CVE-2025-39863

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work The brcmf_btcoex_detach() only shuts down the btcoex timer, if the flag timer_on is false. However, the brcmf_btcoex_timerfunc(), which runs as timer handler, sets timer_on to false. This creates critical race conditions: 1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc() is executing, it may observe timer_on as false and skip the call to timer_shutdown_sync(). 2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info worker after the cancel_work_sync() has been executed, resulting in use-after-free bugs. The use-after-free bugs occur in two distinct scenarios, depending on the timing of when the brcmf_btcoex_info struct is freed relative to the execution of its worker thread. Scenario 1: Freed before the worker is scheduled The brcmf_btcoex_info is deallocated before the worker is scheduled. A race condition can occur when schedule_work(&bt_local->work) is called after the target memory has been freed. The sequence of events is detailed below: CPU0 | CPU1 brcmf_btcoex_detach | brcmf_btcoex_timerfunc | bt_local->timer_on = false; if (cfg->btcoex->timer_on) | ... | cancel_work_sync(); | ... | kfree(cfg->btcoex); // FREE | | schedule_work(&bt_local->work); // USE Scenario 2: Freed after the worker is scheduled The brcmf_btcoex_info is freed after the worker has been scheduled but before or during its execution. In this case, statements within the brcmf_btcoex_handler() — such as the container_of macro and subsequent dereferences of the brcmf_btcoex_info object will cause a use-after-free access. The following timeline illustrates this scenario: CPU0 | CPU1 brcmf_btcoex_detach | brcmf_btcoex_timerfunc | bt_local->timer_on = false; if (cfg->btcoex->timer_on) | ... | cancel_work_sync(); | ... | schedule_work(); // Reschedule | kfree(cfg->btcoex); // FREE | brcmf_btcoex_handler() // Worker /* | btci = container_of(....); // USE The kfree() above could | ... also occur at any point | btci-> // USE during the worker's execution| */ | To resolve the race conditions, drop the conditional check and call timer_shutdown_sync() directly. It can deactivate the timer reliably, regardless of its current state. Once stopped, the timer_on state is then set to false.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error

After devm_request_irq() fails with error in pci_endpoint_test_request_irq(), the pci_endpoint_test_free_irq_vectors() is called assuming that all IRQs have been released.

However, some requested IRQs remain unreleased, so there are still /proc/irq/* entries remaining, and this results in WARN() with the following message:

remove_proc_entry: removing non-empty directory 'irq/30', leaking at least 'pci-endpoint-test.0' WARNING: CPU: 0 PID: 202 at fs/proc/generic.c:719 remove_proc_entry +0x190/0x19c

To solve this issue, set the number of remaining IRQs to test->num_irqs, and release IRQs in advance by calling pci_endpoint_test_release_irq().

kwilczynski: commit log

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: csa unmap use uninterruptible lock

After process exit to unmap csa and free GPU vm, if signal is accepted and then waiting to take vm lock is interrupted and return, it causes memory leaking and below warning backtrace.

Change to use uninterruptible wait lock fix the issue.

WARNING: CPU: 69 PID: 167800 at amd/amdgpu/amdgpu_kms.c:1525 amdgpu_driver_postclose_kms+0x294/0x2a0 [amdgpu] Call Trace: <TASK> drm_file_free.part.0+0x1da/0x230 [drm] drm_close_helper.isra.0+0x65/0x70 [drm] drm_release+0x6a/0x120 [drm] amdgpu_drm_release+0x51/0x60 [amdgpu] __fput+0x9f/0x280 ____fput+0xe/0x20 task_work_run+0x67/0xa0 do_exit+0x217/0x3c0 do_group_exit+0x3b/0xb0 get_signal+0x14a/0x8d0 arch_do_signal_or_restart+0xde/0x100 exit_to_user_mode_loop+0xc1/0x1a0 exit_to_user_mode_prepare+0xf4/0x100 syscall_exit_to_user_mode+0x17/0x40 do_syscall_64+0x69/0xc0

(cherry picked from commit 7dbbfb3c171a6f63b01165958629c9c26abf38ab)(CVE-2025-38011)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: avoid NULL pointer dereference if no valid csum tree

[BUG] When trying read-only scrub on a btrfs with rescue=idatacsums mount option, it will crash with the following call trace:

BUG: kernel NULL pointer dereference, address: 0000000000000208 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page CPU: 1 UID: 0 PID: 835 Comm: btrfs Tainted: G O 6.15.0-rc3-custom+ #236 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:btrfs_lookup_csums_bitmap+0x49/0x480 [btrfs] Call Trace: <TASK> scrub_find_fill_first_stripe+0x35b/0x3d0 [btrfs] scrub_simple_mirror+0x175/0x290 [btrfs] scrub_stripe+0x5f7/0x6f0 [btrfs] scrub_chunk+0x9a/0x150 [btrfs] scrub_enumerate_chunks+0x333/0x660 [btrfs] btrfs_scrub_dev+0x23e/0x600 [btrfs] btrfs_ioctl+0x1dcf/0x2f80 [btrfs] __x64_sys_ioctl+0x97/0xc0 do_syscall_64+0x4f/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e

[CAUSE] Mount option "rescue=idatacsums" will completely skip loading the csum tree, so that any data read will not find any data csum thus we will ignore data checksum verification.

Normally call sites utilizing csum tree will check the fs state flag NO_DATA_CSUMS bit, but unfortunately scrub does not check that bit at all.

This results in scrub to call btrfs_search_slot() on a NULL pointer and triggered above crash.

[FIX] Check both extent and csum tree root before doing any tree search.(CVE-2025-38059)

In the Linux kernel, the following vulnerability has been resolved:

coresight: holding cscfg_csdev_lock while removing cscfg from csdev

There'll be possible race scenario for coresight config:

CPU0 CPU1 (perf enable) load module cscfg_load_config_sets() …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error

After devm_request_irq() fails with error in pci_endpoint_test_request_irq(), the pci_endpoint_test_free_irq_vectors() is called assuming that all IRQs have been released.

However, some requested IRQs remain unreleased, so there are still /proc/irq/* entries remaining, and this results in WARN() with the following message:

remove_proc_entry: removing non-empty directory 'irq/30', leaking at least 'pci-endpoint-test.0' WARNING: CPU: 0 PID: 202 at fs/proc/generic.c:719 remove_proc_entry +0x190/0x19c

To solve this issue, set the number of remaining IRQs to test->num_irqs, and release IRQs in advance by calling pci_endpoint_test_release_irq().

kwilczynski: commit log

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: csa unmap use uninterruptible lock

After process exit to unmap csa and free GPU vm, if signal is accepted and then waiting to take vm lock is interrupted and return, it causes memory leaking and below warning backtrace.

Change to use uninterruptible wait lock fix the issue.

