CVE-2023-39198

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.(CVE-2022-45884)

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-35823. Reason: This candidate is a reservation duplicate of CVE-2023-35823. Notes: All CVE users should reference CVE-2023-35823 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.(CVE-2023-3327)

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.(CVE-2023-39198)

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.

If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.

We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

(CVE-2023-4623)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.(CVE-2022-45884)

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-35823. Reason: This candidate is a reservation duplicate of CVE-2023-35823. Notes: All CVE users should reference CVE-2023-35823 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.(CVE-2023-3327)

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.(CVE-2023-39198)

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.

If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.

We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

(CVE-2023-4623)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.(CVE-2022-45884)

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-35823. Reason: This candidate is a reservation duplicate of CVE-2023-35823. Notes: All CVE users should reference CVE-2023-35823 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.(CVE-2023-3327)

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.(CVE-2023-39198)

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.

If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.

We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

(CVE-2023-4623)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free.

We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325.

(CVE-2023-5197)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.(CVE-2022-45884)

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-35823. Reason: This candidate is a reservation duplicate of CVE-2023-35823. Notes: All CVE users should reference CVE-2023-35823 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.(CVE-2023-3327)

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.(CVE-2023-39198)

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.

If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.

We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

(CVE-2023-4623)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free.

We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325.

(CVE-2023-5197)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.(CVE-2022-45884)

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-35823. Reason: This candidate is a reservation duplicate of CVE-2023-35823. Notes: All CVE users should reference CVE-2023-35823 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.(CVE-2023-3327)

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.(CVE-2023-39198)

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.

If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.

We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

(CVE-2023-4623)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free.

We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325.

(CVE-2023-5197)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux SIG Cloud 8.10 Release Notes linked from the References section.

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)
• kernel: multiple use-after-free vulnerabilities (CVE-2024-1086, CVE-2023-3567, CVE-2023-4133, CVE-2023-6932, CVE-2023-39198, CVE-2023-51043, CVE-2023-51779, CVE-2023-51780, CVE-2024-1085, CVE-2024-26582)
• kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)
• kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)
• kernel: multiple NULL pointer dereference vulnerabilities (CVE-2022-38096, CVE-2023-6622, CVE-2023-6915, CVE-2023-42754, CVE-2023-46862, CVE-2023-52574, CVE-2024-0841, CVE-2023-52448)
• kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934)
• kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040)
• kernel: GC's deletion of an SKB races with unix_stream_read_generic() leading to UAF (CVE-2023-6531)
• kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931)
• kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023)
• kernel: irdma: Improper access control (CVE-2023-25775)
• Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464)
• kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c (CVE-2023-28866)
• kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl (CVE-2023-31083)
• kernel: multiple out-of-bounds read vulnerabilities (CVE-2023-37453, CVE-2023-39189, CVE-2023-39193, CVE-2023-6121, CVE-2023-39194)
• kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP (CVE-2023-42756)
• kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write (CVE-2023-45863)
• kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)
• kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489)
• kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522)
• kernel: multiple memory leak vulnerabilities (CVE-2023-52529, CVE-2023-52581)
• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)
• kernel: net/core: kernel crash in ETH_P_1588 flow dissector (CVE-2023-52580)
• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)
• kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (CVE-2024-0565)
• kernel: tls: race between async notify and socket close (CVE-2024-26583)
• kernel: tls: handle backlogging of crypto requests (CVE-2024-26584)
• kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585)
• kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)
• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)
• kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)
• kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-26609)
• kernel: local dos vulnerability in scatterwalk_copychunks (CVE-2023-6176)
• kernel: perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476)
• kernel: netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620)
• kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() {CVE-2023-6176}
• wifi: mac80211: fix MBSSID parsing use-after-free {CVE-2022-42719}
• mac80211: always allocate struct ieee802_11_elems {CVE-2022-42719}
• x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2023-46813}
• x86/sev: Check IOBM for IOIO exceptions from user-space {CVE-2023-46813}
• x86/sev: Disable MMIO emulation from user mode {CVE-2023-46813}
• netfilter: nftables: exthdr: fix 4-byte stack OOB write {CVE-2023-4881}
• net: sched: sch_qfq: Fix UAF in qfq_dequeue() {CVE-2023-4921}
• netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c {CVE-2023-42753}
• net/sched: cls_tcindex: downgrade to imperfect hash {CVE-2023-1829}
• USB: ene_usb6250: Allocate enough memory for full object {CVE-2023-45862}
• igb: set max size RX buffer when store bad packet is enabled {CVE-2023-45871}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• nvmet-tcp: Fix a possible UAF in queue intialization setup {CVE-2023-5178}
• drm/qxl: fix UAF on handle creation {CVE-2023-39198}
• net: add kerneldoc comment for sk_peer_lock {CVE-2021-4203}
• af_unix: fix races in sk_peer_pid and sk_peer_cred accesses {CVE-2021-4203}
• block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern {CVE-2022-0494}
• media: ov519: add missing endpoint sanity checks {CVE-2020-11608}
• act_mirred: use the backlog for nested calls to mirred ingress {CVE-2022-4269}
• net/sched: act_mirred: better wording on protection against excessive stack growth {CVE-2022-4269}
• inet: use bigger hash table for IP ID generation {CVE-2021-45486}
• net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()" {CVE-2021-45486}

