CVE-2025-21931

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MMWe currently assume that there is at least one VMA in a MM, which isn ttrue.So we might end up having find_vma() return NULL, to then de-referenceNULL. So properly handle find_vma() returning NULL.This fixes the report:Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTIKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]CPU: 1 UID: 0 PID: 6021 Comm: syz-executor284 Not tainted 6.12.0-rc7-syzkaller-00187-gf868cd251776 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024RIP: 0010:migrate_to_node mm/mempolicy.c:1090 [inline]RIP: 0010:do_migrate_pages+0x403/0x6f0 mm/mempolicy.c:1194Code: ...RSP: 0018:ffffc9000375fd08 EFLAGS: 00010246RAX: 0000000000000000 RBX: ffffc9000375fd78 RCX: 0000000000000000RDX: ffff88807e171300 RSI: dffffc0000000000 RDI: ffff88803390c044RBP: ffff88807e171428 R08: 0000000000000014 R09: fffffbfff2039ef1R10: ffffffff901cf78f R11: 0000000000000000 R12: 0000000000000003R13: ffffc9000375fe90 R14: ffffc9000375fe98 R15: ffffc9000375fdf8FS: 00005555919e1380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00005555919e1ca8 CR3: 000000007f12a000 CR4: 00000000003526f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: <TASK> kernel_migrate_pages+0x5b2/0x750 mm/mempolicy.c:1709 __do_sys_migrate_pages mm/mempolicy.c:1727 [inline] __se_sys_migrate_pages mm/mempolicy.c:1723 [inline] __x64_sys_migrate_pages+0x96/0x100 mm/mempolicy.c:1723 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/[email protected]: add unlikely()

In the Linux kernel, the following vulnerability has been resolved:

PCI/MSI: Handle lack of irqdomain gracefully

Alexandre observed a warning emitted from pci_msi_setup_msi_irqs() on a RISCV platform which does not provide PCI/MSI support:

WARNING: CPU: 1 PID: 1 at drivers/pci/msi/msi.h:121 pci_msi_setup_msi_irqs+0x2c/0x32 __pci_enable_msix_range+0x30c/0x596 pci_msi_setup_msi_irqs+0x2c/0x32 pci_alloc_irq_vectors_affinity+0xb8/0xe2

RISCV uses hierarchical interrupt domains and correctly does not implement the legacy fallback. The warning triggers from the legacy fallback stub.

That warning is bogus as the PCI/MSI layer knows whether a PCI/MSI parent domain is associated with the device or not. There is a check for MSI-X, which has a legacy assumption. But that legacy fallback assumption is only valid when legacy support is enabled, but otherwise the check should simply return -ENOTSUPP.

Loongarch tripped over the same problem and blindly enabled legacy support without implementing the legacy fallbacks. There are weak implementations which return an error, so the problem was papered over.

Correct pci_msi_domain_supports() to evaluate the legacy mode and add the missing supported check into the MSI enable path to complete it.(CVE-2024-56760)

In the Linux kernel, the following vulnerability has been resolved:

NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback

Add PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so nfs_release_folio() can skip calling nfs_wb_folio() from kcompactd.

Otherwise NFS can deadlock waiting for kcompactd enduced writeback which recurses back to NFS (which triggers writeback to NFSD via NFS loopback mount on the same host, NFSD blocks waiting for XFS's call to __filemap_get_folio):

6070.550357] INFO: task kcompactd0:58 blocked for more than 4435 seconds.