WARNING: CPU: 69 PID: 167800 at amd/amdgpu/amdgpu_kms.c:1525 amdgpu_driver_postclose_kms+0x294/0x2a0 [amdgpu] Call Trace: <TASK> drm_file_free.part.0+0x1da/0x230 [drm] drm_close_helper.isra.0+0x65/0x70 [drm] drm_release+0x6a/0x120 [drm] amdgpu_drm_release+0x51/0x60 [amdgpu] __fput+0x9f/0x280 ____fput+0xe/0x20 task_work_run+0x67/0xa0 do_exit+0x217/0x3c0 do_group_exit+0x3b/0xb0 get_signal+0x14a/0x8d0 arch_do_signal_or_restart+0xde/0x100 exit_to_user_mode_loop+0xc1/0x1a0 exit_to_user_mode_prepare+0xf4/0x100 syscall_exit_to_user_mode+0x17/0x40 do_syscall_64+0x69/0xc0

(cherry picked from commit 7dbbfb3c171a6f63b01165958629c9c26abf38ab)(CVE-2025-38011)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: avoid NULL pointer dereference if no valid csum tree

[BUG] When trying read-only scrub on a btrfs with rescue=idatacsums mount option, it will crash with the following call trace:

BUG: kernel NULL pointer dereference, address: 0000000000000208 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page CPU: 1 UID: 0 PID: 835 Comm: btrfs Tainted: G O 6.15.0-rc3-custom+ #236 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:btrfs_lookup_csums_bitmap+0x49/0x480 [btrfs] Call Trace: <TASK> scrub_find_fill_first_stripe+0x35b/0x3d0 [btrfs] scrub_simple_mirror+0x175/0x290 [btrfs] scrub_stripe+0x5f7/0x6f0 [btrfs] scrub_chunk+0x9a/0x150 [btrfs] scrub_enumerate_chunks+0x333/0x660 [btrfs] btrfs_scrub_dev+0x23e/0x600 [btrfs] btrfs_ioctl+0x1dcf/0x2f80 [btrfs] __x64_sys_ioctl+0x97/0xc0 do_syscall_64+0x4f/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e

[CAUSE] Mount option "rescue=idatacsums" will completely skip loading the csum tree, so that any data read will not find any data csum thus we will ignore data checksum verification.

Normally call sites utilizing csum tree will check the fs state flag NO_DATA_CSUMS bit, but unfortunately scrub does not check that bit at all.

This results in scrub to call btrfs_search_slot() on a NULL pointer and triggered above crash.

[FIX] Check both extent and csum tree root before doing any tree search.(CVE-2025-38059)

In the Linux kernel, the following vulnerability has been resolved:

coresight: holding cscfg_csdev_lock while removing cscfg from csdev

There'll be possible race scenario for coresight config:

CPU0 CPU1 (perf enable) load module cscfg_load_config_sets() …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error

After devm_request_irq() fails with error in pci_endpoint_test_request_irq(), the pci_endpoint_test_free_irq_vectors() is called assuming that all IRQs have been released.

However, some requested IRQs remain unreleased, so there are still /proc/irq/* entries remaining, and this results in WARN() with the following message:

remove_proc_entry: removing non-empty directory 'irq/30', leaking at least 'pci-endpoint-test.0' WARNING: CPU: 0 PID: 202 at fs/proc/generic.c:719 remove_proc_entry +0x190/0x19c

To solve this issue, set the number of remaining IRQs to test->num_irqs, and release IRQs in advance by calling pci_endpoint_test_release_irq().

kwilczynski: commit log

In the Linux kernel, the following vulnerability has been resolved:

btrfs: avoid NULL pointer dereference if no valid csum tree

[BUG] When trying read-only scrub on a btrfs with rescue=idatacsums mount option, it will crash with the following call trace:

BUG: kernel NULL pointer dereference, address: 0000000000000208 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page CPU: 1 UID: 0 PID: 835 Comm: btrfs Tainted: G O 6.15.0-rc3-custom+ #236 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:btrfs_lookup_csums_bitmap+0x49/0x480 [btrfs] Call Trace: <TASK> scrub_find_fill_first_stripe+0x35b/0x3d0 [btrfs] scrub_simple_mirror+0x175/0x290 [btrfs] scrub_stripe+0x5f7/0x6f0 [btrfs] scrub_chunk+0x9a/0x150 [btrfs] scrub_enumerate_chunks+0x333/0x660 [btrfs] btrfs_scrub_dev+0x23e/0x600 [btrfs] btrfs_ioctl+0x1dcf/0x2f80 [btrfs] __x64_sys_ioctl+0x97/0xc0 do_syscall_64+0x4f/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e

[CAUSE] Mount option "rescue=idatacsums" will completely skip loading the csum tree, so that any data read will not find any data csum thus we will ignore data checksum verification.

Normally call sites utilizing csum tree will check the fs state flag NO_DATA_CSUMS bit, but unfortunately scrub does not check that bit at all.

This results in scrub to call btrfs_search_slot() on a NULL pointer and triggered above crash.

[FIX] Check both extent and csum tree root before doing any tree search.(CVE-2025-38059)

In the Linux kernel, the following vulnerability has been resolved:

coresight: holding cscfg_csdev_lock while removing cscfg from csdev

There'll be possible race scenario for coresight config:

CPU0 CPU1 (perf enable) load module cscfg_load_config_sets() activate config. // sysfs (sys_active_cnt == 1) ... cscfg_csdev_enable_active_config() lock(csdev->cscfg_csdev_lock) deactivate config // sysfs (sys_activec_cnt == 0) cscfg_unload_config_sets() <iterating config_csdev_list> cscfg_remove_owned_csdev_configs() // here load config activate by CPU1 unlock(csdev->cscfg_csdev_lock)

iterating config_csdev_list could be raced with config_csdev_list's entry delete.

To resolve this race , hold csdev->cscfg_csdev_lock() while cscfg_remove_owned_csdev_configs()(CVE-2025-38132)

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init()

devm_ioremap() returns NULL on error. Currently, mt7915_mmio_wed_init() does not check for this case, which results in a NULL pointer…

Root has patched CVE-2025-39863 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2025-39863 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-39863 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2025-39863 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work The brcmf_btcoex_detach() only shuts down the btcoex timer, if the flag timer_on is false. However, the brcmf_btcoex_timerfunc(), which runs as timer handler, sets timer_on to false. This creates critical race conditions: 1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc() is executing, it may observe timer_on as false and skip the call to timer_shutdown_sync(). 2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info worker after the cancel_work_sync() has been executed, resulting in use-after-free bugs. The use-after-free bugs occur in two distinct scenarios, depending on the timing of when the brcmf_btcoex_info struct is freed relative to the execution of its worker thread. Scenario 1: Freed before the worker is scheduled The brcmf_btcoex_info is deallocated before the worker is scheduled. A race condition can occur when schedule_work(&bt_local->work) is called after the target memory has been freed. The sequence of events is detailed below: CPU0 | CPU1 brcmf_btcoex_detach | brcmf_btcoex_timerfunc | bt_local->timer_on = false; if (cfg->btcoex->timer_on) | ... | cancel_work_sync(); | ... | kfree(cfg->btcoex); // FREE | | schedule_work(&bt_local->work); // USE Scenario 2: Freed after the worker is scheduled The brcmf_btcoex_info is freed after the worker has been scheduled but before or during its execution. In this case, statements within the brcmf_btcoex_handler() — such as the container_of macro and subsequent dereferences of the brcmf_btcoex_info object will cause a use-after-free access. The following timeline illustrates this scenario: CPU0 | CPU1 brcmf_btcoex_detach | brcmf_btcoex_timerfunc | bt_local->timer_on = false; if (cfg->btcoex->timer_on) | ... | cancel_work_sync(); | ... | schedule_work(); // Reschedule | kfree(cfg->btcoex); // FREE | brcmf_btcoex_handler() // Worker /* | btci = container_of(....); // USE The kfree() above could | ... also occur at any point | btci-> // USE during the worker's execution| */ | To resolve the race conditions, drop the conditional check and call timer_shutdown_sync() directly. It can deactivate the timer reliably, regardless of its current state. Once stopped, the timer_on state is then set to false.