• net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() {CVE-2023-6176}
• wifi: mac80211: fix MBSSID parsing use-after-free {CVE-2022-42719}
• mac80211: always allocate struct ieee802_11_elems {CVE-2022-42719}
• x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2023-46813}
• x86/sev: Check IOBM for IOIO exceptions from user-space {CVE-2023-46813}
• x86/sev: Disable MMIO emulation from user mode {CVE-2023-46813}
• netfilter: nftables: exthdr: fix 4-byte stack OOB write {CVE-2023-4881}
• net: sched: sch_qfq: Fix UAF in qfq_dequeue() {CVE-2023-4921}
• netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c {CVE-2023-42753}
• net/sched: cls_tcindex: downgrade to imperfect hash {CVE-2023-1829}
• USB: ene_usb6250: Allocate enough memory for full object {CVE-2023-45862}
• igb: set max size RX buffer when store bad packet is enabled {CVE-2023-45871}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• nvmet-tcp: Fix a possible UAF in queue intialization setup {CVE-2023-5178}
• drm/qxl: fix UAF on handle creation {CVE-2023-39198}
• net: add kerneldoc comment for sk_peer_lock {CVE-2021-4203}
• af_unix: fix races in sk_peer_pid and sk_peer_cred accesses {CVE-2021-4203}
• block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern {CVE-2022-0494}
• media: ov519: add missing endpoint sanity checks {CVE-2020-11608}
• act_mirred: use the backlog for nested calls to mirred ingress {CVE-2022-4269}
• net/sched: act_mirred: better wording on protection against excessive stack growth {CVE-2022-4269}
• inet: use bigger hash table for IP ID generation {CVE-2021-45486}
• net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()" {CVE-2021-45486}

• net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() {CVE-2024-26882}
• tls: fix use-after-free on failed backlog decryption {CVE-2024-26800}
• tls: separate no-async decryption request handling from async {CVE-2024-26584}
• tls: decrement decrypt_pending if no async completion will be called {CVE-2024-26584}
• net: tls: fix use-after-free with partial reads and async decrypt {CVE-2024-26582}
• net: tls: handle backlogging of crypto requests {CVE-2024-26584}
• net: tls: factor out tls_*crypt_async_wait()
• tap: tap_open(): correctly initialize socket uid {CVE-2023-1076}
• tun: tun_chr_open(): correctly initialize socket uid {CVE-2023-1076}
• net: add sock_init_data_uid() {CVE-2023-1076}
• netfilter: nf_tables: bail out on mismatching dynset and set expressions {CVE-2023-6622}
• drm/qxl: fix UAF on handle creation {CVE-2023-39198}
• smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
• USB: core: Fix deadlock in port "disable" sysfs attribute {CVE-2024-26933}
• USB: core: Add hub_get() and hub_put() routines {CVE-2024-26933}
• USB: core: Fix deadlock in usb_deauthorize_interface() {CVE-2024-26934}
• scsi: qla2xxx: Fix double free of fcport {CVE-2024-26929}
• netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() {CVE-2024-27020}
• net: ip_tunnel: prevent perpetual headroom growth {CVE-2024-26804}
• netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout {CVE-2024-26643}
• netfilter: nf_tables: disallow anonymous set with timeout flag {CVE-2024-26642}
• netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations {CVE-2024-26673}
• ipv6: sr: fix possible use-after-free and null-ptr-deref {CVE-2024-26735}
• fs: sysfs: Fix reference leak in sysfs_break_active_protection() {CVE-2024-26993}
• cifs: fix underflow in parse_server_interfaces() {CVE-2024-26828}
• mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path {CVE-2024-26595}
• mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code {CVE-2024-26595}
• mlxsw: spectrum_acl_tcam: Make fini symmetric to init {CVE-2024-26595}
• mlxsw: spectrum_acl_tcam: Add missing mutex_destroy() {CVE-2024-26595}
• net: xfrm: Fix xfrm_address_filter OOB read {CVE-2023-39194}
• exfat: check if filename entries exceeds max filename length {CVE-2023-4273}
• xfrm: add NULL check in xfrm_update_ae_params {CVE-2023-3772}
• firmware: arm_scmi: Harden accesses to the reset domains {CVE-2022-48655}
• tcp: Reduce chance of collisions in inet6_hashfn(). {CVE-2023-1206}
• ipv4: fix null-deref in ipv4_link_failure {CVE-2023-42754}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2023-39189}
• netfilter: xt_sctp: validate the flag_info count {CVE-2023-39193}
• net: qcom/emac: Fix use after free bug in emac_remove due to race condition {CVE-2023-33203}
• net/tls: tls_is_tx_ready() checked list_entry {CVE-2023-1075}
• HID: asus: use spinlock to safely schedule workers {CVE-2023-1079}
• HID: asus: use spinlock to protect concurrent accesses {CVE-2023-1079}
• HID: intel_ish-hid: Add check for ishtp_dma_tx_map {CVE-2023-3358}
• gfs2: Don't deref jdesc in evict {CVE-2023-3212}
• fbcon: Check font dimension limits {CVE-2023-3161}
• KVM: nVMX: add missing consistency checks for CR0 and CR4 {CVE-2023-30456}
• hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition {CVE-2023-1855}
• Bluetooth: HCI: Fix global-out-of-bounds {CVE-2023-28866}
• HID: check empty report_list in hid_validate_values() {CVE-2023-1073}
• net: mpls: fix stale pointer if allocation fails during device rename {CVE-2023-26545}
• r8152: Rate limit overflow messages {CVE-2022-3594}
• drm/vmwgfx: Fix shader stage validation {CVE-2022-36402}
• Bluetooth: L2CAP: Fix attempting to access uninitialized memory {CVE-2022-42895}
• dm ioctl: fix nested locking in table_clear() to remove deadlock concern {CVE-2023-2269}
• mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy() {CVE-2023-52562} -…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).
• CVE-2023-2006: Fixed a race condition in the RxRPC network protocol (bsc#1210447).
• CVE-2023-5633: Fixed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface (bsc#1216527).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in drivers/net/usb/lan78xx.c (bsc#1217068).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in drivers/vhost/vringh.c in the host side of a virtio ring (bsc#1215710).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-25775: Fixed improper access control in the Intel Ethernet Controller RDMA driver (bsc#1216959).
• CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo() (bsc#1216693).