{--- [58] "kcompactd0" [<0>]…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MMWe currently assume that there is at least one VMA in a MM, which isn ttrue.So we might end up having find_vma() return NULL, to then de-referenceNULL. So properly handle find_vma() returning NULL.This fixes the report:Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTIKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]CPU: 1 UID: 0 PID: 6021 Comm: syz-executor284 Not tainted 6.12.0-rc7-syzkaller-00187-gf868cd251776 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024RIP: 0010:migrate_to_node mm/mempolicy.c:1090 [inline]RIP: 0010:do_migrate_pages+0x403/0x6f0 mm/mempolicy.c:1194Code: ...RSP: 0018:ffffc9000375fd08 EFLAGS: 00010246RAX: 0000000000000000 RBX: ffffc9000375fd78 RCX: 0000000000000000RDX: ffff88807e171300 RSI: dffffc0000000000 RDI: ffff88803390c044RBP: ffff88807e171428 R08: 0000000000000014 R09: fffffbfff2039ef1R10: ffffffff901cf78f R11: 0000000000000000 R12: 0000000000000003R13: ffffc9000375fe90 R14: ffffc9000375fe98 R15: ffffc9000375fdf8FS: 00005555919e1380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00005555919e1ca8 CR3: 000000007f12a000 CR4: 00000000003526f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: <TASK> kernel_migrate_pages+0x5b2/0x750 mm/mempolicy.c:1709 __do_sys_migrate_pages mm/mempolicy.c:1727 [inline] __se_sys_migrate_pages mm/mempolicy.c:1723 [inline] __x64_sys_migrate_pages+0x96/0x100 mm/mempolicy.c:1723 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/[email protected]: add unlikely()

In the Linux kernel, the following vulnerability has been resolved:

PCI/MSI: Handle lack of irqdomain gracefully

Alexandre observed a warning emitted from pci_msi_setup_msi_irqs() on a RISCV platform which does not provide PCI/MSI support:

WARNING: CPU: 1 PID: 1 at drivers/pci/msi/msi.h:121 pci_msi_setup_msi_irqs+0x2c/0x32 __pci_enable_msix_range+0x30c/0x596 pci_msi_setup_msi_irqs+0x2c/0x32 pci_alloc_irq_vectors_affinity+0xb8/0xe2

RISCV uses hierarchical interrupt domains and correctly does not implement the legacy fallback. The warning triggers from the legacy fallback stub.

That warning is bogus as the PCI/MSI layer knows whether a PCI/MSI parent domain is associated with the device or not. There is a check for MSI-X, which has a legacy assumption. But that legacy fallback assumption is only valid when legacy support is enabled, but otherwise the check should simply return -ENOTSUPP.

Loongarch tripped over the same problem and blindly enabled legacy support without implementing the legacy fallbacks. There are weak implementations which return an error, so the problem was papered over.

Correct pci_msi_domain_supports() to evaluate the legacy mode and add the missing supported check into the MSI enable path to complete it.(CVE-2024-56760)

In the Linux kernel, the following vulnerability has been resolved:

NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback

Add PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so nfs_release_folio() can skip calling nfs_wb_folio() from kcompactd.

Otherwise NFS can deadlock waiting for kcompactd enduced writeback which recurses back to NFS (which triggers writeback to NFSD via NFS loopback mount on the same host, NFSD blocks waiting for XFS's call to __filemap_get_folio):

6070.550357] INFO: task kcompactd0:58 blocked for more than 4435 seconds.

{--- [58] "kcompactd0" [<0>]…

Root has patched CVE-2025-21931 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2025-21931 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-21931 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2025-21931 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio Commit b15c87263a69 ("hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined) add page poison checks in do_migrate_range in order to make offline hwpoisoned page possible by introducing isolate_lru_page and try_to_unmap for hwpoisoned page. However folio lock must be held before calling try_to_unmap. Add it to fix this problem. Warning will be produced if folio is not locked during unmap: ------------[ cut here ]------------ kernel BUG at ./include/linux/swapops.h:400! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 4 UID: 0 PID: 411 Comm: bash Tainted: G W 6.13.0-rc1-00016-g3c434c7ee82a-dirty #41 Tainted: [W]=WARN Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : try_to_unmap_one+0xb08/0xd3c lr : try_to_unmap_one+0x3dc/0xd3c Call trace: try_to_unmap_one+0xb08/0xd3c (P) try_to_unmap_one+0x3dc/0xd3c (L) rmap_walk_anon+0xdc/0x1f8 rmap_walk+0x3c/0x58 try_to_unmap+0x88/0x90 unmap_poisoned_folio+0x30/0xa8 do_migrate_range+0x4a0/0x568 offline_pages+0x5a4/0x670 memory_block_action+0x17c/0x374 memory_subsys_offline+0x3c/0x78 device_offline+0xa4/0xd0 state_store+0x8c/0xf0 dev_attr_store+0x18/0x2c sysfs_kf_write+0x44/0x54 kernfs_fop_write_iter+0x118/0x1a8 vfs_write+0x3a8/0x4bc ksys_write+0x6c/0xf8 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x44/0x100 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x30/0xd0 el0t_64_sync_handler+0xc8/0xcc el0t_64_sync+0x198/0x19c Code: f9407be0 b5fff320 d4210000 17ffff97 (d4210000) ---[ end trace 0000000000000000 ]---

• gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully {CVE-2022-48660}
• ipv4: check for NULL idev in ip_route_use_hint() {CVE-2024-36008}
• KEYS: trusted: Do not use WARN when encode fails {CVE-2024-36975}
• Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027}
• xhci: Fix null pointer dereference when host dies {CVE-2023-52898}
• sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
• blk-mq: fix IO hang from sbitmap wakeup race {CVE-2024-26671}
• net: openvswitch: fix flow memory leak in ovs_flow_cmd_new {CVE-2023-52977}
• gpiolib: fix memory leak in gpiochip_setup_dev() {CVE-2022-48975}
• HID: betop: check shape of output reports {CVE-2023-53015}
• mm/swapfile: add cond_resched() in get_swap_pages() {CVE-2023-52932}
• HV: hv_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-52937}
• drm/i915: Fix a memory leak with reused mmap_offset {CVE-2023-53002}
• ptdma: pt_core_execute_cmd() should use spinlock {CVE-2023-53013}
• RDMA/core: Fix ib block iterator counter overflow {CVE-2023-53026}
• Bluetooth: hci_conn: Fix memory leaks {CVE-2023-53018}
• scsi: target: pscsi: Fix bio_put() for error case {CVE-2024-26760}
• sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}
• pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
• cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}
• ALSA: hda/cs8409: Fix possible NULL dereference {CVE-2024-50160}
• nbd: don't allow reconnect after disconnect {CVE-2025-21731}
• openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
• ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
• ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}
• net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
• wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
• ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
• ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping {CVE-2025-40121}
• i40e: Fix macvlan leak by synchronizing access to mac_filter_hash {CVE-2024-50041}
• net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() {CVE-2024-50000}
• bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}
• xsk: check IFF_UP earlier in Tx path {CVE-2023-53240}
• firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
• virtgpu: don't reset on shutdown {CVE-2025-38064}
• xen/netfront: fix crash when removing device {CVE-2022-48969}
• mptcp: do not fallback when OoO is present {CVE-2024-50185}
• can: j1939: add missing calls in NETDEV_UNREGISTER notification handler {CVE-2025-39925}
• netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160}
• xfs: fix use-after-free in xattr node block inactivation {CVE-2026-43053}
• ext4: fix racy may inline data check in dio write {CVE-2023-52786}
• drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini {CVE-2023-52738}
• macsec: fix UAF bug for real_dev {CVE-2022-49390}
• drm/i915/gem: Fix Virtual Memory mapping boundaries calculation {CVE-2024-42259}
• mm/shmem: disable PMD-sized page cache if needed {CVE-2024-42241}
• driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
• udmabuf: fix memory leak on last export_udmabuf() error path {CVE-2024-56712}
• ALSA: control: Avoid WARN() for symlink errors {CVE-2024-56657}
• mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM {CVE-2024-56611}
• eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}
• net: annotate data-races around sk->sk_{data_ready,write_space} {CVE-2026-23302}
• udmabuf: change folios array from kmalloc to kvmalloc {CVE-2024-56544}
• RDMA/mlx5: Move events notifier registration to be after device registration {CVE-2024-53224}
• dlm: fix possible lkb_resource…

In the Linux kernel, the following vulnerability has been resolved:

hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio

Commit b15c87263a69 ("hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined) add page poison checks in do_migrate_range in order to make offline hwpoisoned page possible by introducing isolate_lru_page and try_to_unmap for hwpoisoned page. However folio lock must be held before calling try_to_unmap. Add it to fix this problem.