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work

The brcmf_btcoex_detach() only shuts down the btcoex timer, if the flag timer_on is false. However, the brcmf_btcoex_timerfunc(), which runs as timer handler, sets timer_on to false. This creates critical race conditions:

1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc() is executing, it may observe timer_on as false and skip the call to timer_shutdown_sync().

2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info worker after the cancel_work_sync() has been executed, resulting in use-after-free bugs.

The use-after-free bugs occur in two distinct scenarios, depending on the timing of when the brcmf_btcoex_info struct is freed relative to the execution of its worker thread.

Scenario 1: Freed before the worker is scheduled

The brcmf_btcoex_info is deallocated before the worker is scheduled. A race condition can occur when schedule_work(&bt_local->work) is called after the target memory has been freed. The sequence of events is detailed below:

CPU0 | CPU1 brcmf_btcoex_detach | brcmf_btcoex_timerfunc | bt_local->timer_on = false; if (cfg->btcoex->timer_on) | ... | cancel_work_sync(); | ... | kfree(cfg->btcoex); // FREE | | schedule_work(&bt_local->work); // USE

Scenario 2: Freed after the worker is scheduled

The brcmf_btcoex_info is freed after the worker has been scheduled but before or during its execution. In this case, statements within the brcmf_btcoex_handler() — such as the container_of macro and subsequent dereferences of the brcmf_btcoex_info object will cause a use-after-free access. The following timeline illustrates this scenario:

CPU0 | CPU1 brcmf_btcoex_detach | brcmf_btcoex_timerfunc | bt_local->timer_on = false; if (cfg->btcoex->timer_on) | ... | cancel_work_sync(); | ... | schedule_work(); // Reschedule | kfree(cfg->btcoex); // FREE | brcmf_btcoex_handler() // Worker /* | btci = container_of(....); // USE The kfree() above could | ... also occur at any point | btci-> // USE during the worker's execution| */ |

To resolve the race conditions, drop the conditional check and call timer_shutdown_sync() directly. It can deactivate the timer reliably, regardless of its current state. Once stopped, the timer_on state is then set to false.

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work

The brcmf_btcoex_detach() only shuts down the btcoex timer, if the flag timer_on is false. However, the brcmf_btcoex_timerfunc(), which runs as timer handler, sets timer_on to false. This creates critical race conditions:

1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc() is executing, it may observe timer_on as false and skip the call to timer_shutdown_sync().

2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info worker after the cancel_work_sync() has been executed, resulting in use-after-free bugs.

The use-after-free bugs occur in two distinct scenarios, depending on the timing of when the brcmf_btcoex_info struct is freed relative to the execution of its worker thread.

Scenario 1: Freed before the worker is scheduled

The brcmf_btcoex_info is deallocated before the worker is scheduled. A race condition can occur when schedule_work(&bt_local->work) is called after the target memory has been freed. The sequence of events is detailed below:

CPU0 | CPU1 brcmf_btcoex_detach | brcmf_btcoex_timerfunc | bt_local->timer_on = false; if (cfg->btcoex->timer_on) | ... | cancel_work_sync(); | ... | kfree(cfg->btcoex); // FREE | | schedule_work(&bt_local->work); // USE

Scenario 2: Freed after the worker is scheduled

The brcmf_btcoex_info is freed after the worker has been scheduled but before or during its execution. In this case, statements within the brcmf_btcoex_handler() — such as the container_of macro and subsequent dereferences of the brcmf_btcoex_info object will cause a use-after-free access. The following timeline illustrates this scenario:

CPU0 | CPU1 brcmf_btcoex_detach | brcmf_btcoex_timerfunc | bt_local->timer_on = false; if (cfg->btcoex->timer_on) | ... | cancel_work_sync(); | ... | schedule_work(); // Reschedule | kfree(cfg->btcoex); // FREE | brcmf_btcoex_handler() // Worker /* | btci = container_of(....); // USE The kfree() above could | ... also occur at any point | btci-> // USE during the worker's execution| */ |

To resolve the race conditions, drop the conditional check and call timer_shutdown_sync() directly. It can deactivate the timer reliably, regardless of its current state. Once stopped, the timer_on state is then set to false.

• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-40186}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
• ext4: fix undefined behavior in bit shift for ext4_check_flag_values {CVE-2022-50403}
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}

• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-40186}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
• ext4: fix undefined behavior in bit shift for ext4_check_flag_values {CVE-2022-50403}
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}

• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-40186}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
• ext4: fix undefined behavior in bit shift for ext4_check_flag_values {CVE-2022-50403}
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}

• Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
• firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
• wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• spec: merge oraclelinux6els changes
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918}
• ipvs: use explicitly signed chars
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-48900}
• netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• mtd: inftlcore: Add error check for inftl_read_oob() {CVE-2025-37892}
• igb: Do not free q_vector unless new one was allocated {CVE-2022-50252}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• md-raid10: fix KASAN warning {CVE-2022-50211}
• usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}

• Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
• firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
• wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• spec: merge oraclelinux6els changes
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918}
• ipvs: use explicitly signed chars
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-48900}
• netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• mtd: inftlcore: Add error check for inftl_read_oob() {CVE-2025-37892}
• igb: Do not free q_vector unless new one was allocated {CVE-2022-50252}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• md-raid10: fix KASAN warning {CVE-2022-50211}
• usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}

• mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory {CVE-2025-39883}
• comedi: aio_iiro_16: Fix bit shift out of bounds {CVE-2025-38529}
• comedi: das6402: Fix bit shift out of bounds {CVE-2025-38482}
• comedi: pcl812: Fix bit shift out of bounds {CVE-2025-38530}
• comedi: das16m1: Fix bit shift out of bounds {CVE-2025-38483}
• tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). {CVE-2025-40186}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• smb: client: let recv_done verify data_offset, data_length and remaining_data_length {CVE-2025-39933}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping {CVE-2025-40154}
• Bluetooth: hci_event: call disconnect callback before deleting conn {CVE-2023-53673}
• net: fix information leakage in /proc/net/ptype {CVE-2022-48757}
• net/mlx5e: fix a potential double-free in fs_any_create_groups {CVE-2023-52667}
• mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update {CVE-2024-35855}
• Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
• crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
• perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
• ext4: fix double-free of blocks due to wrong extents moved_len {CVE-2024-26704}
• stm class: Fix a double free in stm_register_device() {CVE-2024-38627}
• pinctrl: core: delete incorrect free in pinctrl_enable() {CVE-2024-36940}
• ipvlan: add ipvlan_route_v6_outbound() helper {CVE-2023-52796}
• wifi: ath11k: fix gtk offload status event locking {CVE-2023-52777}
• ice: fix memory corruption bug with suspend and rebuild {CVE-2024-35911}
• drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' {CVE-2024-27042}
• drm/i915/vma: Fix UAF on destroy against retire race {CVE-2024-26939}
• netfilter: nf_tables: prefer nft_chain_validate {CVE-2024-41042}
• Bluetooth: Fix potential use-after-free when clear keys {CVE-2023-53386}
• drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] {CVE-2024-46815}
• drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120}
• nbd: fix incomplete validation of ioctl arg {CVE-2023-53513}
• RDMA/rxe: Fix incomplete state save in rxe_requester {CVE-2023-53539}
• netfilter: nftables: exthdr: fix 4-byte stack OOB write
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
• iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid {CVE-2025-37927}
• drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• RDMA/rxe: Fix mr->map double free {CVE-2022-50543}
• ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}
• vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
• RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug {CVE-2025-38024}
• drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies {CVE-2025-40096}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• drm/i915: mark requests for GuC virtual engines to avoid use-after-free {CVE-2023-53552}
• net: atlantic: fix fragment overflow handling in RX path {CVE-2025-68301}
• net: atm: add lec_mutex {CVE-2025-38323}
• net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
• scsi: lpfc: Fix buffer free/clear order in deferred receive path…