The following non-security bugs were fixed:

• ACPI: FPDT: properly handle invalid FPDT subtables (git-fixes).
• ACPI: resource: Do IRQ override on TongFang GMxXGxx (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA (git-fixes).
• ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() (git-fixes).
• ALSA: hda/realtek - ALC287 Realtek I2S speaker platform support (git-fixes).
• ALSA: hda/realtek - Add Dell ALC295 to pin fall back table (git-fixes).
• ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS UX7602ZM (git-fixes).
• ALSA: hda/realtek: Add quirks for ASUS 2024 Zenbooks (git-fixes).
• ALSA: hda/realtek: Add quirks for HP Laptops (git-fixes).
• ALSA: hda/realtek: Add support dual speaker for Dell (git-fixes).
• ALSA: hda/realtek: Enable Mute LED on HP 255 G10 (git-fixes).
• ALSA: hda/realtek: Enable Mute LED on HP 255 G8 (git-fixes).
• ALSA: hda: ASUS UM5302LA: Added quirks for cs35L41/10431A83 on i2c bus (git-fixes).
• ALSA: hda: Disable power-save on KONTRON SinglePC (bsc#1217140).
• ALSA: hda: Fix possible null-ptr-deref when assigning a stream (git-fixes).
• ALSA: hda: cs35l41: Fix unbalanced pm_runtime_get() (git-fixes).
• ALSA: hda: cs35l41: Undo runtime PM changes at driver exit time (git-fixes).
• ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection (git-fixes).
• ALSA: info: Fix potential deadlock at disconnection (git-fixes).
• ALSA: usb-audio: add quirk flag to enable native DSD for McIntosh devices (git-fixes).
• ARM: 9321/1: memset: cast the constant byte to unsigned char (git-fixes).
• ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails (git-fixes).
• ASoC: SOF: core: Ensure sof_ops_free() is still called when probe never ran (git-fixes).
• ASoC: ams-delta.c: use component after check (git-fixes).
• ASoC: codecs: wsa-macro: fix uninitialized stack variables with name prefix (git-fixes).
• ASoC: cs35l41: Undo runtime PM changes at driver exit time (git-fixes).
• ASoC: cs35l41: Verify PM runtime resume errors in IRQ handler (git-fixes).
• ASoC: fsl: Fix PM disable depth imbalance in fsl_easrc_probe (git-fixes).
• ASoC: fsl: mpc5200_dma.c: Fix warning of Function parameter or member not described (git-fixes).
• ASoC: hdmi-codec: register hpd callback on component probe (git-fixes).
• ASoC: rt5650: fix the wrong result…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).
• CVE-2023-2006: Fixed a race condition in the RxRPC network protocol (bsc#1210447).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in drivers/net/usb/lan78xx.c (bsc#1217068).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in drivers/vhost/vringh.c in the host side of a virtio ring (bsc#1215710).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-25775: Fixed improper access control in the Intel Ethernet Controller RDMA driver (bsc#1216959).
• CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo() (bsc#1216693).

The following non-security bugs were fixed:

• ACPI: FPDT: properly handle invalid FPDT subtables (git-fixes).
• ACPI: resource: Do IRQ override on TongFang GMxXGxx (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA (git-fixes).
• ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() (git-fixes).
• ALSA: hda/realtek - Add Dell ALC295 to pin fall back table (git-fixes).
• ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC (git-fixes).
• ALSA: hda/realtek: Add quirks for HP Laptops (git-fixes).
• ALSA: hda/realtek: Enable Mute LED on HP 255 G10 (git-fixes).
• ALSA: hda/realtek: Enable Mute LED on HP 255 G8 (git-fixes).
• ALSA: hda: Disable power-save on KONTRON SinglePC (bsc#1217140).
• ALSA: hda: Fix possible null-ptr-deref when assigning a stream (git-fixes).
• ALSA: hda: cs35l41: Fix unbalanced pm_runtime_get() (git-fixes).
• ALSA: hda: cs35l41: Undo runtime PM changes at driver exit time (git-fixes).
• ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection (git-fixes).
• ALSA: info: Fix potential deadlock at disconnection (git-fixes).
• ARM: 9321/1: memset: cast the constant byte to unsigned char (git-fixes).
• ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails (git-fixes).
• ASoC: ams-delta.c: use component after check (git-fixes).
• ASoC: codecs: wsa-macro: fix uninitialized stack variables with name prefix (git-fixes).
• ASoC: cs35l41: Undo runtime PM changes at driver exit time (git-fixes).
• ASoC: cs35l41: Verify PM runtime resume errors in IRQ handler (git-fixes).
• ASoC: fsl: Fix PM disable depth imbalance in fsl_easrc_probe (git-fixes).
• ASoC: fsl: mpc5200_dma.c: Fix warning of Function parameter or member not described (git-fixes).
• ASoC: hdmi-codec: register hpd callback on component probe (git-fixes).
• ASoC: rt5650: fix the wrong result of key button (git-fixes).
• ASoC: simple-card: fixup asoc_simple_probe() error handling (git-fixes).
• ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings (git-fixes).
• Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE (git-fixes).
• Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables (git-fixes).
• Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559 (git-fixes).
• Bluetooth: btusb: Add date->evt_skb is NULL check (git-fixes).
• Disable Loongson drivers Loongson is a mips architecture, it does not make sense to build Loongson drivers on other architectures.
• Documentation: networking: correct possessive 'its' (bsc#1215458).
• Drivers:…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2006: Fixed a race condition in the RxRPC network protocol (bsc#1210447).
• CVE-2023-25775: Fixed improper access control in the Intel Ethernet Controller RDMA driver (bsc#1216959).
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-46813: Fixed SEV-ES local priv escalation (bsc#1212649).
• CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo() (bsc#1216693).
• CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in drivers/vhost/vringh.c in the host side of a virtio ring (bsc#1215710).
• CVE-2023-5633: Fixed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface (bsc#1216527).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in drivers/net/usb/lan78xx.c (bsc#1217068).
• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).