Warning will be produced if folio is not locked during unmap:

------------[ cut here ]------------ kernel BUG at ./include/linux/swapops.h:400! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 4 UID: 0 PID: 411 Comm: bash Tainted: G W 6.13.0-rc1-00016-g3c434c7ee82a-dirty #41 Tainted: [W]=WARN Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : try_to_unmap_one+0xb08/0xd3c lr : try_to_unmap_one+0x3dc/0xd3c Call trace: try_to_unmap_one+0xb08/0xd3c (P) try_to_unmap_one+0x3dc/0xd3c (L) rmap_walk_anon+0xdc/0x1f8 rmap_walk+0x3c/0x58 try_to_unmap+0x88/0x90 unmap_poisoned_folio+0x30/0xa8 do_migrate_range+0x4a0/0x568 offline_pages+0x5a4/0x670 memory_block_action+0x17c/0x374 memory_subsys_offline+0x3c/0x78 device_offline+0xa4/0xd0 state_store+0x8c/0xf0 dev_attr_store+0x18/0x2c sysfs_kf_write+0x44/0x54 kernfs_fop_write_iter+0x118/0x1a8 vfs_write+0x3a8/0x4bc ksys_write+0x6c/0xf8 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x44/0x100 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x30/0xd0 el0t_64_sync_handler+0xc8/0xcc el0t_64_sync+0x198/0x19c Code: f9407be0 b5fff320 d4210000 17ffff97 (d4210000) ---[ end trace 0000000000000000 ]---

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47659: drm/plane: Move range check for format_count earlier (bsc#1237839).
• CVE-2022-49044: dm integrity: fix memory corruption when tag_size is less than digest size (bsc#1237840).
• CVE-2022-49055: drm/amdkfd: Check for potential null return of kmalloc_array() (bsc#1237868).
• CVE-2022-49060: net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() (bsc#1237845).
• CVE-2022-49086: net: openvswitch: fix leak of nested actions (bsc#1238037).
• CVE-2022-49111: Bluetooth: Fix use after free in hci_send_acl (bsc#1237984).
• CVE-2022-49118: scsi: hisi_sas: Free irq vectors in order for v3 HW (bsc#1237979).
• CVE-2022-49121: scsi: pm8001: Fix tag leaks on error (bsc#1237926).
• CVE-2022-49137: drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj (bsc#1238155).
• CVE-2022-49175: PM: core: keep irq flags in device_pm_check_callbacks() (bsc#1238099).
• CVE-2022-49176: bfq: fix use-after-free in bfq_dispatch_request (bsc#1238097).
• CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1238092).
• CVE-2022-49188: remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region (bsc#1238138).
• CVE-2022-49197: af_netlink: Fix shift out of bounds in group mask calculation (bsc#1238455).
• CVE-2022-49205: bpf, sockmap: Fix double uncharge the mem of sk_msg (bsc#1238335).
• CVE-2022-49232: drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() (bsc#1238139).
• CVE-2022-49290: mac80211: fix potential double free on mesh join (bsc#1238156).
• CVE-2022-49305: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() (bsc#1238645).
• CVE-2022-49325: tcp: add accessors to read/set tp->snd_cwnd (bsc#1238398).
• CVE-2022-49335: drm/amdgpu/cs: make commands with 0 chunks illegal behaviour (bsc#1238377).
• CVE-2022-49351: net: altera: Fix refcount leak in altera_tse_mdio_create (bsc#1237939).
• CVE-2022-49385: driver: base: fix UAF when driver_attach failed (bsc#1237951).
• CVE-2022-49390: macsec: fix UAF bug for real_dev (bsc#1238233).
• CVE-2022-49411: bfq: Make sure bfqg for which we are queueing requests is online (bsc#1238307).
• CVE-2022-49442: drivers/base/node.c: fix compaction sysfs file leak (bsc#1238243).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49478: media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init (bsc#1238000).
• CVE-2022-49489: drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume (bsc#1238244).
• CVE-2022-49504: scsi: lpfc: Inhibit aborts if external loopback plug is inserted (bsc#1238835).
• CVE-2022-49521: scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() (bsc#1238938).
• CVE-2022-49525: media: cx25821: Fix the warning when removing the module (bsc#1238022).
• CVE-2022-49534: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT (bsc#1238893).
• CVE-2022-49535: scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI (bsc#1238937).
• CVE-2022-49536: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock (bsc#1238838).
• CVE-2022-49537: scsi: lpfc: Fix call trace observed during I/O with CMF enabled (bsc#1238930).
• CVE-2022-49542: scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() (bsc#1238722).
• CVE-2022-49561: netfilter: conntrack: re-fetch conntrack after insertion (bsc#1238537).
• CVE-2022-49590: igmp: Fix data-races around sysctl_igmp_llm_reports (bsc#1238844).
• CVE-2022-49658: bpf, selftests: Add verifier test case for imm=0,umin=0,umax=1 scalar (bsc#1238803).
• CVE-2022-49668: PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events (bsc#1237957).
• CVE-2022-49693: drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf (bsc#1237954).
• CVE-2022-49725: i40e: Fix call trace in setup_tx_descriptors…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
• CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
• CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
• CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
• CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
• CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
• CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
• CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
• CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
• CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
• CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
• CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
• CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
• CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
• CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
• CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
• CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
• CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
• CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
• CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
• CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
• CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
• CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
• CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
• CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
• CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
• CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
• CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
• CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).
• CVE-2025-21924: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error (bsc#1240720). -…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-27415: netfilter: bridge: confirm multicast packets before passing them up the stack (bsc#1224757).
• CVE-2024-28956: Intel CPU: Indirect Target Selection (ITS) (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-46763: fou: Fix null-ptr-deref in GRO (bsc#1230764).
• CVE-2024-50038: netfilter: xtables: avoid NFPROTO_UNSPEC where needed (bsc#1231910).
• CVE-2024-50162: bpf: devmap: provide rxq after redirect (bsc#1233075).
• CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
• CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
• CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
• CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
• CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
• CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
• CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
• CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
• CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
• CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
• CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
• CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
• CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
• CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
• CVE-2025-21854: sockmap, vsock: For connectible sockets allow only connected (bsc#1239470).
• CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
• CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
• CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
• CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
• CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
• CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
• CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
• CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
• CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
• CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
• CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
• CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
• CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
• CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
• CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).…