• net/ieee802154: don't warn zero-sized raw_sendmsg() {CVE-2022-50706}
• bpf: Don't redirect packets with invalid pkt_len {CVE-2022-49975}
• media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
• ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network {CVE-2022-49865}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
• NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349}
• pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
• lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
• ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
• fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691}
• wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue {CVE-2022-50164}
• mptcp: fix race condition in mptcp_schedule_work() {CVE-2025-40258}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• xfrm: Duplicate SPI Handling {CVE-2025-39797}
• scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input {CVE-2022-50030}
• net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent {CVE-2022-48883}
• net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
• dm raid: fix address sanitizer warning in raid_resume {CVE-2022-50085}
• Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
• ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() {CVE-2022-50050}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
• nfs: fix UAF in direct writes {CVE-2024-26958}
• iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
• drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• ALSA: pcm: Fix potential data race at PCM memory allocation helpers {CVE-2023-54072}
• drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes {CVE-2023-53077}
• net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
• i40e: fix idx validation in config queues msg {CVE-2025-39971}
• loop: Fix use-after-free issues {CVE-2023-53111}
• fs: prevent out-of-bounds array speculation when closing a file descriptor {CVE-2023-53117}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• Bluetooth: hci_event: call disconnect callback before deleting conn {CVE-2023-53673}
• wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
• pid: take a reference when initializing cad_pid {CVE-2021-47118}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• iommu/amd: Fix potential buffer overflow in…

• net/ieee802154: don't warn zero-sized raw_sendmsg() {CVE-2022-50706}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
• ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• xfrm: Duplicate SPI Handling {CVE-2025-39797}
• scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input {CVE-2022-50030}
• net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent {CVE-2022-48883}
• net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
• dm raid: fix address sanitizer warning in raid_resume {CVE-2022-50085}
• ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() {CVE-2022-50050}
• nfs: fix UAF in direct writes {CVE-2024-26958}
• iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
• drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• ALSA: pcm: Fix potential data race at PCM memory allocation helpers {CVE-2023-54072}
• drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes {CVE-2023-53077}
• net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
• loop: Fix use-after-free issues {CVE-2023-53111}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• Bluetooth: hci_event: call disconnect callback before deleting conn {CVE-2023-53673}
• ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729}
• libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285}
• firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• drm/shmem-helper: Remove another errant put in error path {CVE-2023-53084}
• wifi: mac80211: Fix UAF in ieee80211_scan_rx() {CVE-2022-49934}
• drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() {CVE-2022-50185}
• ext4: fix undefined behavior in bit shift for ext4_check_flag_values {CVE-2022-50403}
• wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() {CVE-2022-50279}
• nbd: fix incomplete validation of ioctl arg {CVE-2023-53513}
• r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586}
• sctp: handle the error returned from sctp_auth_asoc_init_active_key {CVE-2022-50243}
• crypto: qat - resolve race condition during AER recovery {CVE-2024-39493}
• i40e: fix idx validation in config queues msg {CVE-2025-39971}
• netfilter: nf_tables: prefer nft_chain_validate {CVE-2024-41042}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
• netfilter: validate user input for expected length {CVE-2024-35962}
• wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
• Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
• wifi: iwlwifi: fix a memory corruption {CVE-2024-26610}
• pid: take a reference when initializing cad_pid {CVE-2021-47118}
• wifi: cfg80211: check A-MSDU format more carefully…

• HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
• fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
• ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
• Bluetooth: ISO: Fix possible UAF on iso_conn_free {CVE-2025-40141}
• Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once {CVE-2025-40318}
• smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
• pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
• ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
• fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• bus: mhi: host: Detect events pointing to unexpected TREs {CVE-2025-39790}
• nvmet: fix out-of-bounds access in nvmet_enable_port {CVE-2025-37825}
• drm/xe: Make dma-fences compliant with the safe access rules {CVE-2025-38703}
• libceph: fix invalid accesses to ceph_connection_v1_info {CVE-2025-39880}
• fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass {CVE-2025-38396}
• anon_inode: explicitly block ->setattr()
• anon_inode: use a proper mode internally
• dynamic_dname(): drop unused dentry argument
• anon_inode: raise SB_I_NODEV and SB_I_NOEXEC
• Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete {CVE-2025-38118}
• Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync {CVE-2024-58013}
• drm/xe: Fix vm_bind_ioctl double free bug {CVE-2025-38731}
• media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
• HID: core: ensure __hid_request reserves the report ID as the first byte
• wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691}
• drm/i915: Protect access to driver and timeline name
• sync_file: Protect access to driver and timeline name
• dma-fence: Add safe access helpers and document the rules
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• net: phylink: add lock for serializing concurrent pl->phydev writes with resolver {CVE-2025-39905}
• HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() {CVE-2025-39806}
• vsock: Do not allow binding to VMADDR_PORT_ANY {CVE-2025-38618}
• mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory {CVE-2025-39883}
• md/raid1: Fix stack memory use after return in raid1_reshape {CVE-2025-38445}
• drm/i915/gt: Fix timeline left held on VMA alloc error {CVE-2025-38389}
• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• i40e: remove read access to debugfs files {CVE-2025-39901}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• bnxt_en: Fix memory corruption when FW resources change during ifdown {CVE-2025-39810}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• nbd: fix uaf in nbd_genl_connect() error path {CVE-2025-38443}
• Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
• regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods {CVE-2025-38395}
• virtio-net: ensure the received length does not exceed allocated size {CVE-2025-38375}
• ftrace: Fix UAF when lookup kallsym after ftrace disabled {CVE-2025-38346}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• software node: Correct a OOB check in software_node_get_reference_args() {CVE-2025-38342}
• net: atm: add lec_mutex {CVE-2025-38323} -…

• net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit {CVE-2025-39766}
• NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• KVM: x86: use array_index_nospec with indices that come from guest {CVE-2025-39823}
• ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
• ext4: improve error handling from ext4_dirhash() {CVE-2023-53473}
• rcu: Protect ->defer_qs_iw_pending from data race {CVE-2025-39749}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
• ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
• Bluetooth: ISO: Fix possible UAF on iso_conn_free {CVE-2025-40141}
• pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
• lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
• ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
• fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
• fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• libceph: fix invalid accesses to ceph_connection_v1_info {CVE-2025-39880}
• bus: mhi: host: Detect events pointing to unexpected TREs {CVE-2025-39790}
• nvmet: fix out-of-bounds access in nvmet_enable_port {CVE-2025-37825}
• net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() {CVE-2023-54155}
• wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
• fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691}
• net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device {CVE-2023-54015}
• x86/sev: Make enc_dec_hypercall() accept a size instead of npages {CVE-2023-53996}
• page_pool: Fix use-after-free in page_pool_recycle_in_ring {CVE-2025-38129}
• page_pool: fix inconsistency for page_pool_ring_[un]lock()
• net: page_pool: use in_softirq() instead {CVE-2025-38129}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• vsock: avoid to close connected socket after the timeout {CVE-2025-40248}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• smb: client: let recv_done verify data_offset, data_length and remaining_data_length {CVE-2025-39933}
• net: phylink: add lock for serializing concurrent pl->phydev writes with resolver {CVE-2025-39905}
• i40e: validate ring_len parameter against hardware-specific values
• i40e: add validation for ring_len param {CVE-2025-39973}
• i40e: increase max descriptors for XL710
• i40e: remove read access to debugfs files {CVE-2025-39901}
• mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory {CVE-2025-39883}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• i2c: tegra: check msg length in SMBUS block read {CVE-2025-38425}
• regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods {CVE-2025-38395}
• virtio-net: ensure the received length does not exceed allocated size {CVE-2025-38375}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow {CVE-2023-54102}
• tcp: fix a signed-integer-overflow bug in tcp_add_backlog() {CVE-2022-50865}
• tcp: minor optimization in tcp_add_backlog() {CVE-2022-50865}
• block, bfq: fix uaf for bfqq in bic_set_bfqq() {CVE-2023-52983}
• block, bfq: replace 0/1 with…