The following non-security bugs were fixed:

• acpi: fpdt: properly handle invalid fpdt subtables (git-fixes).
• acpi: resource: do irq override on tongfang gmxxgxx (git-fixes).
• acpi: resource: skip irq override on asus expertbook b1402cva (git-fixes).
• acpi: sysfs: fix create_pnp_modalias() and create_of_modalias() (git-fixes).
• alsa: hda/realtek - add dell alc295 to pin fall back table (git-fixes).
• alsa: hda/realtek - alc287 realtek i2s speaker platform support (git-fixes).
• alsa: hda/realtek - enable internal speaker of asus k6500zc (git-fixes).
• alsa: hda/realtek: add quirk for asus ux7602zm (git-fixes).
• alsa: hda/realtek: add quirks for asus 2024 zenbooks (git-fixes).
• alsa: hda/realtek: add quirks for hp laptops (git-fixes).
• alsa: hda/realtek: add support dual speaker for dell (git-fixes).
• alsa: hda/realtek: enable mute led on hp 255 g10 (git-fixes).
• alsa: hda/realtek: enable mute led on hp 255 g8 (git-fixes).
• alsa: hda: asus um5302la: added quirks for cs35l41/10431a83 on i2c bus (git-fixes).
• alsa: hda: cs35l41: fix unbalanced pm_runtime_get() (git-fixes).
• alsa: hda: cs35l41: undo runtime pm changes at driver exit time (git-fixes).
• alsa: hda: disable power-save on kontron singlepc (bsc#1217140).
• alsa: hda: fix possible null-ptr-deref when assigning a stream (git-fixes).
• alsa: hda: intel-dsp-config: fix jsl chromebook quirk detection (git-fixes).
• alsa: info: fix potential deadlock at disconnection (git-fixes).
• alsa: usb-audio: add quirk flag to enable native dsd for mcintosh devices (git-fixes).
• arm/xen: fix xen_vcpu_info allocation alignment (git-fixes).
• arm64: add cortex-a520 cpu part definition (git-fixes)
• arm64: allow kprobes on el0 handlers (git-fixes)
• arm64: armv8_deprecated move emulation functions (git-fixes)
• arm64: armv8_deprecated: fix unused-function error (git-fixes)
• arm64: armv8_deprecated: fold ops into insn_emulation (git-fixes)
• arm64: armv8_deprecated: move aarch32 helper earlier (git-fixes)
• arm64: armv8_deprecated: rework deprected instruction handling (git-fixes)
• arm64: consistently pass esr_elx to die() (git-fixes)
• arm64: die(): pass 'err' as…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).

The following non-security bugs were fixed:

• ALSA: hda: Disable power-save on KONTRON SinglePC (bsc#1217140).
• Call flush_delayed_fput() from nfsd main-loop (bsc#1217408).
• net: mana: Configure hwc timeout from hardware (bsc#1214037).
• net: mana: Fix MANA VF unload when hardware is unresponsive (bsc#1214764).
• powerpc: Do not clobber f0/vs0 during fp|altivec register save (bsc#1217780).

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2006: Fixed a race condition in the RxRPC network protocol (bsc#1210447).
• CVE-2023-25775: Fixed improper access control in the Intel Ethernet Controller RDMA driver (bsc#1216959).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo() (bsc#1216693).
• CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in drivers/vhost/vringh.c in the host side of a virtio ring (bsc#1215710).
• CVE-2023-5633: Fixed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface (bsc#1216527).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in drivers/net/usb/lan78xx.c (bsc#1217068).
• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).

The following non-security bugs were fixed:

• acpi: fpdt: properly handle invalid fpdt subtables (git-fixes).
• acpi: resource: do irq override on tongfang gmxxgxx (git-fixes).
• acpi: resource: skip irq override on asus expertbook b1402cva (git-fixes).
• acpi: sysfs: fix create_pnp_modalias() and create_of_modalias() (git-fixes).
• alsa: hda/realtek - add dell alc295 to pin fall back table (git-fixes).
• alsa: hda/realtek - alc287 realtek i2s speaker platform support (git-fixes).
• alsa: hda/realtek - enable internal speaker of asus k6500zc (git-fixes).
• alsa: hda/realtek: add quirk for asus ux7602zm (git-fixes).
• alsa: hda/realtek: add quirks for asus 2024 zenbooks (git-fixes).
• alsa: hda/realtek: add quirks for hp laptops (git-fixes).
• alsa: hda/realtek: add support dual speaker for dell (git-fixes).
• alsa: hda/realtek: enable mute led on hp 255 g10 (git-fixes).
• alsa: hda/realtek: enable mute led on hp 255 g8 (git-fixes).
• alsa: hda: asus um5302la: added quirks for cs35l41/10431a83 on i2c bus (git-fixes).
• alsa: hda: cs35l41: fix unbalanced pm_runtime_get() (git-fixes).
• alsa: hda: cs35l41: undo runtime pm changes at driver exit time (git-fixes).
• alsa: hda: disable power-save on kontron singlepc (bsc#1217140).
• alsa: hda: fix possible null-ptr-deref when assigning a stream (git-fixes).
• alsa: hda: intel-dsp-config: fix jsl chromebook quirk detection (git-fixes).
• alsa: info: fix potential deadlock at disconnection (git-fixes).
• alsa: usb-audio: add quirk flag to enable native dsd for mcintosh devices (git-fixes).
• arm/xen: fix xen_vcpu_info allocation alignment (git-fixes).
• arm64: add cortex-a520 cpu part definition (git-fixes)
• arm64: allow kprobes on el0 handlers (git-fixes)
• arm64: armv8_deprecated move emulation functions (git-fixes)
• arm64: armv8_deprecated: fix unused-function error (git-fixes)
• arm64: armv8_deprecated: fold ops into insn_emulation (git-fixes)
• arm64: armv8_deprecated: move aarch32 helper earlier (git-fixes)
• arm64: armv8_deprecated: rework deprected instruction handling (git-fixes)
• arm64: consistently pass esr_elx to die() (git-fixes)
• arm64: die(): pass 'err' as long (git-fixes)
• arm64: factor insn read out of call_undef_hook() (git-fixes)
• arm64: factor out el1 ssbs emulation hook (git-fixes)
• arm64: report el1 undefs better (git-fixes)
• arm64: rework bti exception handling…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).