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-43869: perf: Fix hang while freeing sigtrap event (bsc#1229491).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
• CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
• CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
• CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
• CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
• CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
• CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
• CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086). -…

The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49570: drm/xe/tracing: Fix a potential TP_printk UAF (bsc#1238782).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
• CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
• CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
• CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
• CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
• CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
• CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
• CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2024-58074: drm/i915: Grab intel_display from the encoder to avoid potential (bsc#1238972).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510). -…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
• CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
• CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
• CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
• CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
• CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
• CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
• CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
• CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
• CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
• CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
• CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
• CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
• CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
• CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
• CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
• CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
• CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
• CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
• CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
• CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
• CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
• CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
• CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
• CVE-2025-21894: net: enetc: VFs do not…

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49570: drm/xe/tracing: Fix a potential TP_printk UAF (bsc#1238782).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
• CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
• CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
• CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
• CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
• CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
• CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
• CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2024-58074: drm/i915: Grab intel_display from the encoder to avoid potential (bsc#1238972).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510). -…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
• CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
• CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
• CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
• CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
• CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
• CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
• CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
• CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
• CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
• CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
• CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
• CVE-2025-21925: llc: do not use skb_get() before dev_queue_xmit() (bsc#1240713).
• CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment (bsc#1240712).
• CVE-2025-21931: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (bsc#1240709).
• CVE-2025-21962: cifs: Fix integer overflow while processing closetimeo mount option (bsc#1240655).
• CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717).
• CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740).
• CVE-2025-21980: sched: address a potential NULL pointer dereference in the GRED scheduler (bsc#1240809).
• CVE-2025-21985: drm/amd/display: Fix out-of-bound accesses (bsc#1240811).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835).
• CVE-2025-22015: mm/migrate: fix shmem xarray update during migration (bsc#1240944).
• CVE-2025-22016: dpll: fix xa_alloc_cyclic() error handling (bsc#1240934).
• CVE-2025-22017: devlink: fix xa_alloc_cyclic() error handling (bsc#1240936).
• CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266).
• CVE-2025-22029: exec: fix the racy usage of fs_struct->in_exec (bsc#1241378).
• CVE-2025-22036: exfat: fix random stack corruption after get_block (bsc#1241426).
• CVE-2025-22045: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (bsc#1241433).
• CVE-2025-22053: net: ibmveth: make veth_pool_store stop hanging (bsc#1241373).
• CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371).
• CVE-2025-22058: udp: Fix memory accounting leak (bsc#1241332).
• CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
• CVE-2025-22064: netfilter: nf_tables: do not unregister hook when table is dormant (bsc#1241413).
• CVE-2025-22080: fs/ntfs3: Prevent integer overflow in hdr_first_de() (bsc#1241416).
• CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
• CVE-2025-22102: Bluetooth: btnxpuart: Fix kernel panic during FW…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
• CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
• CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
• CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
• CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
• CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
• CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
• CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
• CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
• CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
• CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
• CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
• CVE-2025-21925: llc: do not use skb_get() before dev_queue_xmit() (bsc#1240713).
• CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment (bsc#1240712).
• CVE-2025-21931: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (bsc#1240709).
• CVE-2025-21962: cifs: Fix integer overflow while processing closetimeo mount option (bsc#1240655).
• CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717).
• CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740).
• CVE-2025-21980: sched: address a potential NULL pointer dereference in the GRED scheduler (bsc#1240809).
• CVE-2025-21985: drm/amd/display: Fix out-of-bound accesses (bsc#1240811).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835).
• CVE-2025-22015: mm/migrate: fix shmem xarray update during migration (bsc#1240944).
• CVE-2025-22016: dpll: fix xa_alloc_cyclic() error handling (bsc#1240934).
• CVE-2025-22017: devlink: fix xa_alloc_cyclic() error handling (bsc#1240936).
• CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266).
• CVE-2025-22029: exec: fix the racy usage of fs_struct->in_exec (bsc#1241378).
• CVE-2025-22036: exfat: fix random stack corruption after get_block (bsc#1241426).
• CVE-2025-22045: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (bsc#1241433).
• CVE-2025-22053: net: ibmveth: make veth_pool_store stop hanging (bsc#1241373).
• CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371).
• CVE-2025-22058: udp: Fix memory accounting leak (bsc#1241332).
• CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
• CVE-2025-22064: netfilter: nf_tables: do not unregister hook when table is dormant (bsc#1241413).
• CVE-2025-22080: fs/ntfs3: Prevent integer overflow in hdr_first_de() (bsc#1241416).
• CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
• CVE-2025-22102: Bluetooth: btnxpuart: Fix kernel panic during…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
• CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
• CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
• CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
• CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
• CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
• CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
• CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
• CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
• CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
• CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
• CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
• CVE-2025-21925: llc: do not use skb_get() before dev_queue_xmit() (bsc#1240713).
• CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment (bsc#1240712).
• CVE-2025-21931: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (bsc#1240709).
• CVE-2025-21962: cifs: Fix integer overflow while processing closetimeo mount option (bsc#1240655).
• CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717).
• CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740).
• CVE-2025-21980: sched: address a potential NULL pointer dereference in the GRED scheduler (bsc#1240809).
• CVE-2025-21985: drm/amd/display: Fix out-of-bound accesses (bsc#1240811).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835).
• CVE-2025-22015: mm/migrate: fix shmem xarray update during migration (bsc#1240944).
• CVE-2025-22016: dpll: fix xa_alloc_cyclic() error handling (bsc#1240934).
• CVE-2025-22017: devlink: fix xa_alloc_cyclic() error handling (bsc#1240936).
• CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266).
• CVE-2025-22029: exec: fix the racy usage of fs_struct->in_exec (bsc#1241378).
• CVE-2025-22036: exfat: fix random stack corruption after get_block (bsc#1241426).
• CVE-2025-22045: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (bsc#1241433).
• CVE-2025-22053: net: ibmveth: make veth_pool_store stop hanging (bsc#1241373).
• CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371).
• CVE-2025-22058: udp: Fix memory accounting leak (bsc#1241332).
• CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
• CVE-2025-22064: netfilter: nf_tables: do not unregister hook when table is dormant (bsc#1241413).
• CVE-2025-22080: fs/ntfs3: Prevent integer overflow in hdr_first_de() (bsc#1241416).
• CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
• CVE-2025-22102: Bluetooth: btnxpuart: Fix kernel panic during FW…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
• CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
• CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
• CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
• CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
• CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
• CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
• CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
• CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
• CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
• CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
• CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
• CVE-2025-21925: llc: do not use skb_get() before dev_queue_xmit() (bsc#1240713).
• CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment (bsc#1240712).
• CVE-2025-21931: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (bsc#1240709).
• CVE-2025-21962: cifs: Fix integer overflow while processing closetimeo mount option (bsc#1240655).
• CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717).
• CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740).
• CVE-2025-21980: sched: address a potential NULL pointer dereference in the GRED scheduler (bsc#1240809).
• CVE-2025-21985: drm/amd/display: Fix out-of-bound accesses (bsc#1240811).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835).
• CVE-2025-22015: mm/migrate: fix shmem xarray update during migration (bsc#1240944).
• CVE-2025-22016: dpll: fix xa_alloc_cyclic() error handling (bsc#1240934).
• CVE-2025-22017: devlink: fix xa_alloc_cyclic() error handling (bsc#1240936).
• CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266).
• CVE-2025-22029: exec: fix the racy usage of fs_struct->in_exec (bsc#1241378).
• CVE-2025-22036: exfat: fix random stack corruption after get_block (bsc#1241426).
• CVE-2025-22045: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (bsc#1241433).
• CVE-2025-22053: net: ibmveth: make veth_pool_store stop hanging (bsc#1241373).
• CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371).
• CVE-2025-22058: udp: Fix memory accounting leak (bsc#1241332).
• CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
• CVE-2025-22064: netfilter: nf_tables: do not unregister hook when table is dormant (bsc#1241413).
• CVE-2025-22080: fs/ntfs3: Prevent integer overflow in hdr_first_de() (bsc#1241416).
• CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
• CVE-2025-22102: Bluetooth: btnxpuart: Fix kernel panic during…