• CVE-2025-38699
  • scsi: bfa: Double-free fix {CVE-2025-38699}
• CVE-2025-38697
  • jfs: upper bound check of tree index in dbAllocAG {CVE-2025-38697}
• CVE-2025-39823
  • KVM: x86: use array_index_nospec with indices that come from guest {CVE-2025-39823}
• CVE-2025-39689
  • ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
• CVE-2025-39749
  • rcu: Protect ->defer_qs_iw_pending from data race {CVE-2025-39749}
• CVE-2025-38728
  • smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
• CVE-2025-38676
  • iommu/amd: Avoid stack buffer overflow from kernel cmdline {CVE-2025-38676}
• CVE-2025-38574
  • pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
• CVE-2025-38572
  • ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
• CVE-2025-38685
  • fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
• CVE-2025-38563
  • vm_ops: rename .split() callback to .may_split() {CVE-2025-38563}
  • perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563}
• CVE-2025-38702
  • fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• CVE-2025-39911
  • i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• CVE-2025-39971
  • i40e: fix idx validation in config queues msg {CVE-2025-39971}
• CVE-2025-40154
  • ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping {CVE-2025-40154}
• CVE-2025-39973
  • i40e: increase max descriptors for XL710 {CVE-2025-39973}
  • i40e: add validation for ring_len param {CVE-2025-39973}
• CVE-2022-49026
  • e100: Fix possible use after free in e100_xmit_prepare {CVE-2022-49026}
• CVE-2025-38724
  • nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• CVE-2025-39853
  • i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• CVE-2025-39860
  • Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
• CVE-2025-39891
  • wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
• CVE-2025-38530
  • comedi: pcl812: Fix bit shift out of bounds {CVE-2025-38530}
• CVE-2025-38529
  • comedi: aio_iiro_16: Fix bit shift out of bounds {CVE-2025-38529}
• CVE-2025-38497
  • usb: gadget: configfs: Fix OOB read on empty string write {CVE-2025-38497}
• CVE-2025-38483
  • comedi: das16m1: Fix bit shift out of bounds {CVE-2025-38483}
• CVE-2025-38482
  • comedi: das6402: Fix bit shift out of bounds {CVE-2025-38482}
• CVE-2025-39702
  • ipv6: sr: Fix MAC comparison to be constant-time {CVE-2025-39702}
• CVE-2025-39730
  • NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730}
• CVE-2025-39841
  • scsi: lpfc: Fix buffer free/clear order in deferred receive path {CVE-2025-39841}
• CVE-2025-39817
  • efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
• CVE-2025-38494
  • HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38494}
  • HID: core: ensure __hid_request reserves the report ID as the first byte {CVE-2025-38494}
  • HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• CVE-2025-39757
  • ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
• CVE-2025-38527
  • smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527}
• CVE-2023-52854
  • padata: Fix refcnt handling in padata_free_shell() {CVE-2023-52854}
• CVE-2024-35867
  • smb: client: fix potential UAF in cifs_stats_proc_show() {CVE-2024-35867}
• CVE-2024-50061
  • i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition {CVE-2024-50061}
• CVE-2025-39965 -…

• CVE-2023-53515
  • virtio-mmio: don't break lifecycle of vm_dev {CVE-2023-53515}
• CVE-2025-39967
  • fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
  • fbcon: Fix OOB access in font allocation {CVE-2025-39967}
• CVE-2025-38702
  • fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• CVE-2025-38563
  • perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563}
• CVE-2025-39869
  • dmaengine: ti: edma: Fix memory allocation size for queue_priority_map {CVE-2025-39869}
• CVE-2023-53577
  • bpf, cpumap: Make sure kthread is running before map update returns {CVE-2023-53577}
• CVE-2023-53608
  • nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() {CVE-2023-53608}
• CVE-2023-53604
  • dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path {CVE-2023-53604}
• CVE-2023-53619
  • netfilter: Replace printk() with pr_*() and define pr_fmt() {CVE-2023-53619}
  • netfilter: use kvmalloc_array to allocate memory for hashtable {CVE-2023-53619}
  • netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• CVE-2025-38680
  • media: uvcvideo: Fix 1-byte out-of-bounds read in {CVE-2025-38680}
• CVE-2023-53454
  • HID: multitouch: Correct devm device reference for hidinput {CVE-2023-53454}
• CVE-2025-38699
  • scsi: bfa: Double-free fix {CVE-2025-38699}
  • ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265}
  • scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
  • fs: jfs: Fix UBSAN: array-index-out-of-bounds in {CVE-2025-38699}
• CVE-2023-53596
  • drivers: base: Free devm resources when unregistering a {CVE-2023-53596}
• CVE-2023-53622
  • gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
  • HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition {CVE-2023-53622}
• CVE-2023-53090
  • drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
• CVE-2023-53116
  • nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
• CVE-2023-53138
  • net: caif: Fix use-after-free in cfusbl_device_notify() {CVE-2023-53138}
• CVE-2023-53035
  • nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() {CVE-2023-53035}
• CVE-2023-53668
  • ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• CVE-2023-53616
  • jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount {CVE-2023-53616}
• CVE-2023-53554
  • staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() {CVE-2023-53554}
• CVE-2023-53587
  • ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• CVE-2023-53541
  • mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write {CVE-2023-53541}
• CVE-2023-53559
  • ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559}
• CVE-2023-53484
  • lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
  • lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() {CVE-2023-53484}
• CVE-2025-39824
  • HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
• CVE-2025-38715
  • hfs: fix slab-out-of-bounds in hfs_bnode_read() {CVE-2025-38715}
• CVE-2023-53153
  • wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• CVE-2025-38555
  • usb: gadget : fix use-after-free in composite_dev_cleanup() {CVE-2025-38555}
• CVE-2025-39743
  • jfs: truncate good inode pages when hard link is 0 {CVE-2025-39743}
• CVE-2025-39945
  • cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945}
• CVE-2023-53506
  • udf: Do not bother merging very…