The following non-security bugs were fixed:

• cpu/SMT: Allow enabling partial SMT states via sysfs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• cpu/SMT: Create topology_smt_thread_allowed() (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• cpu/SMT: Move SMT prototypes into cpu_smt.h (bsc#1214408).
• cpu/SMT: Move smt/control simple exit cases earlier (bsc#1214408).
• cpu/SMT: Remove topology_smt_supported() (bsc#1214408).
• cpu/SMT: Store the current/max number of threads (bsc#1214408).
• cpu/hotplug: Create SMT sysfs interface for all arches (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• dm-raid: remove useless checking in raid_message() (git-fixes).
• l2tp: fix refcount leakage on PPPoL2TP sockets (git-fixes).
• l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow (git-fixes).
• md/bitmap: always wake up md_thread in timeout_store (git-fixes).
• md/bitmap: factor out a helper to set timeout (git-fixes).
• md/raid10: Do not add spare disk when recovery fails (git-fixes).
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter (git-fixes).
• md/raid10: clean up md_add_new_disk() (git-fixes).
• md/raid10: fix io loss while replacement replace rdev (git-fixes).
• md/raid10: fix leak of 'r10bio->remaining' for recovery (git-fixes).
• md/raid10: fix memleak for 'conf->bio_split' (git-fixes).
• md/raid10: fix memleak of md thread (git-fixes).
• md/raid10: fix null-ptr-deref in raid10_sync_request (git-fixes).
• md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request (git-fixes).
• md/raid10: fix overflow of md/safe_mode_delay (git-fixes).
• md/raid10: fix wrong setting of max_corr_read_errors (git-fixes).
• md/raid10: improve code of mrdev in raid10_sync_request (git-fixes).
• md/raid10: prevent soft lockup while flush writes (git-fixes).
• md/raid10: prioritize adding disk to 'removed' mirror (git-fixes).
• md: Flush workqueue md_rdev_misc_wq in md_alloc() (git-fixes).
• md: add new workqueue for delete rdev (git-fixes).
• md: avoid signed overflow in slot_store() (git-fixes).
• md: do not return existing mddevs from mddev_find_or_alloc (git-fixes).
• md: factor out a mddev_alloc_unit helper from mddev_find (git-fixes).
• md: fix data corruption for raid456 when reshape restart while grow up (git-fixes).
• md: fix deadlock causing by sysfs_notify (git-fixes).
• md: fix incorrect declaration about claim_rdev in md_import_device (git-fixes).
• md: flush md_rdev_misc_wq for HOT_ADD_DISK case (git-fixes).
• md: get sysfs entry after redundancy attr group create (git-fixes).
• md: refactor mddev_find_or_alloc (git-fixes).
• md: remove lock_bdev / unlock_bdev (git-fixes).
• mm, memcg: add mem_cgroup_disabled checks in vmpressure and swap-related functions (bsc#1190208 (MM functional and performance backports) bsc#1216759).
• net-memcg: Fix scope of sockmem pressure indicators (bsc#1216759).
• net: mana: Configure hwc timeout from hardware (bsc#1214037).
• net: mana: Fix MANA VF unload when hardware is unresponsive (bsc#1214764).
• powerpc/pseries: Honour current SMT state when DLPAR onlining CPUs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• powerpc/pseries: Initialise CPU hotplug…

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2006: Fixed a race condition in the RxRPC network protocol (bsc#1210447).
• CVE-2023-25775: Fixed improper access control in the Intel Ethernet Controller RDMA driver (bsc#1216959).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo() (bsc#1216693).
• CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in drivers/vhost/vringh.c in the host side of a virtio ring (bsc#1215710).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in drivers/net/usb/lan78xx.c (bsc#1217068).
• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).

The following non-security bugs were fixed:

• acpi: fpdt: properly handle invalid fpdt subtables (git-fixes).
• acpi: resource: do irq override on tongfang gmxxgxx (git-fixes).
• acpi: resource: skip irq override on asus expertbook b1402cva (git-fixes).
• acpi: sysfs: fix create_pnp_modalias() and create_of_modalias() (git-fixes).
• alsa: hda/realtek - add dell alc295 to pin fall back table (git-fixes).
• alsa: hda/realtek - enable internal speaker of asus k6500zc (git-fixes).
• alsa: hda/realtek: add quirks for hp laptops (git-fixes).
• alsa: hda/realtek: enable mute led on hp 255 g10 (git-fixes).
• alsa: hda/realtek: enable mute led on hp 255 g8 (git-fixes).
• alsa: hda: cs35l41: fix unbalanced pm_runtime_get() (git-fixes).
• alsa: hda: cs35l41: undo runtime pm changes at driver exit time (git-fixes).
• alsa: hda: disable power-save on kontron singlepc (bsc#1217140).
• alsa: hda: fix possible null-ptr-deref when assigning a stream (git-fixes).
• alsa: hda: intel-dsp-config: fix jsl chromebook quirk detection (git-fixes).
• alsa: info: fix potential deadlock at disconnection (git-fixes).
• arm/xen: fix xen_vcpu_info allocation alignment (git-fixes).
• arm64: add cortex-a520 cpu part definition (git-fixes)
• arm64: allow kprobes on el0 handlers (git-fixes)
• arm64: armv8_deprecated move emulation functions (git-fixes)
• arm64: armv8_deprecated: fix unused-function error (git-fixes)
• arm64: armv8_deprecated: fold ops into insn_emulation (git-fixes)
• arm64: armv8_deprecated: move aarch32 helper earlier (git-fixes)
• arm64: armv8_deprecated: rework deprected instruction handling (git-fixes)
• arm64: consistently pass esr_elx to die() (git-fixes)
• arm64: die(): pass 'err' as long (git-fixes)
• arm64: factor insn read out of call_undef_hook() (git-fixes)
• arm64: factor out el1 ssbs emulation hook (git-fixes)
• arm64: report el1 undefs better (git-fixes)
• arm64: rework bti exception handling (git-fixes)
• arm64: rework el0 mrs emulation (git-fixes)
• arm64: rework fpac exception handling (git-fixes)
• arm64: split el0/el1 undef handlers (git-fixes)
• arm: 9321/1: memset: cast the constant byte to unsigned char (git-fixes).
• asoc: ams-delta.c: use component after check (git-fixes).
• asoc: codecs: wsa-macro: fix uninitialized stack variables with name prefix (git-fixes).
• asoc: cs35l41: undo runtime pm changes at driver exit time (git-fixes).
• asoc: cs35l41: verify pm runtime resume errors in irq handler (git-fixes).
• asoc: fsl: fix pm disable depth imbalance in…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).

The following non-security bugs were fixed:

• net: mana: Configure hwc timeout from hardware (bsc#1214037).
• net: mana: Fix MANA VF unload when hardware is unresponsive (bsc#1214764).
• powerpc: Do not clobber f0/vs0 during fp|altivec register save (bsc#1217780).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).

The following non-security bugs were fixed:

• USB: serial: option: add Quectel RM500U-CN modem (git-fixes).
• USB: serial: option: add Telit FE990 compositions (git-fixes).
• USB: serial: option: add UNISOC vendor and TOZED LT70C product (git-fixes).
• cpu/SMT: Allow enabling partial SMT states via sysfs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• cpu/SMT: Create topology_smt_thread_allowed() (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• cpu/SMT: Move SMT prototypes into cpu_smt.h (bsc#1214408).
• cpu/SMT: Move smt/control simple exit cases earlier (bsc#1214408).
• cpu/SMT: Remove topology_smt_supported() (bsc#1214408).
• cpu/SMT: Store the current/max number of threads (bsc#1214408).
• cpu/hotplug: Create SMT sysfs interface for all arches (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• dm-raid: remove useless checking in raid_message() (git-fixes).
• l2tp: fix refcount leakage on PPPoL2TP sockets (git-fixes).
• l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow (git-fixes).
• md/bitmap: always wake up md_thread in timeout_store (git-fixes).
• md/bitmap: factor out a helper to set timeout (git-fixes).
• md/raid10: Do not add spare disk when recovery fails (git-fixes).
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter (git-fixes).
• md/raid10: clean up md_add_new_disk() (git-fixes).
• md/raid10: fix io loss while replacement replace rdev (git-fixes).
• md/raid10: fix leak of 'r10bio->remaining' for recovery (git-fixes).
• md/raid10: fix memleak for 'conf->bio_split' (git-fixes).
• md/raid10: fix memleak of md thread (git-fixes).
• md/raid10: fix null-ptr-deref in raid10_sync_request (git-fixes).
• md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request (git-fixes).
• md/raid10: fix overflow of md/safe_mode_delay (git-fixes).
• md/raid10: fix wrong setting of max_corr_read_errors (git-fixes).
• md/raid10: improve code of mrdev in raid10_sync_request (git-fixes).
• md/raid10: prevent soft lockup while flush writes (git-fixes).
• md/raid10: prioritize adding disk to 'removed' mirror (git-fixes).
• md: Flush workqueue md_rdev_misc_wq in md_alloc() (git-fixes).
• md: add new workqueue for delete rdev (git-fixes).
• md: avoid signed overflow in slot_store() (git-fixes).
• md: do not return existing mddevs from mddev_find_or_alloc (git-fixes).
• md: factor out a mddev_alloc_unit helper from mddev_find (git-fixes).
• md: fix data corruption for raid456 when reshape restart while grow up (git-fixes).
• md: fix deadlock causing by sysfs_notify (git-fixes).
• md: fix incorrect declaration about claim_rdev in md_import_device (git-fixes).
• md: flush md_rdev_misc_wq for HOT_ADD_DISK case (git-fixes).
• md: get sysfs entry after redundancy attr group create (git-fixes).
• md: refactor mddev_find_or_alloc (git-fixes).
• md: remove lock_bdev / unlock_bdev (git-fixes).
• mm, memcg: add mem_cgroup_disabled checks in vmpressure and swap-related functions (bsc#1190208 (MM functional and performance backports) bsc#1216759).
• net-memcg: Fix scope of sockmem pressure indicators (bsc#1216759).
• net: mana: Configure hwc timeout from hardware (bsc#1214037).
• net: mana: Fix MANA VF unload…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).
• CVE-2023-2006: Fixed a race condition in the RxRPC network protocol (bsc#1210447).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in drivers/net/usb/lan78xx.c (bsc#1217068).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in drivers/vhost/vringh.c in the host side of a virtio ring (bsc#1215710).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-25775: Fixed improper access control in the Intel Ethernet Controller RDMA driver (bsc#1216959).
• CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo() (bsc#1216693).

The following non-security bugs were fixed:

• ACPI: FPDT: properly handle invalid FPDT subtables (git-fixes).
• ACPI: resource: Do IRQ override on TongFang GMxXGxx (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA (git-fixes).
• ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() (git-fixes).
• ALSA: hda/realtek - Add Dell ALC295 to pin fall back table (git-fixes).
• ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC (git-fixes).
• ALSA: hda/realtek: Add quirks for HP Laptops (git-fixes).
• ALSA: hda/realtek: Enable Mute LED on HP 255 G10 (git-fixes).
• ALSA: hda/realtek: Enable Mute LED on HP 255 G8 (git-fixes).
• ALSA: hda: Disable power-save on KONTRON SinglePC (bsc#1217140).
• ALSA: hda: Fix possible null-ptr-deref when assigning a stream (git-fixes).
• ALSA: hda: cs35l41: Fix unbalanced pm_runtime_get() (git-fixes).
• ALSA: hda: cs35l41: Undo runtime PM changes at driver exit time (git-fixes).
• ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection (git-fixes).
• ALSA: info: Fix potential deadlock at disconnection (git-fixes).
• ARM: 9321/1: memset: cast the constant byte to unsigned char (git-fixes).
• ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails (git-fixes).
• ASoC: ams-delta.c: use component after check (git-fixes).
• ASoC: codecs: wsa-macro: fix uninitialized stack variables with name prefix (git-fixes).
• ASoC: cs35l41: Undo runtime PM changes at driver exit time (git-fixes).
• ASoC: cs35l41: Verify PM runtime resume errors in IRQ handler (git-fixes).
• ASoC: fsl: Fix PM disable depth imbalance in fsl_easrc_probe (git-fixes).
• ASoC: fsl: mpc5200_dma.c: Fix warning of Function parameter or member not described (git-fixes).
• ASoC: hdmi-codec: register hpd callback on component probe (git-fixes).
• ASoC: rt5650: fix the wrong result of key button (git-fixes).
• ASoC: simple-card: fixup asoc_simple_probe() error handling (git-fixes).
• ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings (git-fixes).
• Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE (git-fixes).
• Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables (git-fixes).
• Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559 (git-fixes).
• Bluetooth: btusb: Add date->evt_skb is NULL check (git-fixes).
• Drivers: hv: vmbus: Remove unused extern declaration vmbus_ontimer() (git-fixes).
• HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W (git-fixes).
• HID: hyperv: Replace one-element array with…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).