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• HW tracing;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Amlogic Meson DDR PMU;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• USB core drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• TSM Common Guest driver;
• Virtio drivers;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• Overlay file system;…

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• HW tracing;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Amlogic Meson DDR PMU;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• USB core drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• TSM Common Guest driver;
• Virtio drivers;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• Overlay file system; …

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• HW tracing;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Amlogic Meson DDR PMU;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• USB core drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• TSM Common Guest driver;
• Virtio drivers;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• Overlay file system; …

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• HW tracing;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Amlogic Meson DDR PMU;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• USB core drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• TSM Common Guest driver;
• Virtio drivers;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• Overlay file system; …

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• HW tracing;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Amlogic Meson DDR PMU;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• USB core drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• TSM Common Guest driver;
• Virtio drivers;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• Overlay file system; …

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• HW tracing;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Amlogic Meson DDR PMU;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• USB core drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• TSM Common Guest driver;
• Virtio drivers;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• Overlay file system; …

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• HW tracing;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Amlogic Meson DDR PMU;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• USB core drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• TSM Common Guest driver;
• Virtio drivers;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• Overlay file system; …

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• HW tracing;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Amlogic Meson DDR PMU;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• USB core drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• TSM Common Guest driver;
• Virtio drivers;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• Overlay file system; …

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• HW tracing;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Amlogic Meson DDR PMU;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• USB core drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• TSM Common Guest driver;
• Virtio drivers;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• Overlay file system; …

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• HW tracing;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Amlogic Meson DDR PMU;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• USB core drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• TSM Common Guest driver;
• Virtio drivers;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• Overlay file system; …

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• HW tracing;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Amlogic Meson DDR PMU;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• USB core drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• TSM Common Guest driver;
• Virtio drivers;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• Overlay file system; …

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• HW tracing;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Amlogic Meson DDR PMU;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• USB core drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• TSM Common Guest driver;
• Virtio drivers;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• Overlay file system; …

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• HW tracing;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Amlogic Meson DDR PMU;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• USB core drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• TSM Common Guest driver;
• Virtio drivers;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• Overlay file system; …

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• HW tracing;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Amlogic Meson DDR PMU;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• USB core drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• TSM Common Guest driver;
• Virtio drivers;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• Overlay file system; …

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• HW tracing;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Amlogic Meson DDR PMU;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• USB core drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• TSM Common Guest driver;
• Virtio drivers;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• Overlay file system; …

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Block device driver;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• ISDN/mISDN subsystem;
• Mailbox framework;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Fastrpc Driver;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Amlogic Meson DDR PMU;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• Power supply drivers;
• Powercap sysfs driver;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem; -…