• Miscellaneous Ubuntu changes
  • update-from-bionic-master repo has been updated
• Miscellaneous upstream changes
  • debian: add control and changeg files [ Ubuntu: 4.15.0-254.265 ]
• CVE-2023-53515
  • virtio-mmio: don't break lifecycle of vm_dev {CVE-2023-53515}
• CVE-2025-39967
  • fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
  • fbcon: Fix OOB access in font allocation {CVE-2025-39967}
• CVE-2025-38702
  • fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• CVE-2025-38563
  • perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563}
• CVE-2025-39869
  • dmaengine: ti: edma: Fix memory allocation size for queue_priority_map {CVE-2025-39869}
• CVE-2023-53577
  • bpf, cpumap: Make sure kthread is running before map update returns {CVE-2023-53577}
• CVE-2023-53608
  • nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() {CVE-2023-53608}
• CVE-2023-53604
  • dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path {CVE-2023-53604}
• CVE-2023-53619
  • netfilter: Replace printk() with pr_*() and define pr_fmt() {CVE-2023-53619}
  • netfilter: use kvmalloc_array to allocate memory for hashtable {CVE-2023-53619}
  • netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• CVE-2025-38680
  • media: uvcvideo: Fix 1-byte out-of-bounds read in {CVE-2025-38680}
• CVE-2023-53454
  • HID: multitouch: Correct devm device reference for hidinput {CVE-2023-53454}
• CVE-2025-38699
  • scsi: bfa: Double-free fix {CVE-2025-38699}
  • ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265}
  • scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
  • fs: jfs: Fix UBSAN: array-index-out-of-bounds in {CVE-2025-38699}
• CVE-2023-53596
  • drivers: base: Free devm resources when unregistering a {CVE-2023-53596}
• CVE-2023-53622
  • gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
  • HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition {CVE-2023-53622}
• CVE-2023-53090
  • drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
• CVE-2023-53116
  • nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
• CVE-2023-53138
  • net: caif: Fix use-after-free in cfusbl_device_notify() {CVE-2023-53138}
• CVE-2023-53035
  • nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() {CVE-2023-53035}
• CVE-2023-53668
  • ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• CVE-2023-53616
  • jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount {CVE-2023-53616}
• CVE-2023-53554
  • staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() {CVE-2023-53554}
• CVE-2023-53587
  • ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• CVE-2023-53541
  • mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write {CVE-2023-53541}
• CVE-2023-53559
  • ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559}
• CVE-2023-53484
  • lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
  • lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() {CVE-2023-53484}
• CVE-2025-39824
  • HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
• CVE-2025-38715
  • hfs: fix slab-out-of-bounds in hfs_bnode_read() {CVE-2025-38715}
• CVE-2023-53153
  • wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• CVE-2025-38555
  • usb: gadget : fix use-after-free in composite_dev_cleanup() {CVE-2025-38555}
• CVE-2025-39743
  • jfs: truncate good inode…

• Bump kernel ABI to 29: ship the ELS kernel as 4.19.0-29-*, distinct from the prior 4.19.0-28.
• CVE-2021-46984
  • kyber: fix out of bounds access when preempted {CVE-2021-46984}
• CVE-2021-47049
  • Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}
• CVE-2021-47101
  • asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
• CVE-2021-47191
  • scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• CVE-2021-47352
  • virtio-net: Add validation for used length {CVE-2021-47352}
• CVE-2021-47379
  • blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd {CVE-2021-47379}
• CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests {CVE-2021-47391}
• CVE-2021-47479
  • staging: rtl8712: fix use-after-free in rtl8712_dl_fw {CVE-2021-47479}
• CVE-2022-21546
  • scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• CVE-2022-39189
  • KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• CVE-2022-43945
  • SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
  • NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2022-49026
  • e100: Fix possible use after free in e100_xmit_prepare {CVE-2022-49026}
• CVE-2022-49720
  • block: Fix handling of offline queues in blk_mq_alloc_request_hctx() {CVE-2022-49720}
• CVE-2022-49975
  • bpf: Don't redirect packets with invalid pkt_len {CVE-2022-49975}
  • bpf: Move skb->len == 0 checks into __bpf_redirect {CVE-2022-49975}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2022-50103
  • sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• CVE-2022-50129
  • RDMA/srpt: Introduce a reference count in struct srpt_device {CVE-2022-50129}
  • RDMA/srpt: Fix a use-after-free {CVE-2022-50129}
• CVE-2022-50300
  • btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300}
• CVE-2022-50406
  • iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50552
  • blk-mq: use quiesced elevator switch when reinitializing queues {CVE-2022-50552}
• CVE-2023-51779
  • Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
• CVE-2023-52434
  • smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• CVE-2023-52515
  • RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
• CVE-2023-52531
  • wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
• CVE-2023-52741
  • cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
• CVE-2023-53000
  • netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• CVE-2023-53039
  • workqueue: Add resource managed version of delayed work init {CVE-2023-53039}
  • devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc {CVE-2023-53039}
  • devm-helpers: Add resource managed version of work init {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc {CVE-2023-53039}
• CVE-2023-53111
  • loop: Fix use-after-free issues {CVE-2023-53111}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels…

• CVE-2022-49416
  • wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416}
• CVE-2022-49685
  • iio: trigger: sysfs: fix use-after-free on remove {CVE-2022-49685}
• CVE-2021-47670
  • can: peak_usb: fix use after free bugs {CVE-2021-47670}
• CVE-2026-98706
  • wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706}
• CVE-2026-98610
  • net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget {CVE-2026-98610}
• CVE-2026-98548
  • sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548}
• CVE-2026-98614
  • sctp: avoid livelock while updating retransmit path {CVE-2026-98614}
• CVE-2026-98547
  • af_packet: fix integer overflow in prb_calc_retire_blk_tmo() {CVE-2026-98547}
• CVE-2026-98579
  • nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure {CVE-2026-98579}
• CVE-2026-98581
  • nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() {CVE-2026-98581}
• CVE-2026-98577
  • nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() {CVE-2026-98577}
• CVE-2026-98482
  • nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() {CVE-2026-98482}
• CVE-2026-98576
  • nfc: llcp: fix slab-out-of-bounds reads when logging service names {CVE-2026-98576}
• CVE-2026-98624
  • netfilter: nfnetlink_queue: hold nfnl mutex in event notifier {CVE-2026-98624}
  • netlink: use blocking notifier {CVE-2026-98624}
• CVE-2026-98794
  • ipvs: filter some flags received in the backup server {CVE-2026-98794}
• CVE-2026-98829
  • wifi: mac80211: drop oversized fragments to avoid extra_len overflow {CVE-2026-98829}
• CVE-2026-98708
  • wifi: mac80211: keep paired old chanctx alive {CVE-2026-98708}
• CVE-2026-98707
  • wifi: mac80211: shut down RX BA session timer on teardown {CVE-2026-98707}
• CVE-2026-98532
  • ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532}
• CVE-2026-98541
  • fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT {CVE-2026-98541}
• CVE-2026-98461
  • Bluetooth: hci_sock: validate event length before filtering {CVE-2026-98461}
• CVE-2026-98621
  • net: gue: reject invalid REMCSUM offsets {CVE-2026-98621}
• CVE-2026-98526
  • llc: reserve device headroom for allocated frames {CVE-2026-98526}
• CVE-2026-98555
  • llc: fix skb UAF and leaks on llc_mac_hdr_init() failure {CVE-2026-98555}
• CVE-2026-98573
  • net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573}
• CVE-2026-98739
  • Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739}
• CVE-2026-98457
  • Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457}
• CVE-2026-98460
  • Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460}
• CVE-2026-98856
  • kprobes: Skip disarmed probes when checking optkprobe overlap {CVE-2026-98856}
• CVE-2026-98636
  • squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636}
• CVE-2026-98681
  • smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races {CVE-2026-98681}
• CVE-2026-98771
  • usb: storage: sierra_ms: reject short SWoC info transfers {CVE-2026-98771}
• CVE-2026-98772
  • USB: serial: fix port tear down use-after-free {CVE-2026-98772}
• CVE-2026-98696
  • USB: serial: fix driver deregistration order {CVE-2026-98696}
• CVE-2026-98697
  • USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697}
• CVE-2026-98769
  • usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769}
• CVE-2026-98764
  • usb: gadget: f_fs: Fix NULL pointer dereference in …

In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix use after free in midcomms commit While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning: .

