).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).
• CVE-2024-53166: block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234885).
• CVE-2024-57793: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (bsc#1235769).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233118).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1243648).

This update for the Linux Kernel 6.4.0-150600_10_11 fixes several issues.

The following security issues were fixed:

• CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234854).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
• CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages (bsc#1235921).
• CVE-2024-50250: fsdax: dax_unshare_iter needs to copy entire blocks (bsc#1233227).
• CVE-2025-22115: btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (bsc#1241579).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).
• CVE-2024-53166: block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234885).
• CVE-2024-57793: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (bsc#1235769).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233118).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1243648).

This update for the Linux Kernel 6.4.0-150600_8 fixes several issues.

The following security issues were fixed:

• CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234854).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
• CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages (bsc#1235921).
• CVE-2024-50250: fsdax: dax_unshare_iter needs to copy entire blocks (bsc#1233227).
• CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
• CVE-2025-22115: btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (bsc#1241579).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).
• CVE-2024-53166: block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234885).
• CVE-2024-57793: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (bsc#1235769).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233118).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1243648).

This update for the Linux Kernel 4.12.14-122_222 fixes several issues.

The following security issues were fixed:

• CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234854).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238920).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
• CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages (bsc#1235921).
• CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).

This update for the Linux Kernel 4.12.14-122_225 fixes several issues.

The following security issues were fixed:

• CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234854).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238920).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
• CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages (bsc#1235921).
• CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).

This update for the Linux Kernel 5.14.21-150500_55_94 fixes one issue.

The following security issue was fixed:

• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).

This update for the Linux Kernel 4.12.14-122_247 fixes several issues.

The following security issues were fixed:

• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238920).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).

This update for the Linux Kernel 4.12.14-122_231 fixes several issues.

The following security issues were fixed:

• CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234854).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238920).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
• CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages (bsc#1235921).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).

This update for the Linux Kernel 5.3.18-150300_59_167 fixes several issues.

The following security issues were fixed:

• CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234854).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238920).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
• CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages (bsc#1235921).
• CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233118).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1243648).

This update for the Linux Kernel 5.3.18-150300_59_188 fixes several issues.

The following security issues were fixed:

• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238920).
• CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages (bsc#1235921).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1243648).

This update for the Linux Kernel 5.14.21-150400_24_136 fixes several issues.

The following security issues were fixed:

• CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234854).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238920).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
• CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages (bsc#1235921).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).
• CVE-2024-53166: block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234885).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233118).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1243648).

This update for the Linux Kernel 5.14.21-150400_24_141 fixes several issues.

The following security issues were fixed:

• CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234854).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238920).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
• CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages (bsc#1235921).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).
• CVE-2024-53166: block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234885).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1243648).

This update for the Linux Kernel 4.12.14-122_244 fixes several issues.

The following security issues were fixed:

• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238920).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).

This update for the Linux Kernel 5.14.21-150500_55_68 fixes several issues.

The following security issues were fixed:

• CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234854).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
• CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages (bsc#1235921).
• CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).
• CVE-2024-53166: block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234885).
• CVE-2024-57793: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (bsc#1235769).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233118).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1243648).

This update for the Linux Kernel 6.4.0-150600_10_29 fixes several issues.

The following security issues were fixed:

• CVE-2025-22115: btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (bsc#1241579).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).

This update for the Linux Kernel 5.14.21-150500_55_88 fixes several issues.

The following security issues were fixed:

• CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234854).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
• CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages (bsc#1235921).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).
• CVE-2024-53166: block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234885).
• CVE-2024-57793: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (bsc#1235769).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1243648).

This update for the Linux Kernel 6.4.0-150600_10_14 fixes several issues.

The following security issues were fixed:

• CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234854).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
• CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages (bsc#1235921).
• CVE-2024-50250: fsdax: dax_unshare_iter needs to copy entire blocks (bsc#1233227).
• CVE-2025-22115: btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (bsc#1241579).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).
• CVE-2024-53166: block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234885).
• CVE-2024-57793: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (bsc#1235769).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233118).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1243648).

This update for the Linux Kernel 6.4.0-150600_10_17 fixes several issues.

The following security issues were fixed:

• CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234854).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
• CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages (bsc#1235921).
• CVE-2024-50250: fsdax: dax_unshare_iter needs to copy entire blocks (bsc#1233227).
• CVE-2025-22115: btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (bsc#1241579).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).
• CVE-2024-53166: block, bfq: fix bfqq uaf in bfq_limit_depth() (bsc#1234885).
• CVE-2024-57793: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (bsc#1235769).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1243648).