The following non-security bugs were fixed:

• ALSA: hda: Disable power-save on KONTRON SinglePC (bsc#1217140).
• Call flush_delayed_fput() from nfsd main-loop (bsc#1217408).
• net: mana: Configure hwc timeout from hardware (bsc#1214037).
• net: mana: Fix MANA VF unload when hardware is unresponsive (bsc#1214764).
• powerpc: Do not clobber f0/vs0 during fp|altivec register save (bsc#1217780).

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).

The following non-security bugs were fixed:

• cpu/SMT: Allow enabling partial SMT states via sysfs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• cpu/SMT: Create topology_smt_thread_allowed() (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• cpu/SMT: Move SMT prototypes into cpu_smt.h (bsc#1214408).
• cpu/SMT: Move smt/control simple exit cases earlier (bsc#1214408).
• cpu/SMT: Remove topology_smt_supported() (bsc#1214408).
• cpu/SMT: Store the current/max number of threads (bsc#1214408).
• cpu/hotplug: Create SMT sysfs interface for all arches (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• dm-raid: remove useless checking in raid_message() (git-fixes).
• l2tp: fix refcount leakage on PPPoL2TP sockets (git-fixes).
• l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow (git-fixes).
• md/bitmap: always wake up md_thread in timeout_store (git-fixes).
• md/bitmap: factor out a helper to set timeout (git-fixes).
• md/raid10: Do not add spare disk when recovery fails (git-fixes).
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter (git-fixes).
• md/raid10: clean up md_add_new_disk() (git-fixes).
• md/raid10: fix io loss while replacement replace rdev (git-fixes).
• md/raid10: fix leak of 'r10bio->remaining' for recovery (git-fixes).
• md/raid10: fix memleak for 'conf->bio_split' (git-fixes).
• md/raid10: fix memleak of md thread (git-fixes).
• md/raid10: fix null-ptr-deref in raid10_sync_request (git-fixes).
• md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request (git-fixes).
• md/raid10: fix overflow of md/safe_mode_delay (git-fixes).
• md/raid10: fix wrong setting of max_corr_read_errors (git-fixes).
• md/raid10: improve code of mrdev in raid10_sync_request (git-fixes).
• md/raid10: prevent soft lockup while flush writes (git-fixes).
• md/raid10: prioritize adding disk to 'removed' mirror (git-fixes).
• md: Flush workqueue md_rdev_misc_wq in md_alloc() (git-fixes).
• md: add new workqueue for delete rdev (git-fixes).
• md: avoid signed overflow in slot_store() (git-fixes).
• md: do not return existing mddevs from mddev_find_or_alloc (git-fixes).
• md: factor out a mddev_alloc_unit helper from mddev_find (git-fixes).
• md: fix data corruption for raid456 when reshape restart while grow up (git-fixes).
• md: fix deadlock causing by sysfs_notify (git-fixes).
• md: fix incorrect declaration about claim_rdev in md_import_device (git-fixes).
• md: flush md_rdev_misc_wq for HOT_ADD_DISK case (git-fixes).
• md: get sysfs entry after redundancy attr group create (git-fixes).
• md: refactor mddev_find_or_alloc (git-fixes).
• md: remove lock_bdev / unlock_bdev (git-fixes).
• mm, memcg: add mem_cgroup_disabled checks in vmpressure and swap-related functions (bsc#1190208 (MM functional and performance backports) bsc#1216759).
• net-memcg: Fix scope of sockmem pressure indicators (bsc#1216759).
• net: mana: Configure hwc timeout from hardware (bsc#1214037).
• net: mana: Fix MANA VF unload when hardware is unresponsive (bsc#1214764).
• powerpc/pseries: Honour current SMT state when DLPAR onlining CPUs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
• powerpc/pseries: Initialise CPU…

This update for the Linux Kernel 5.14.21-150500_13_11 fixes several issues.

The following security issues were fixed:

• CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be exploited to achieve local privilege escalation (bsc#1215300).
• CVE-2023-39198: Fixed a race condition leading to a use-after-free in qxl_mode_dumb_create() (bsc#1217116).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218733).

This update for the Linux Kernel 5.14.21-150500_11 fixes several issues.

The following security issues were fixed:

• CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be exploited to achieve local privilege escalation (bsc#1215300).
• CVE-2023-39198: Fixed a race condition leading to a use-after-free in qxl_mode_dumb_create() (bsc#1217116).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218733).

This update for the Linux Kernel 5.3.18-150200_24_166 fixes several issues.

The following security issues were fixed:

• CVE-2023-39198: Fixed a race condition leading to a use-after-free in qxl_mode_dumb_create() (bsc#1217116).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218733).

This update for the Linux Kernel 5.14.21-150400_24_63 fixes several issues.

The following security issues were fixed:

• CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be exploited to achieve local privilege escalation (bsc#1215300).
• CVE-2023-39198: Fixed a race condition leading to a use-after-free in qxl_mode_dumb_create() (bsc#1217116).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218733).

This update for the Linux Kernel 5.14.21-150500_55_19 fixes several issues.

The following security issues were fixed:

• CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be exploited to achieve local privilege escalation (bsc#1215300).
• CVE-2023-39198: Fixed a race condition leading to a use-after-free in qxl_mode_dumb_create() (bsc#1217116).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218733).

This update for the Linux Kernel 5.3.18-150300_59_138 fixes several issues.

The following security issues were fixed:

• CVE-2023-39198: Fixed a race condition leading to a use-after-free in qxl_mode_dumb_create() (bsc#1217116).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218733).

This update for the Linux Kernel 5.14.21-150500_55_7 fixes several issues.

The following security issues were fixed:

• CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be exploited to achieve local privilege escalation (bsc#1215300).
• CVE-2023-39198: Fixed a race condition leading to a use-after-free in qxl_mode_dumb_create() (bsc#1217116).
• CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218733).

It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors in certain situations, leading to a out-of-bounds read vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-37453)

Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly initialize a policy data structure, leading to an out-of-bounds vulnerability. A local privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3773)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did not properly validate u32 packets content, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39192)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate SCTP data, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39193)

Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly handle state filters, leading to an out- of-bounds read vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39194)

It was discovered that a race condition existed in QXL virtual GPU driver in the Linux kernel, leading to a use after free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-39198)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference vulnerability. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-42754)

Jason Wang discovered that the virtio ring implementation in the Linux kernel did not properly handle iov buffers in some situations. A local attacker in a guest VM could use this to cause a denial of service (host system crash). (CVE-2023-5158)

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly handle queue initialization failures in certain situations, leading to a use-after-free vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5178)

Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

It was discovered that the Microchip USB Ethernet driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-6039)

It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors in certain situations, leading to a out-of-bounds read vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-37453)

Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly initialize a policy data structure, leading to an out-of-bounds vulnerability. A local privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3773)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did not properly validate u32 packets content, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39192)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate SCTP data, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39193)

Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly handle state filters, leading to an out- of-bounds read vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39194)

It was discovered that a race condition existed in QXL virtual GPU driver in the Linux kernel, leading to a use after free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-39198)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference vulnerability. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-42754)

Jason Wang discovered that the virtio ring implementation in the Linux kernel did not properly handle iov buffers in some situations. A local attacker in a guest VM could use this to cause a denial of service (host system crash). (CVE-2023-5158)

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly handle queue initialization failures in certain situations, leading to a use-after-free vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5178)

Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

It was discovered that the Microchip USB Ethernet driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-6039)

It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors in certain situations, leading to a out-of-bounds read vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-37453)

Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly initialize a policy data structure, leading to an out-of-bounds vulnerability. A local privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3773)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did not properly validate u32 packets content, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39192)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate SCTP data, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39193)

Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly handle state filters, leading to an out- of-bounds read vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39194)

It was discovered that a race condition existed in QXL virtual GPU driver in the Linux kernel, leading to a use after free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-39198)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference vulnerability. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-42754)

Jason Wang discovered that the virtio ring implementation in the Linux kernel did not properly handle iov buffers in some situations. A local attacker in a guest VM could use this to cause a denial of service (host system crash). (CVE-2023-5158)

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly handle queue initialization failures in certain situations, leading to a use-after-free vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5178)

Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors in certain situations, leading to a out-of-bounds read vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-37453)

Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly initialize a policy data structure, leading to an out-of-bounds vulnerability. A local privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3773)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did not properly validate u32 packets content, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39192)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate SCTP data, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39193)

Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly handle state filters, leading to an out- of-bounds read vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39194)

It was discovered that a race condition existed in QXL virtual GPU driver in the Linux kernel, leading to a use after free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-39198)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference vulnerability. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-42754)

Jason Wang discovered that the virtio ring implementation in the Linux kernel did not properly handle iov buffers in some situations. A local attacker in a guest VM could use this to cause a denial of service (host system crash). (CVE-2023-5158)

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly handle queue initialization failures in certain situations, leading to a use-after-free vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5178)

Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors in certain situations, leading to a out-of-bounds read vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-37453)

Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly initialize a policy data structure, leading to an out-of-bounds vulnerability. A local privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3773)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did not properly validate u32 packets content, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39192)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate SCTP data, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39193)

Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly handle state filters, leading to an out- of-bounds read vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39194)

It was discovered that a race condition existed in QXL virtual GPU driver in the Linux kernel, leading to a use after free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-39198)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference vulnerability. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-42754)

Jason Wang discovered that the virtio ring implementation in the Linux kernel did not properly handle iov buffers in some situations. A local attacker in a guest VM could use this to cause a denial of service (host system crash). (CVE-2023-5158)

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly handle queue initialization failures in certain situations, leading to a use-after-free vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5178)

Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors in certain situations, leading to a out-of-bounds read vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-37453)

Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly initialize a policy data structure, leading to an out-of-bounds vulnerability. A local privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3773)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did not properly validate u32 packets content, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39192)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate SCTP data, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39193)

Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly handle state filters, leading to an out- of-bounds read vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39194)

It was discovered that a race condition existed in QXL virtual GPU driver in the Linux kernel, leading to a use after free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-39198)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference vulnerability. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-42754)

Jason Wang discovered that the virtio ring implementation in the Linux kernel did not properly handle iov buffers in some situations. A local attacker in a guest VM could use this to cause a denial of service (host system crash). (CVE-2023-5158)

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly handle queue initialization failures in certain situations, leading to a use-after-free vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5178)

Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors in certain situations, leading to a out-of-bounds read vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-37453)

Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly initialize a policy data structure, leading to an out-of-bounds vulnerability. A local privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3773)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did not properly validate u32 packets content, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39192)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate SCTP data, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39193)

Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly handle state filters, leading to an out- of-bounds read vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39194)

It was discovered that a race condition existed in QXL virtual GPU driver in the Linux kernel, leading to a use after free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-39198)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference vulnerability. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-42754)

Jason Wang discovered that the virtio ring implementation in the Linux kernel did not properly handle iov buffers in some situations. A local attacker in a guest VM could use this to cause a denial of service (host system crash). (CVE-2023-5158)

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly handle queue initialization failures in certain situations, leading to a use-after-free vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5178)

Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)