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' value applies (e.g. 512) and a lot of queued SKBs are sent from the pkt queue.

In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206 CPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+ Workqueue: pdecrypt_parallel padata_parallel_worker Call Trace: <TASK> dump_stack_lvl+0x32/0x50 print_address_description.constprop.0+0x6b/0x3d0 print_report+0xdd/0x2c0 kasan_report+0xa5/0xd0 padata_find_next+0x29/0x1a0 padata_reorder+0x131/0x220 padata_parallel_worker+0x3d/0xc0 process_one_work+0x2ec/0x5a0 If 'mdelay(10)' is added before calling 'padata_find_next' in the 'padata_reorder' function, this issue could be reproduced easily with ltp test (pcrypt_aead01).

In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev().

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_sessions_deregister() In multichannel mode, UAF issue can occur in session_deregister when the second channel sets up a session through the connection of the first channel.

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by one compactly.

In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end Once inside 'ext4_xattr_inode_dec_ref_all' we should ignore xattrs entries past the 'end' entry.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __smb2_lease_break_noti() Move tcp_transport free to ksmbd_conn_free.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krb_authenticate krb_authenticate frees sess->user and does not set the pointer to NULL.

In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer.)(CVE-2025-37823).

In the Linux kernel, the following vulnerability has been resolved: jbd2: remove wrong sb->s_sequence check Journal emptiness is not determined by sb->s_sequence .

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mode1 reset crash issue If HW scheduler hangs and mode1 reset is used to recover GPU, KFD signal user space to abort the processes.

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use local fence in error path of xe_migrate_clear The intent of the error path in xe_migrate_clear is to wait on locally generated fence and then return.

In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report .

In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report .

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted…

The SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2024-57891: sched_ext: Fix invalid irq restore in scx_ops_bypass() (bsc#1235953).
• CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug (bsc#1237108).
• CVE-2024-57952: Revert "libfs: fix infinite directory reads for offset dir" (bsc#1237131).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22034: mm/rmap: avoid -EBUSY from make_device_exclusive() (bsc#1241435).
• CVE-2025-22077: Revert "smb: client: fix TCP timers deadlock after rmmod" (bsc#1241403).
• CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
• CVE-2025-37821: sched/eevdf: Fix se->slice being set to U64_MAX and resulting (bsc#1242864).
• CVE-2025-37849: KVM: arm64: Tear down vGIC on failed vCPU creation (bsc#1243000).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38019: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (bsc#1245000).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38038: cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (bsc#1244812).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
• CVE-2025-38101: ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (bsc#1245659).
• CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
• CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
• CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
• CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
• CVE-2025-38168: perf: arm-ni: Unregister PMUs on probe failure (bsc#1245763).
• CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
• CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
• CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
• CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
• CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
• CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
• CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
• CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
• CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).
• CVE-2025-38242: mm: userfaultfd: fix race of userfaultfd_move and swap…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4: do not BUG…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50242: drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() (bsc#1249696).
• CVE-2022-50244: cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() (bsc#1249647).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947).
• CVE-2022-50265: kcm: annotate data-races around kcm->rx_wait (bsc#1249744).
• CVE-2022-50278: PNP: fix name memory leak in pnp_alloc_dev() (bsc#1249715).
• CVE-2022-50285: mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages (bsc#1249803).
• CVE-2022-50288: qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure (bsc#1249802).
• CVE-2022-50291: kcm: annotate data-races around kcm->rx_psock (bsc#1249798).
• CVE-2022-50294: wifi: libertas: fix memory leak in lbs_init_adapter() (bsc#1249799).
• CVE-2022-50297: wifi: ath9k: verify the expected usb_endpoints are present (bsc#1250250).
• CVE-2022-50304: mm: export bdi_unregister (bsc#1249725).
• CVE-2022-50311: cxl: Fix refcount leak in cxl_calc_capp_routing (bsc#1249720).
• CVE-2022-50312: drivers: serial: jsm: fix some leaks in probe (bsc#1249716).
• CVE-2022-50321: wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (bsc#1249706).
• CVE-2022-50330: crypto: cavium - prevent integer overflow loading firmware (bsc#1249700).
• CVE-2022-50349: misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (bsc#1249920).
• CVE-2022-50352: net: hns: fix possible memory leak in hnae_ae_register() (bsc#1249922).
• CVE-2022-50359: media: cx88: Fix a null-ptr-deref bug in buffer_prepare() (bsc#1250269).
• CVE-2022-50365: skbuff: Account for tail adjustment during pull operations (bsc#1250084).
• CVE-2022-50375: tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown (bsc#1250132).
• CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
• CVE-2022-50396: net: sched: fix memory leak in tcindex_set_parms (bsc#1250104).
• CVE-2022-50402: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() (bsc#1250363).
• CVE-2022-50405: net/tunnel: wait until all sk_user_data reader finish before releasing the sock (bsc#1250155).
• CVE-2022-50406: iomap: iomap: fix memory corruption when recording errors during writeback (bsc#1250165).
• CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2022-50419: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times (bsc#1250394).
• CVE-2023-53148: igb: Do not bring the device up after non-fatal error (bsc#1249842).
• CVE-2023-53153: wifi: cfg80211: Partial revert 'wifi: cfg80211: Fix use after free for wext' (bsc#1249877).
• CVE-2023-53176: serial: 8250: Fix oops for port->pm on uart_change_pm() (bsc#1249991).
• CVE-2023-53178: mm: zswap: fix missing folio cleanup in writeback race path (bsc#1249827 git-fix).
• CVE-2023-53199: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails (bsc#1249683).
• CVE-2023-53201: RDMA/bnxt_re: wraparound mbox producer index (bsc#1249687).
• CVE-2023-53226: wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (bsc#1249658).
• CVE-2023-53248: drm/amdgpu: install stub fence into potential unused fence pointers (bsc#1249779).
• CVE-2023-53254: drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug (bsc#1249871).
• CVE-2023-53272: net: ena: fix shift-out-of-bounds in exponential backoff (bsc#1249917).
• CVE-2023-53277: wifi: iwl3945: Add missing check for create_singlethread_workqueue…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
• CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
• CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
• CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
• CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
• CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
• CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
• CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
• CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
• CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
• CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (bsc#1247167).
• CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
• CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
• CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
• CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
• CVE-2025-38491: mptcp: make fallback action and fallback decision…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4: do…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4: do…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4:…

The SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2024-57891: sched_ext: Fix invalid irq restore in scx_ops_bypass() (bsc#1235953).
• CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug (bsc#1237108).
• CVE-2024-57952: Revert "libfs: fix infinite directory reads for offset dir" (bsc#1237131).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22034: mm/rmap: avoid -EBUSY from make_device_exclusive() (bsc#1241435).
• CVE-2025-22077: Revert "smb: client: fix TCP timers deadlock after rmmod" (bsc#1241403).
• CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
• CVE-2025-37821: sched/eevdf: Fix se->slice being set to U64_MAX and resulting (bsc#1242864).
• CVE-2025-37849: KVM: arm64: Tear down vGIC on failed vCPU creation (bsc#1243000).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38019: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (bsc#1245000).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38038: cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (bsc#1244812).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
• CVE-2025-38101: ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (bsc#1245659).
• CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
• CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
• CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
• CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
• CVE-2025-38168: perf: arm-ni: Unregister PMUs on probe failure (bsc#1245763).
• CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
• CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
• CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
• CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
• CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
• CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
• CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
• CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
• CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).
• CVE-2025-38242: mm: userfaultfd: fix race of userfaultfd_move and swap…

The SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2024-57891: sched_ext: Fix invalid irq restore in scx_ops_bypass() (bsc#1235953).
• CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug (bsc#1237108).
• CVE-2024-57952: Revert "libfs: fix infinite directory reads for offset dir" (bsc#1237131).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22034: mm/rmap: avoid -EBUSY from make_device_exclusive() (bsc#1241435).
• CVE-2025-22077: Revert "smb: client: fix TCP timers deadlock after rmmod" (bsc#1241403).
• CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
• CVE-2025-37821: sched/eevdf: Fix se->slice being set to U64_MAX and resulting (bsc#1242864).
• CVE-2025-37849: KVM: arm64: Tear down vGIC on failed vCPU creation (bsc#1243000).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38019: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (bsc#1245000).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38038: cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (bsc#1244812).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
• CVE-2025-38101: ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (bsc#1245659).
• CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
• CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
• CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
• CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
• CVE-2025-38168: perf: arm-ni: Unregister PMUs on probe failure (bsc#1245763).
• CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
• CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
• CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
• CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
• CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
• CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
• CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
• CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
• CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).
• CVE-2025-38242: mm: userfaultfd: fix race of userfaultfd_move and swap…

The SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2024-57891: sched_ext: Fix invalid irq restore in scx_ops_bypass() (bsc#1235953).
• CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug (bsc#1237108).
• CVE-2024-57952: Revert "libfs: fix infinite directory reads for offset dir" (bsc#1237131).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22034: mm/rmap: avoid -EBUSY from make_device_exclusive() (bsc#1241435).
• CVE-2025-22077: Revert "smb: client: fix TCP timers deadlock after rmmod" (bsc#1241403).
• CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
• CVE-2025-37821: sched/eevdf: Fix se->slice being set to U64_MAX and resulting (bsc#1242864).
• CVE-2025-37849: KVM: arm64: Tear down vGIC on failed vCPU creation (bsc#1243000).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38019: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (bsc#1245000).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38038: cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (bsc#1244812).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
• CVE-2025-38101: ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (bsc#1245659).
• CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
• CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
• CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
• CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
• CVE-2025-38168: perf: arm-ni: Unregister PMUs on probe failure (bsc#1245763).
• CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
• CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
• CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
• CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
• CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
• CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
• CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
• CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
• CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).
• CVE-2025-38242: mm: userfaultfd: fix race of userfaultfd_move and swap…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4: do not…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).
• CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).
• CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).
• CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).
• CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (bsc#1249182).
• CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
• CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).
• CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).
• CVE-2025-39683: tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286).
• CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).
• CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).
• CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).
• CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).
• CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
• CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).
• CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).
• CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).
• CVE-2025-39832: net/mlx5: Add sync reset drop mode support (bsc#1249901).
• CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
• CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
• CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).
• CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
• CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
• CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).
• CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).
• CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).
• CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).
• CVE-2025-39898: e1000e: fix heap overflow in e1000_set_eeprom (bsc#1250742).
• CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).
• CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).
• CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).
• CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).
• CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).
• CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).
• CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).
• CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051). -…

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).
• CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).
• CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).
• CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).
• CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (bsc#1249182).
• CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
• CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).
• CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).
• CVE-2025-39683: tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286).
• CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).
• CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).
• CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).
• CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).
• CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
• CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).
• CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).
• CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).
• CVE-2025-39832: net/mlx5: Add sync reset drop mode support (bsc#1249901).
• CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
• CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
• CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).
• CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
• CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
• CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).
• CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).
• CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).
• CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).
• CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).
• CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).
• CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).
• CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).
• CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).
• CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).
• CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).
• CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).
• CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052). -…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).
• CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).
• CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).
• CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).
• CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (bsc#1249182).
• CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
• CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).
• CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).
• CVE-2025-39683: tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286).
• CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).
• CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).
• CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).
• CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).
• CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
• CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).
• CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).
• CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).
• CVE-2025-39832: net/mlx5: Add sync reset drop mode support (bsc#1249901).
• CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
• CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
• CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).
• CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
• CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
• CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).
• CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).
• CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).
• CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).
• CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).
• CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).
• CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).
• CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).
• CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).
• CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).
• CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).
• CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).
• CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052). -…

The SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2024-57891: sched_ext: Fix invalid irq restore in scx_ops_bypass() (bsc#1235953).
• CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug (bsc#1237108).
• CVE-2024-57952: Revert "libfs: fix infinite directory reads for offset dir" (bsc#1237131).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22034: mm/rmap: avoid -EBUSY from make_device_exclusive() (bsc#1241435).
• CVE-2025-22077: Revert "smb: client: fix TCP timers deadlock after rmmod" (bsc#1241403).
• CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
• CVE-2025-37821: sched/eevdf: Fix se->slice being set to U64_MAX and resulting (bsc#1242864).
• CVE-2025-37849: KVM: arm64: Tear down vGIC on failed vCPU creation (bsc#1243000).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38019: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (bsc#1245000).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38038: cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (bsc#1244812).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
• CVE-2025-38101: ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (bsc#1245659).
• CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
• CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
• CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
• CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
• CVE-2025-38168: perf: arm-ni: Unregister PMUs on probe failure (bsc#1245763).
• CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
• CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
• CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
• CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
• CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
• CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
• CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
• CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
• CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).
• CVE-2025-38242: mm: userfaultfd: fix race of userfaultfd_move and swap…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• KERNFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• Asynchronous Transfer Mode (ATM) subsystem;
• BPF subsystem;
• Mellanox drivers;
• NFS page cache wrapper;
• Memory management;
• Memory Management;
• Media input infrastructure;
• Bluetooth subsystem;
• IP tunnels definitions;
• Network traffic control;
• Rose network layer;
• Network sockets;
• io_uring subsystem;
• Control group (cgroup);
• Kernel crash support code;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• KERNFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• Asynchronous Transfer Mode (ATM) subsystem;
• BPF subsystem;
• Mellanox drivers;
• NFS page cache wrapper;
• Memory management;
• Memory Management;
• Media input infrastructure;
• Bluetooth subsystem;
• IP tunnels definitions;
• Network traffic control;
• Rose network layer;
• Network sockets;
• io_uring subsystem;
• Control group (cgroup);
• Kernel crash support code;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• KERNFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• Asynchronous Transfer Mode (ATM) subsystem;
• BPF subsystem;
• Mellanox drivers;
• NFS page cache wrapper;
• Memory management;
• Memory Management;
• Media input infrastructure;
• Bluetooth subsystem;
• IP tunnels definitions;
• Network traffic control;
• Rose network layer;
• Network sockets;
• io_uring subsystem;
• Control group (cgroup);
• Kernel crash support code;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• KERNFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• Asynchronous Transfer Mode (ATM) subsystem;
• BPF subsystem;
• Mellanox drivers;
• NFS page cache wrapper;
• Memory management;
• Memory Management;
• Media input infrastructure;
• Bluetooth subsystem;
• IP tunnels definitions;
• Network traffic control;
• Rose network layer;
• Network sockets;
• io_uring subsystem;
• Control group (cgroup);
• Kernel crash support code;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer…