CVE-2021-47383

tty: Fix out-of-bound vmalloc access in imageblit

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

tty: Fix out-of-bound vmalloc access in imageblit

This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values.

If this struct is the same as the previous ioctl, the vc_resize() detects it and doesn't call the resize_screen(), leaving the fb_var_screeninfo incomplete. And this leads to the updatescrollmode() calculates a wrong value to fbcon_display->vrows, which makes the real_y() return a wrong value of y, and that value, eventually, causes the imageblit to access an out-of-bound address value.

To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.27%Up 0.2 points since May 22, 2024

What each source reports

CVE List Score used 7.8

tty: Fix out-of-bound vmalloc access in imageblit

In the Linux kernel, the following vulnerability has been resolved:

tty: Fix out-of-bound vmalloc access in imageblit

This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values.

To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.

Record: CVE-2021-47383
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2021-34388 7.8

In the Linux kernel, the following vulnerability has been resolved:

tty: Fix out-of-bound vmalloc access in imageblit

This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values.

To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.

Record: EUVD-2021-34388
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-h7hm-j4cr-jwhq 7.1

In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound...

In the Linux kernel, the following vulnerability has been resolved:

tty: Fix out-of-bound vmalloc access in imageblit

This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values.

To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.

Record: GHSA-h7hm-j4cr-jwhq
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

tty: Fix out-of-bound vmalloc access in imageblit

This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values.

To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.

Record: CVE-2021-47383
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSV 7.1

In the Linux kernel, the following vulnerability has been resolved:

tty: Fix out-of-bound vmalloc access in imageblit

This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values.

To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.

Record: CVE-2021-47383
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2021-47383 7.1

In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values. If this struct is the same as the previous ioctl, the vc_resize() detects it and doesn't call the resize_screen(), leaving the fb_var_screeninfo incomplete. And this leads to the updatescrollmode() calculates a wrong value to fbcon_display->vrows, which makes the real_y() return a wrong value of y, and that value, eventually, causes the imageblit to access an out-of-bound address value. To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.

Record: DEBIAN-CVE-2021-47383
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

Show 48 moreShow less

OSVRHSA-2024:5364 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2024:5364
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:5365 7.8

Red Hat Security Advisory: kernel-rt security update

Record: RHSA-2024:5365
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:7000 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2024:7000
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:7001 7.8

Red Hat Security Advisory: kernel-rt security update

Record: RHSA-2024:7001
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:8617 7.1

Red Hat Security Advisory: kernel security update

Record: RHSA-2024:8617
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2024:7000 7.8

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):

CVE-2023-6040 CVE-2024-26595 CVE-2024-26600 CVE-2021-46984 CVE-2023-52478 CVE-2023-52476 CVE-2023-52522 CVE-2021-47101 CVE-2021-47097 CVE-2023-52605 CVE-2024-26638 CVE-2024-26645 CVE-2024-26665 CVE-2024-26720 CVE-2024-26717 CVE-2024-26769 CVE-2024-26846 CVE-2024-26894 CVE-2024-26880 CVE-2024-26855 CVE-2024-26923 CVE-2024-26939 CVE-2024-27013 CVE-2024-27042 CVE-2024-35809 CVE-2023-52683 CVE-2024-35884 CVE-2024-35877 CVE-2024-35944 CVE-2024-35989 CVE-2021-47412 CVE-2021-47393 CVE-2021-47386 CVE-2021-47385 CVE-2021-47384 CVE-2021-47383 CVE-2021-47432 CVE-2021-47352 CVE-2021-47338 CVE-2021-47321 CVE-2021-47289 CVE-2021-47287 CVE-2023-52798 CVE-2023-52809 CVE-2023-52817 CVE-2023-52840 CVE-2023-52800 CVE-2021-47441 CVE-2021-47466 CVE-2021-47455 CVE-2021-47497 CVE-2021-47560 CVE-2021-47527 CVE-2024-36883 CVE-2024-36922 CVE-2024-36920 CVE-2024-36902 CVE-2024-36953 CVE-2024-36939 CVE-2024-36919 CVE-2024-36901 CVE-2021-47582 CVE-2021-47609 CVE-2024-38619 CVE-2022-48754 CVE-2022-48760 CVE-2024-38581 CVE-2024-38579 CVE-2024-38570 CVE-2024-38559 CVE-2024-38558 CVE-2024-37356 CVE-2024-39471 CVE-2024-39499 CVE-2024-39501 CVE-2024-39506 CVE-2024-40904 CVE-2024-40911 CVE-2024-40912 CVE-2024-40929 CVE-2024-40931 CVE-2024-40941 CVE-2024-40954 CVE-2024-40958 CVE-2024-40959 CVE-2024-40960 CVE-2024-40972 CVE-2024-40977 CVE-2024-40978 CVE-2024-40988 CVE-2024-40989 CVE-2024-40995 CVE-2024-40997 CVE-2024-40998 CVE-2024-41005 CVE-2024-40901 CVE-2024-41007 CVE-2024-41008 CVE-2022-48804 CVE-2022-48836 CVE-2022-48866 CVE-2024-41090 CVE-2024-41091 CVE-2024-41012 CVE-2024-41013 CVE-2024-41014 CVE-2024-41023 CVE-2024-41035 CVE-2024-41038 CVE-2024-41039 CVE-2024-41040 CVE-2024-41041 CVE-2024-41044 CVE-2024-41055 CVE-2024-41056 CVE-2024-41060 CVE-2024-41064 CVE-2024-41065 CVE-2024-41071 CVE-2024-41076 CVE-2024-41097 CVE-2024-42084 CVE-2024-42090 CVE-2024-42094 CVE-2024-42096 CVE-2024-42114 CVE-2024-42124 CVE-2024-42131 CVE-2024-42152 CVE-2024-42154 CVE-2024-42225 CVE-2024-42226 CVE-2024-42228 CVE-2024-42237 CVE-2024-42238 CVE-2024-42240 CVE-2024-42246 CVE-2024-42322 CVE-2024-43830 CVE-2024-43871 For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2024:7000
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-47383 8.4

Record: UBUNTU-CVE-2021-47383
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVALSA-2024:7000 No score

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):

Record: ALSA-2024:7000
Updated: 2026-11-02

OSVALSA-2024:7001 No score

Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):

CVE-2023-6040 CVE-2024-26595 CVE-2021-46984 CVE-2023-52478 CVE-2023-52476 CVE-2023-52522 CVE-2021-47101 CVE-2021-47097 CVE-2023-52605 CVE-2024-26645 CVE-2024-26665 CVE-2024-26720 CVE-2024-26717 CVE-2024-26769 CVE-2024-26894 CVE-2024-26880 CVE-2024-26855 CVE-2024-26923 CVE-2024-26939 CVE-2024-27013 CVE-2024-27042 CVE-2024-35809 CVE-2023-52683 CVE-2024-35884 CVE-2024-35877 CVE-2024-35944 CVE-2024-35989 CVE-2021-47412 CVE-2021-47393 CVE-2021-47386 CVE-2021-47385 CVE-2021-47384 CVE-2021-47383 CVE-2021-47432 CVE-2021-47352 CVE-2021-47338 CVE-2021-47321 CVE-2021-47289 CVE-2021-47287 CVE-2023-52817 CVE-2023-52840 CVE-2021-47441 CVE-2021-47466 CVE-2021-47455 CVE-2021-47497 CVE-2021-47560 CVE-2021-47527 CVE-2024-36883 CVE-2024-36920 CVE-2024-36902 CVE-2024-36953 CVE-2024-36939 CVE-2024-36901 CVE-2021-47582 CVE-2021-47609 CVE-2024-38619 CVE-2022-48754 CVE-2022-48760 CVE-2024-38581 CVE-2024-38570 CVE-2024-38559 CVE-2024-38558 CVE-2024-37356 CVE-2024-39471 CVE-2024-39499 CVE-2024-39501 CVE-2024-39506 CVE-2024-40904 CVE-2024-40911 CVE-2024-40912 CVE-2024-40929 CVE-2024-40931 CVE-2024-40941 CVE-2024-40954 CVE-2024-40958 CVE-2024-40959 CVE-2024-40960 CVE-2024-40972 CVE-2024-40977 CVE-2024-40978 CVE-2024-40988 CVE-2024-40989 CVE-2024-40995 CVE-2024-40997 CVE-2024-40998 CVE-2024-41005 CVE-2024-40901 CVE-2024-41007 CVE-2024-41008 CVE-2022-48804 CVE-2022-48836 CVE-2022-48866 CVE-2024-41090 CVE-2024-41091 CVE-2024-41012 CVE-2024-41013 CVE-2024-41014 CVE-2024-41035 CVE-2024-41038 CVE-2024-41039 CVE-2024-41040 CVE-2024-41041 CVE-2024-41044 CVE-2024-41055 CVE-2024-41056 CVE-2024-41060 CVE-2024-41071 CVE-2024-41076 CVE-2024-41097 CVE-2024-42084 CVE-2024-42090 CVE-2024-42096 CVE-2024-42114 CVE-2024-42124 CVE-2024-42131 CVE-2024-42152 CVE-2024-42154 CVE-2024-42226 CVE-2024-42228 CVE-2024-42237 CVE-2024-42238 CVE-2024-42240 CVE-2024-42246 CVE-2024-42322 CVE-2024-43871 For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2024:7001
Updated: 2026-11-02

OSVALSA-2024:8617 No score

Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

hw: cpu: intel: Native Branch History Injection (BHI) (CVE-2024-2201)
kernel: tcp: add sanity checks to rx zerocopy (CVE-2024-26640)
kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)
kernel: af_unix: Fix garbage collector racing against connect() (CVE-2024-26923)
kernel: mac802154: fix llsec key resources release in mac802154_llsec_key_del (CVE-2024-26961)
kernel: scsi: core: Fix unremoved procfs host directory regression (CVE-2024-26935)
kernel: tty: Fix out-of-bound vmalloc access in imageblit (CVE-2021-47383)
kernel: net/sched: taprio: extend minimum interval restriction to entire cycle too (CVE-2024-36244)
kernel: xfs: fix log recovery buffer allocation for the legacy h_size fixup (CVE-2024-39472)
kernel: netfilter: nft_inner: validate mandatory meta and payload (CVE-2024-39504)
kernel: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CVE-2024-40904)
kernel: mptcp: ensure snd_una is properly initialized on connect (CVE-2024-40931)
kernel: ipv6: prevent possible NULL dereference in rt6_probe() (CVE-2024-40960)
kernel: ext4: do not create EA inode under buffer lock (CVE-2024-40972)
kernel: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CVE-2024-40977)
kernel: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (CVE-2024-40995)
kernel: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (CVE-2024-40998)
kernel: netpoll: Fix race condition in netpoll_owner_active (CVE-2024-41005)
kernel: xfs: don't walk off the end of a directory data block (CVE-2024-41013)
kernel: xfs: add bounds checking to xlog_recover_process_data (CVE-2024-41014)
kernel: block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854)
kernel: netfilter: flowtable: initialise extack before use (CVE-2024-45018)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2024:8617
Updated: 2026-11-02

OSVCLSA-2024-1724693366 No score

kernel: Fix of 15 CVEs

net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() {CVE-2024-26855}
tty: Fix out-of-bound vmalloc access in imageblit {CVE-2021-47383}
drm/vmwgfx: Fix invalid reads in fence signaled events {CVE-2024-36960}
Revert: GFS2: Skip dlm_unlock calls during unmount {CVE-2024-38570}
Revert: GFS2: ignore unlock failures after withdraw {CVE-2024-38570}
Revert: GFS2: fix skip unlock condition {CVE-2024-38570}
ima: Fix use-after-free on a dentry's dname.name {CVE-2024-39494}
netfilter: nft_limit: reject configurations that cause integer overflow {CVE-2024-26668}
ipv6: remove max_size check inline with ipv4 {CVE-2023-52340}
USB: core: Fix deadlock in usb_deauthorize_interface() {CVE-2024-26934}
net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() {CVE-2024-26882}
ip: validate header length on virtual device xmit
ext4: improve error recovery code paths in __ext4_remount() {CVE-2024-0775}
drivers/amd/pm: fix a use-after-free in kv_parse_power_table {CVE-2023-52469}
drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc {CVE-2024-42228}
netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() {CVE-2024-27020}
af_unix: Fix garbage collector racing against connect() {CVE-2024-26923}
md/raid5: fix atomicity violation in raid5_cache_count {CVE-2024-23307}

Record: CLSA-2024-1724693366
Updated: 2026-11-02

OSVCLSA-2024-1727690025 No score

kernel: Fix of 80 CVEs

sch/netem: fix use after free in netem_dequeue {CVE-2024-46800}
VMCI: Fix use-after-free when removing resource in vmci_resource_remove() {CVE-2024-46738}
drm/amdgpu: Fix out-of-bounds write warning {CVE-2024-46725}
drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number {CVE-2024-46724}
drm/amdgpu: fix ucode out-of-bounds read warning {CVE-2024-46723}
drm/amdgpu: fix mc_data out-of-bounds read warning {CVE-2024-46722}
scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}
ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
exec: Fix ToCToU between perm check and set-uid/gid usage {CVE-2024-43882}
dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
RDMA/iwcm: Fix a use-after-free related to destroying CM IDs {CVE-2024-42285}
tipc: Return non-zero value from tipc_udp_addr2str() on error {CVE-2024-42284}
mISDN: Fix a use after free in hfcmulti_tx() {CVE-2024-42280}
nvme: avoid double free special payload {CVE-2024-41073}
wifi: mac80211: Avoid address calculations via out of bounds array indexing {CVE-2024-41071}
xfs: don't walk off the end of a directory data block {CVE-2024-41013}
tunnels: fix out of bounds access when building IPv6 PMTU error {CVE-2024-26665}
KVM: x86/mmu: make apf token non-zero to fix bug {CVE-2022-48943}
cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}
netfilter: fix use-after-free in __nf_register_net_hook() {CVE-2022-48912}
rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() {CVE-2022-48742}
selinux: fix double free of cond_list on error paths {CVE-2022-48740}
ALSA: hda: Fix UAF of leds class devs at unbinding {CVE-2022-48735}
drm/nouveau: fix off by one in BIOS boundary checking {CVE-2022-48732}
mm, slub: fix potential memoryleak in kmem_cache_open() {CVE-2021-47466}
x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25744}
x86: Make IA32_EMULATION boot time configurable {CVE-2024-25744}
x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() {CVE-2024-25744}
x86/elf: Make loading of 32bit processes depend on ia32_enabled() {CVE-2024-25744}
x86/entry: Rename ignore_sysret() {CVE-2024-25744}
x86/cpu: Don't write CSTAR MSR on Intel CPUs {CVE-2024-25744}
x86: Introduce ia32_enabled() {CVE-2024-25744}
scsi: qedf: Make qedf_execute_tmf() non-preemptible {CVE-2024-42124}
ftruncate: pass a signed offset {CVE-2024-42084}
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor {CVE-2024-41035}
xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
drm/radeon: fix UBSAN warning in kv_dpm.c {CVE-2024-40988}
ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
Input: cyapa - add missing input core locking to suspend/resume functions {CVE-2023-52884}
Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() {CVE-2023-52840}
wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
wifi: ath11k: fix dfs radar event locking {CVE-2023-52798}
ACPI: LPIT: Avoid u32 multiplication overflow {CVE-2023-52683}
ACPI: extlog: fix NULL pointer dereference check {CVE-2023-52605}
HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect {CVE-2023-52478}
USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
phylib: fix potential use-after-free {CVE-2022-48754}
serial: core: fix transmit-buffer reset and memleak {CVE-2021-47527}
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
mlxsw: thermal: Fix out-of-bounds memory accesses {CVE-2021-47441}
hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs {CVE-2021-47393}
hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47386}
hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47385}
hwmon: (w83793) Fix NULL pointer…

Record: CLSA-2024-1727690025
Updated: 2026-11-02

OSVCLSA-2024-1727690947 No score

kernel: Fix of 80 CVEs

sch/netem: fix use after free in netem_dequeue {CVE-2024-46800}
VMCI: Fix use-after-free when removing resource in vmci_resource_remove() {CVE-2024-46738}
drm/amdgpu: Fix out-of-bounds write warning {CVE-2024-46725}
drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number {CVE-2024-46724}
drm/amdgpu: fix ucode out-of-bounds read warning {CVE-2024-46723}
drm/amdgpu: fix mc_data out-of-bounds read warning {CVE-2024-46722}
scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}
ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
exec: Fix ToCToU between perm check and set-uid/gid usage {CVE-2024-43882}
dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
RDMA/iwcm: Fix a use-after-free related to destroying CM IDs {CVE-2024-42285}
tipc: Return non-zero value from tipc_udp_addr2str() on error {CVE-2024-42284}
mISDN: Fix a use after free in hfcmulti_tx() {CVE-2024-42280}
nvme: avoid double free special payload {CVE-2024-41073}
wifi: mac80211: Avoid address calculations via out of bounds array indexing {CVE-2024-41071}
xfs: don't walk off the end of a directory data block {CVE-2024-41013}
tunnels: fix out of bounds access when building IPv6 PMTU error {CVE-2024-26665}
KVM: x86/mmu: make apf token non-zero to fix bug {CVE-2022-48943}
cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}
netfilter: fix use-after-free in __nf_register_net_hook() {CVE-2022-48912}
rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() {CVE-2022-48742}
selinux: fix double free of cond_list on error paths {CVE-2022-48740}
ALSA: hda: Fix UAF of leds class devs at unbinding {CVE-2022-48735}
drm/nouveau: fix off by one in BIOS boundary checking {CVE-2022-48732}
mm, slub: fix potential memoryleak in kmem_cache_open() {CVE-2021-47466}
x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25744}
x86: Make IA32_EMULATION boot time configurable {CVE-2024-25744}
x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() {CVE-2024-25744}
x86/elf: Make loading of 32bit processes depend on ia32_enabled() {CVE-2024-25744}
x86/entry: Rename ignore_sysret() {CVE-2024-25744}
x86/cpu: Don't write CSTAR MSR on Intel CPUs {CVE-2024-25744}
x86: Introduce ia32_enabled() {CVE-2024-25744}
x86/asm/64: Change all ENTRY+END to SYM_CODE_* {CVE-2024-25744}
x86/head/64: Annotate start_cpu0() as non-callable {CVE-2024-25744}
x86/asm: Do not annotate functions with GLOBAL {CVE-2024-25744}
kprobes/x86/xen: blacklist non-attachable xen interrupt functions {CVE-2024-25744}
x86/asm/64: Add ENDs to some functions and relabel with SYM_CODE_* {CVE-2024-25744}
x86/asm: Use SYM_INNER_LABEL instead of GLOBAL {CVE-2024-25744}
x86/asm: Annotate aliases {CVE-2024-25744}
x86/asm/crypto: Annotate local functions {CVE-2024-25744}
scsi: qedf: Make qedf_execute_tmf() non-preemptible {CVE-2024-42124}
ftruncate: pass a signed offset {CVE-2024-42084}
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor {CVE-2024-41035}
xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
drm/radeon: fix UBSAN warning in kv_dpm.c {CVE-2024-40988}
ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
Input: cyapa - add missing input core locking to suspend/resume functions {CVE-2023-52884}
Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() {CVE-2023-52840}
wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
wifi: ath11k: fix dfs radar event locking {CVE-2023-52798}
ACPI: LPIT: Avoid u32 multiplication overflow {CVE-2023-52683}
ACPI: extlog: fix NULL pointer dereference check {CVE-2023-52605}
HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect {CVE-2023-52478}
USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
phylib: fix potential use-after-free {CVE-2022-48754}
serial: core: fix transmit-buffer…

Record: CLSA-2024-1727690947
Updated: 2026-11-02

OSVCLSA-2024-1727815919 No score

kernel: Fix of 73 CVEs

firmware: cs_dsp: Return error if block header overflows file {CVE-2024-42238}
scsi: qedf: Make qedf_execute_tmf() non-preemptible {CVE-2024-42124}
ftruncate: pass a signed offset {CVE-2024-42084}
firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files {CVE-2024-41056}
firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor {CVE-2024-41035}
xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
netpoll: Fix race condition in netpoll_owner_active {CVE-2024-41005}
drm/radeon: fix UBSAN warning in kv_dpm.c {CVE-2024-40988}
ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
scsi: mpi3mr: Avoid memcpy field-spanning write WARNING {CVE-2024-36920}
dmaengine: idxd: Fix oops during rmmod on single-CPU platforms {CVE-2024-35989}
udp: do not accept non-tunnel GSO skbs landing in a tunnel {CVE-2024-35884}
nvme-fc: do not wait in vain when unloading module {CVE-2024-26846}
drm/amdgpu: Fix the null pointer when load rlc firmware {CVE-2024-26649}
Input: cyapa - add missing input core locking to suspend/resume functions {CVE-2023-52884}
Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() {CVE-2023-52840}
wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
wifi: ath11k: fix dfs radar event locking {CVE-2023-52798}
ACPI: LPIT: Avoid u32 multiplication overflow {CVE-2023-52683}
ACPI: extlog: fix NULL pointer dereference check {CVE-2023-52605}
HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect {CVE-2023-52478}
USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
phylib: fix potential use-after-free {CVE-2022-48754}
serial: core: fix transmit-buffer reset and memleak {CVE-2021-47527}
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
mlxsw: thermal: Fix out-of-bounds memory accesses {CVE-2021-47441}
hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs {CVE-2021-47393}
hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47386}
hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47385}
hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47384}
virtio-net: Add validation for used length {CVE-2021-47352}
fbmem: Do not delete the mode that is still in use {CVE-2021-47338}
watchdog: Fix possible use-after-free by calling del_timer_sync() {CVE-2021-47321}
ACPI: fix NULL pointer dereference {CVE-2021-47289}
driver core: auxiliary bus: Fix memory leak when driver_register() fail {CVE-2021-47287}
Input: elantech - fix stack out of bound access in elantech_change_report_id() {CVE-2021-47097}
HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts {CVE-2022-48866}
ipv6: prevent possible NULL dereference in rt6_probe() {CVE-2024-40960}
xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() {CVE-2024-40959}
wifi: iwlwifi: mvm: don't read past the mfuart notifcation {CVE-2024-40941}
wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() {CVE-2024-40912}
wifi: cfg80211: Lock wiphy in cfg80211_get_station {CVE-2024-40911}
USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages {CVE-2024-40904}
scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet {CVE-2024-39506}
vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
crypto: bcm - Fix pointer arithmetic {CVE-2024-38579}
scsi: qedf: Ensure the copied buf is NUL terminated {CVE-2024-38559}
net: openvswitch: fix overwriting ct original tuple for ICMPv6…

Record: CLSA-2024-1727815919
Updated: 2026-11-02

OSVCLSA-2024-1728936982 No score

kernel: Fix of 86 CVEs

drm/amd/pm: Fix negative array index read {CVE-2024-46821}
drm/amd/display: Check gpio_id before used as array index {CVE-2024-46818}
drm/amd/display: Check link_index before accessing dc->links[] {CVE-2024-46813}
drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box {CVE-2024-46811}
Squashfs: sanity check symbolic link size {CVE-2024-46744}
platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses {CVE-2024-46859}
net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() {CVE-2024-40995}
net/sched: act_api: rely on rcu in tcf_idr_check_alloc {CVE-2024-40995}
netfilter: bridge: confirm multicast packets before passing them up the stack {CVE-2024-27415}
netfilter: let reset rules clean out conntrack entries {CVE-2024-27415}
mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray {CVE-2024-42243}
gpiolib: cdev: Fix use after free in lineinfo_changed_notify {CVE-2024-36899}
bpf, sockmap: Prevent lock inversion deadlock in map delete elem {CVE-2024-35895}
bpf, sockmap: Fix preempt_rt splat when using raw_spin_lock_t {CVE-2024-35895}
mm/huge_memory: don't unpoison huge_zero_folio {CVE-2024-40914}
cxgb4: fix use after free bugs caused by circular dependency problem {CVE-2023-4133}
timers: Restore ABI Compatibility with timer_delete Functions {CVE-2023-4133}
timers: Provide timer_shutdown_sync {CVE-2023-4133}
timers: Add shutdown mechanism to the internal functions {CVE-2023-4133}
timers: Split [try_to_]del_timer_sync to prepare for shutdown mode {CVE-2023-4133}
timers: Silently ignore timers with a NULL function {CVE-2023-4133}
timers: Rename del_timer() to timer_delete() {CVE-2023-4133}
timers: Rename del_timer_sync() to timer_delete_sync() {CVE-2023-4133}
timers: Use del_timer_sync() even on UP {CVE-2023-4133}
timers: Update kernel-doc for various functions {CVE-2023-4133}
timers: Replace BUG_ON()s {CVE-2023-4133}
timers: Get rid of del_singleshot_timer_sync() {CVE-2023-4133}
clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function {CVE-2023-4133}
clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function {CVE-2023-4133}
mm: avoid overflows in dirty throttling logic {CVE-2024-42131}
ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
igc: avoid returning frame twice in XDP_REDIRECT {CVE-2024-26853}
igc: Avoid transmit queue timeout for XDP {CVE-2024-26853}
nfsd: fix RELEASE_LOCKOWNER {CVE-2024-26629}
tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc {CVE-2023-52880}
nvmet: fix a possible leak when destroy a ctrl during qp establishment {CVE-2024-42152}
net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() {CVE-2024-42110}
x86: stop playing stack games in profile_pc() {CVE-2024-42096}
xdp: Remove WARN() from __xdp_reg_mem_model() {CVE-2024-42082}
NFSv4: Fix memory leak in nfs4_set_security_label {CVE-2024-41076}
ppp: reject claimed-as-LCP but actually malformed packets {CVE-2024-41044}
udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). {CVE-2024-41041}
sched/deadline: Fix task_struct reference leak {CVE-2024-41023}
tipc: force a dst refcount before doing decryption {CVE-2024-40983}
scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978}
wifi: iwlwifi: mvm: don't read past the mfuart notifcation {CVE-2024-40941}
wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
xhci: Handle TD clearing for multiple streams case {CVE-2024-40927}
wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() {CVE-2024-40912}
wifi: cfg80211: Lock wiphy in cfg80211_get_station {CVE-2024-40911}
ipv6: fix possible race in __fib6_drop_pcpu_from() {CVE-2024-40905}
md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING {CVE-2024-39476}
usb-storage: alauda: Check whether the media is…

Record: CLSA-2024-1728936982
Updated: 2026-11-02

OSVCLSA-2025-1761074747 No score

kernel: Fix of 39 CVEs

nfs: fix UAF in direct writes {CVE-2024-26958}
NFSD: Fix the behavior of READ near OFFSET_MAX {CVE-2022-48827}
thermal: core: prevent potential string overflow {CVE-2023-52868}
ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 {CVE-2021-47633}
RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests {CVE-2021-47391}
drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
netfilter: validate user input for expected length {CVE-2024-35896}
wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
net: bridge: xmit: make sure we have at least eth header len bytes {CVE-2024-38538}
bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() {CVE-2024-39487}
SUNRPC: Fix UAF in svc_tcp_listen_data_ready() {CVE-2023-52885}
tty: Fix out-of-bound vmalloc access in imageblit {CVE-2021-47383}
watchdog: Fix possible use-after-free by calling del_timer_sync() {CVE-2021-47321}
virtio-net: Add validation for used length {CVE-2021-47352}
USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
jffs2: prevent xattr node from overflowing the eraseblock {CVE-2024-38599}
ecryptfs: Fix buffer size for tag 66 packet {CVE-2024-38578}
dlm: fix plock invalid read {CVE-2022-49407}
media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
jfs: fix shift-out-of-bounds in dbSplit {CVE-2024-56597}
wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
pid: take a reference when initializing cad_pid {CVE-2021-47118}
Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
sched/rt: pick_next_rt_entity(): check list_entry {CVE-2023-1077}
media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23038}
media: dvb-core: Fix use-after-free due to race at dvb_register_device() {CVE-2022-45884}
media: dvb-core: Fix use-after-free due on race condition at dvb_net {CVE-2022-45886}
media: dvb-core: Fix use-after-free on race condition at dvb_frontend {CVE-2022-45885}
media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 {CVE-2022-45919}
x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit {CVE-2022-25265}
x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK {CVE-2022-25265}
x86/elf: Add table to document READ_IMPLIES_EXEC {CVE-2022-25265}
i2c: i801: Don't generate an interrupt on bus reset {CVE-2021-47153}

Record: CLSA-2025-1761074747
Updated: 2026-11-02

OSVCLSA-2025-1761139764 No score

kernel: Fix of 39 CVEs

nfs: fix UAF in direct writes {CVE-2024-26958}
NFSD: Fix the behavior of READ near OFFSET_MAX {CVE-2022-48827}
thermal: core: prevent potential string overflow {CVE-2023-52868}
ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 {CVE-2021-47633}
RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests {CVE-2021-47391}
drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
netfilter: validate user input for expected length {CVE-2024-35896}
wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
net: bridge: xmit: make sure we have at least eth header len bytes {CVE-2024-38538}
bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() {CVE-2024-39487}
SUNRPC: Fix UAF in svc_tcp_listen_data_ready() {CVE-2023-52885}
tty: Fix out-of-bound vmalloc access in imageblit {CVE-2021-47383}
watchdog: Fix possible use-after-free by calling del_timer_sync() {CVE-2021-47321}
virtio-net: Add validation for used length {CVE-2021-47352}
USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
jffs2: prevent xattr node from overflowing the eraseblock {CVE-2024-38599}
ecryptfs: Fix buffer size for tag 66 packet {CVE-2024-38578}
dlm: fix plock invalid read {CVE-2022-49407}
media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
jfs: fix shift-out-of-bounds in dbSplit {CVE-2024-56597}
wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
pid: take a reference when initializing cad_pid {CVE-2021-47118}
Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
sched/rt: pick_next_rt_entity(): check list_entry {CVE-2023-1077}
media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23038}
media: dvb-core: Fix use-after-free due to race at dvb_register_device() {CVE-2022-45884}
media: dvb-core: Fix use-after-free due on race condition at dvb_net {CVE-2022-45886}
media: dvb-core: Fix use-after-free on race condition at dvb_frontend {CVE-2022-45885}
media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 {CVE-2022-45919}
x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit {CVE-2022-25265}
x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK {CVE-2022-25265}
x86/elf: Add table to document READ_IMPLIES_EXEC {CVE-2022-25265}
i2c: i801: Don't generate an interrupt on bus reset {CVE-2021-47153}

Record: CLSA-2025-1761139764
Updated: 2026-11-02

OSVCLSA-2025-1763991095 No score

Fix of 25 CVEs

Focal update: v5.4.291 upstream stable release (LP: #2106002) // CVE-2025-21772
- partitions: mac: fix handling of bogus partition table
CVE-url: https://ubuntu.com/security/CVE-2025-22079
- ocfs2: validate l_tree_depth to avoid out-of-bounds access
CVE-url: https://ubuntu.com/security/CVE-2024-58014
- wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
CVE-url: https://ubuntu.com/security/CVE-2024-41042
- netfilter: nf_tables: prefer nft_chain_validate
CVE-url: https://ubuntu.com/security/CVE-2024-46713
- perf/aux: Fix AUX buffer serialization
CVE-url: https://ubuntu.com/security/CVE-2025-38352
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
CVE-url: https://ubuntu.com/security/CVE-2025-38477
- net/sched: sch_qfq: Fix race condition on qfq_aggregate
Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52804
- fs/jfs: Add check for negative db_l2nbperpage
- fs/jfs: Add validity check for db_maxag and db_agpref
Focal update: v5.4.251 upstream stable release (LP: #2034918) // CVE-url: https://ubuntu.com/security/CVE-2023-52804
- jfs: jfs_dmap: Validate db_l2nbperpage while mounting
Bionic update: upstream stable patchset 2023-02-06 (LP: #2006403) // CVE- url: https://ubuntu.com/security/CVE-2023-52804
- fs: jfs: fix shift-out-of-bounds in dbAllocAG
CVE-url: https://ubuntu.com/security/CVE-2022-25265
- x86/elf: Add table to document READ_IMPLIES_EXEC
- x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK
- x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit
Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740) // CVE- url: https://ubuntu.com/security/CVE-2021-47153
- i2c: i801: Don't generate an interrupt on bus reset
Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48757
- net: fix information leakage in /proc/net/ptype
Focal update: v5.4.279 upstream stable release (LP: #2073621) // CVE-url: https://ubuntu.com/security/CVE-2024-37078
- nilfs2: fix potential kernel bug due to lack of writeback flag waiting
Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48760
- USB: core: Fix hang in usb_kill_urb by adding memory barriers
Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE- url: https://ubuntu.com/security/CVE-2021-47383
- tty: Fix out-of-bound vmalloc access in imageblit
Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE- url: https://ubuntu.com/security/CVE-2022-49145
- ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
Bionic update: upstream stable patchset 2021-11-23 (LP: #1951997) // CVE- url: https://ubuntu.com/security/CVE-2021-47458
- ocfs2: mount fails with buffer overflow in strlen
CVE-url: https://ubuntu.com/security/CVE-2022-49170
- f2fs: fix to do sanity check on curseg->alloc_type
CVE-url: https://ubuntu.com/security/CVE-2021-47479
- staging: rtl8712: fix use-after-free in rtl8712_dl_fw
Bionic update: upstream stable patchset 2021-12-03 (LP: #1953202) // CVE- url: https://ubuntu.com/security/CVE-2021-47477
- comedi: dt9812: fix DMA buffers on stack
Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE- url: https://ubuntu.com/security/CVE-2021-47642
- video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
Bionic update: upstream stable patchset 2022-01-06 (LP: #1956614) // CVE- url: https://ubuntu.com/security/CVE-2021-47565
- scsi: mpt3sas: Fix kernel panic during drive powercycle test
Bionic update: upstream stable patchset 2022-01-06…

Record: CLSA-2025-1763991095
Updated: 2026-11-02

OSVRLSA-2024:7001 No score

Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):

Record: RLSA-2024:7001
Updated: 2026-11-02

OSVRLSA-2024:8617 No score

Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

hw: cpu: intel: Native Branch History Injection (BHI) (CVE-2024-2201)
kernel: tcp: add sanity checks to rx zerocopy (CVE-2024-26640)
kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)
kernel: af_unix: Fix garbage collector racing against connect() (CVE-2024-26923)
kernel: mac802154: fix llsec key resources release in mac802154_llsec_key_del (CVE-2024-26961)
kernel: scsi: core: Fix unremoved procfs host directory regression (CVE-2024-26935)
kernel: tty: Fix out-of-bound vmalloc access in imageblit (CVE-2021-47383)
kernel: net/sched: taprio: extend minimum interval restriction to entire cycle too (CVE-2024-36244)
kernel: xfs: fix log recovery buffer allocation for the legacy h_size fixup (CVE-2024-39472)
kernel: netfilter: nft_inner: validate mandatory meta and payload (CVE-2024-39504)
kernel: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CVE-2024-40904)
kernel: mptcp: ensure snd_una is properly initialized on connect (CVE-2024-40931)
kernel: ipv6: prevent possible NULL dereference in rt6_probe() (CVE-2024-40960)
kernel: ext4: do not create EA inode under buffer lock (CVE-2024-40972)
kernel: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CVE-2024-40977)
kernel: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (CVE-2024-40995)
kernel: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (CVE-2024-40998)
kernel: netpoll: Fix race condition in netpoll_owner_active (CVE-2024-41005)
kernel: xfs: don't walk off the end of a directory data block (CVE-2024-41013)
kernel: xfs: add bounds checking to xlog_recover_process_data (CVE-2024-41014)
kernel: block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854)
kernel: netfilter: flowtable: initialise extack before use (CVE-2024-45018)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2024:8617
Updated: 2026-11-02

OSVSUSE-SU-2024:1978-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
CVE-2021-47321: Fixed possible use-after-free by calling del_timer_sync() (bsc#1225060).
CVE-2021-47324: Fixed possible use-after-free in wdt_startup() (bsc#1225030).
CVE-2021-47323: Fixed possible use-after-free in wdt_turnoff() (bsc#1225026).
CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
CVE-2021-47391: Ensure rdma_addr_cancel() happens before issuing more requests (bsc#1225318)
CVE-2021-47347: Fixed possible buffer overflow in wl1251_cmd_scan (bsc#1225177).

Record: SUSE-SU-2024:1978-1
Updated: 2026-11-02

OSVSUSE-SU-2024:1979-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948). Update blacklist.conf: remove entry
CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
CVE-2022-48697: Fix a use-after-free (bsc#1223922). Update blacklist.conf: drop entry from it
CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).
CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
CVE-2023-42755: Check user supplied offsets (bsc#1215702).
CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).
CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222 CVE-2023-52732).
CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
CVE-2024-36029: Pervent access to suspended controller (bsc#1225708 CVE-2024-36029)
CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
CVE-2021-47352: Add validation for used length (bsc#1225124).
CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).
CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
CVE-2021-47423: Fix file release memory leak (bsc#1225366).
CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).
CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).
CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)
CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960, CVE-2021-47277).
CVE-2024-35791: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (bsc#1224725).
CVE-2021-47401: Fix stack information leak (bsc#1225242).
CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).
CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).
CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).
CVE-2023-52864: Fix opening of char device (bsc#1225132).
CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).
CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).
CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)
CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).
CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).
CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)
CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).
CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931) -…

Record: SUSE-SU-2024:1979-1
Updated: 2026-11-02

OSVSUSE-SU-2024:1983-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948).
CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
CVE-2022-48697: Fix a use-after-free (bsc#1223922).
CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).
CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
CVE-2023-42755: Check user supplied offsets (bsc#1215702).
CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).
CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222).
CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
CVE-2021-47548: Fixed a possible array out-of-bounds (bsc#1225506)
CVE-2024-36029: Pervent access to suspended controller (bsc#1225708)
CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
CVE-2021-47352: Add validation for used length (bsc#1225124).
CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).
CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
CVE-2021-47423: Fix file release memory leak (bsc#1225366).
CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).
CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).
CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)
CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960).
CVE-2024-35791: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (bsc#1224725).
CVE-2021-47401: Fix stack information leak (bsc#1225242).
CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).
CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).
CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).
CVE-2023-52864: Fix opening of char device (bsc#1225132).
CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).
CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).
CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)
CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).
CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).
CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)
CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).
CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)
CVE-2021-47249: Fix memory leak in rds_recvmsg (bsc#1224880)
CVE-2021-47397: Break out if skb_header_pointer returns NULL in…

Record: SUSE-SU-2024:1983-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2008-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
CVE-2023-42755: Check user supplied offsets (bsc#1215702).
CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
CVE-2023-52660: Fiedx IRQ handling due to shared interrupts (bsc#1224443).
CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
CVE-2024-26715: Fixed NULL pointer dereference in dwc3_gadget_suspend (bsc#1222561).
CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes bsc#1222608).
CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
CVE-2024-27042: Fixed potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (bsc#1223823).
CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).
CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181).
CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr() (bsc#1224721)
CVE-2024-27419: Fixed data-races around sysctl_net_busy_read (bsc#1224759)
CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
CVE-2024-35791: Flush pages under…

Record: SUSE-SU-2024:2008-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2010-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).

The following non-security bugs were fixed:

af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
btrfs: do not start relocation until in progress drops are done (bsc#1222251).
btrfs: do not start relocation until in progress drops are done (bsc#1222251).
cifs: add missing spinlock around tcon refcount (bsc#1213476).
cifs: avoid dup prefix path in dfs_get_automount_devname() (bsc#1213476).
cifs: avoid race conditions with parallel reconnects (bsc#1213476).
cifs: avoid re-lookups in dfs_cache_find() (bsc#1213476).
cifs: avoid use of global locks for high contention data (bsc#1213476).
cifs: check only tcon status on tcon related functions (bsc#1213476).
cifs: do all necessary checks for credits within or before locking (bsc#1213476).
cifs: do not block in dfs_cache_noreq_update_tgthint() (bsc#1213476).
cifs: do not refresh cached referrals from unactive mounts (bsc#1213476).
cifs: do not take exclusive lock for updating target hints (bsc#1213476).
cifs: fix confusing debug message (bsc#1213476).
cifs: fix missing unload_nls() in smb2_reconnect() (bsc#1213476).
cifs: fix potential deadlock in cache_refresh_path() (bsc#1213476).
cifs: fix refresh of cached referrals (bsc#1213476).
cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (bsc#1213476).
cifs: fix source pathname comparison of dfs supers (bsc#1213476).
cifs: fix status checks in cifs_tree_connect (bsc#1213476).
cifs: fix use-after-free bug in refresh_cache_worker() (bsc#1213476).
cifs: get rid of dns resolve worker (bsc#1213476).
cifs: get rid of mount options string parsing (bsc#1213476).
cifs: handle cache lookup errors different than -ENOENT (bsc#1213476).
cifs: ignore ipc reconnect failures during dfs failover (bsc#1213476).
cifs: match even the scope id for ipv6 addresses (bsc#1213476).
cifs: optimize reconnect of nested links (bsc#1213476).
cifs: prevent data race in smb2_reconnect() (bsc#1213476). -…

Record: SUSE-SU-2024:2010-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2011-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
CVE-2024-35904: Fixed dereference of garbage after mount failure (bsc#1224494).
CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).

The following non-security bugs were fixed:

af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
filemap: remove use of wait bookmarks (bsc#1224085).
idpf: extend tx watchdog timeout (bsc#1224137).
ipvs: Fix checksumming on GSO of SCTP packets (bsc#1221958)
powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).
powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).
powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).
powerpc/powernv: Add a null pointer check to scom_debug_init_one() (bsc#1194869).
powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV (bsc#1220492 ltc#205270).
powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).
powerpc: Refactor verification of MSR_RI (bsc#1223191).
supported.conf: support tcp_dctcp module (jsc#PED-8111)

Record: SUSE-SU-2024:2011-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2019-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).
CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575).
CVE-2024-36938: Fixed NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761).
CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
CVE-2024-35998: Fixed lock ordering potential deadlock in cifs_sync_mid_result (bsc#1224549).
CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).
CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break() (bsc#1224668).
CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key() (bsc#1224667).
CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
CVE-2024-35869: Guarantee refcounted children from parent session (bsc#1224679).
CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).
CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
CVE-2023-42755: Check user supplied offsets (bsc#1215702).
CVE-2024-35964: Fixed not validating setsockopt user input (bsc#1224581).
CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
CVE-2024-35860: struct bpf_link and bpf_link_ops kABI workaround (bsc#1224531).
CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).
CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).
CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios (bsc#1224530).
CVE-2024-35852: Fixed memory leak when canceling rehash work (bsc#1224502).
CVE-2024-36006: Fixed incorrect list API usage (bsc#1224541).
CVE-2024-36007: Fixed warning during rehash (bsc#1224543).
CVE-2024-35885: Stop interface during shutdown (bsc#1224519).
CVE-2024-35907: Call request_irq() after NAPI initialized (bsc#1224492).
CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure…

Record: SUSE-SU-2024:2019-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2183-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).

The following non-security bugs were fixed:

NFC: nxp: add NXP1002 (bsc#1185589).
PCI: rpaphp: Add MODULE_DESCRIPTION (bsc#1176869 ltc#188243).
af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
btrfs: do not start relocation until in progress drops are done (bsc#1222251).
md: Replace snprintf with scnprintf (git-fixes).
netfilter: nf_tables: GC transaction race with abort path (git-fixes).
netfilter: nf_tables: GC transaction race with netns dismantle (git-fixes).
netfilter: nf_tables: defer gc run if previous batch is still pending (git-fixes).
netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path (git-fixes).
netfilter: nf_tables: fix kdoc warnings after gc rework (git-fixes).
netfilter: nf_tables: fix memleak when more than 255 elements expired (git-fixes).
netfilter: nf_tables: mark newset as dead on transaction abort (git-fixes).
netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (git-fixes).
netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure (git-fixes).
netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (git-fixes).
netfilter: nf_tables: skip dead set elements in netlink dump (git-fixes).
netfilter: nf_tables: use correct lock to protect gc_list (git-fixes).
netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration (git-fixes).
netfilter: nft_set_rbtree: Add missing expired checks (git-fixes).
netfilter: nft_set_rbtree: Detect partial overlap with start endpoint match (git-fixes).
netfilter: nft_set_rbtree: Detect partial overlaps on insertion (git-fixes).
netfilter: nft_set_rbtree: Do not account for expired elements on insertion (git-fixes).
netfilter: nft_set_rbtree: Drop spurious condition for overlap detection on insertion (git-fixes).
netfilter: nft_set_rbtree: Handle outcomes of tree rotations in overlap detection (git-fixes).
netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start() (git-fixes). -…

Record: SUSE-SU-2024:2183-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2184-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).
CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
CVE-2021-47206: Check return value after calling platform_get_resource() (bsc#1222894).
CVE-2021-47238: Fixed memory leak in ip_mc_add1_src (bsc#1224847)
CVE-2021-47245: Fixed out of bounds when parsing TCP options (bsc#1224838)
CVE-2021-47246: Fixed page reclaim for dead peer hairpin (CVE-2021-47246 bsc#1224831).
CVE-2021-47249: Fixed memory leak in rds_recvmsg (bsc#1224880)
CVE-2021-47250: Fixed memory leak in netlbl_cipsov4_add_std (bsc#1224827)
CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960).
CVE-2021-47281: Fixed race of snd_seq_timer_open() (bsc#1224983).
CVE-2021-47334: Fixed two use after free in ibmasm_init_one (bsc#1225112).
CVE-2021-47352: Add validation for used length (bsc#1225124).
CVE-2021-47355: Fixed possible use-after-free in nicstar_cleanup() (bsc#1225141).
CVE-2021-47357: Fixed possible use-after-free in ia_module_exit() (bsc#1225144).
CVE-2021-47361: Fixed error handling in mcb_alloc_bus() (bsc#1225151).
CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225208).
CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb (bsc#1225082)
CVE-2021-47401: Fixed stack information leak (bsc#1225242).
CVE-2021-47423: Fixed file release memory leak (bsc#1225366).
CVE-2021-47431: Fixed gart.bo pin_count leak (bsc#1225390).
CVE-2021-47469: Add SPI fix commit to be ignored (bsc#1225347)
CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit() (bsc#1224907).
CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
CVE-2022-48672: Fixed off-by-one error in unflatten_dt_nodes() (CVE-2022-48672 bsc#1223931).
CVE-2022-48686: Fixed UAF when detecting digest errors (bsc#1223948).
CVE-2022-48697: Fixed a use-after-free (bsc#1223922).
CVE-2022-48702: Fixed out of bounds access in snd_emu10k1_pcm_channel_alloc() (bsc#1223923).
CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)
CVE-2022-48708: Fixed potential NULL dereference (bsc#1224942).
CVE-2022-48710: Fixed a possible null pointer dereference (bsc#1225230).
CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
CVE-2023-42755: Check user supplied offsets (bsc#1215702).
CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
CVE-2023-52691: Fixed a double-free in si_dpm_init (bsc#1224607).
CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
CVE-2023-52730: Fixed possible resource leaks in some error paths (bsc#1224956).
CVE-2023-52732: Blocklist the kclient when…

Record: SUSE-SU-2024:2184-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2185-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).

The following non-security bugs were fixed:

af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
btrfs: do not start relocation until in progress drops are done (bsc#1222251).
btrfs: do not start relocation until in progress drops are done (bsc#1222251).
cifs: add missing spinlock around tcon refcount (bsc#1213476).
cifs: avoid dup prefix path in dfs_get_automount_devname() (bsc#1213476).
cifs: avoid race conditions with parallel reconnects (bsc#1213476).
cifs: avoid re-lookups in dfs_cache_find() (bsc#1213476).
cifs: avoid use of global locks for high contention data (bsc#1213476).
cifs: check only tcon status on tcon related functions (bsc#1213476).
cifs: do all necessary checks for credits within or before locking (bsc#1213476).
cifs: do not block in dfs_cache_noreq_update_tgthint() (bsc#1213476).
cifs: do not refresh cached referrals from unactive mounts (bsc#1213476).
cifs: do not take exclusive lock for updating target hints (bsc#1213476).
cifs: fix confusing debug message (bsc#1213476).
cifs: fix missing unload_nls() in smb2_reconnect() (bsc#1213476).
cifs: fix potential deadlock in cache_refresh_path() (bsc#1213476).
cifs: fix refresh of cached referrals (bsc#1213476).
cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (bsc#1213476).
cifs: fix source pathname comparison of dfs supers (bsc#1213476).
cifs: fix status checks in cifs_tree_connect (bsc#1213476).
cifs: fix use-after-free bug in refresh_cache_worker() (bsc#1213476).
cifs: get rid of dns resolve worker (bsc#1213476).
cifs: get rid of mount options string parsing (bsc#1213476).
cifs: handle cache lookup errors different than -ENOENT (bsc#1213476).
cifs: ignore ipc reconnect failures during dfs failover (bsc#1213476).
cifs: match even the scope id for ipv6 addresses (bsc#1213476).
cifs: optimize reconnect of nested links (bsc#1213476).
cifs: prevent data race in smb2_reconnect() (bsc#1213476). -…

Record: SUSE-SU-2024:2185-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2189-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
CVE-2024-35863: Fix potential UAF in is_valid_oplock_break() (bsc#1224763).
CVE-2024-35867: Fix potential UAF in cifs_stats_proc_show() (bsc#1224664).
CVE-2024-35868: Fix potential UAF in cifs_stats_proc_write() (bsc#1224678).
CVE-2024-26928: Fix potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).
CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
CVE-2024-35904: Avoid dereference of garbage after mount failure (bsc#1224494).
CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).

The following non-security bugs were fixed:

af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
filemap: remove use of wait bookmarks (bsc#1224085).
idpf: extend tx watchdog timeout (bsc#1224137).
ipvs: Fix checksumming on GSO of SCTP packets (bsc#1221958)
powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).
powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).
powerpc/powernv: Add a null pointer check to scom_debug_init_one() (bsc#1194869).
powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV (bsc#1220492 ltc#205270).
powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).
powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).
powerpc: Refactor verification of MSR_RI (bsc#1223191).

Record: SUSE-SU-2024:2189-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2190-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
CVE-2023-42755: Check user supplied offsets (bsc#1215702).
CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
CVE-2023-52660: Fiedx IRQ handling due to shared interrupts (bsc#1224443).
CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
CVE-2024-26700: Fixed drm/amd/display: Fix MST Null Ptr for RV (bsc#1222870)
CVE-2024-26715: Fixed NULL pointer dereference in dwc3_gadget_suspend (bsc#1222561).
CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes bsc#1222608).
CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
CVE-2024-26777: Error out if pixclock equals zero in fbdev/sis (bsc#1222765)
CVE-2024-26778: Error out if pixclock equals zero in fbdev/savage (bsc#1222770)
CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
CVE-2024-26839: Fixed a memleak in init_credit_return() (bsc#1222975)
CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
CVE-2024-26907: Fixed a fortify source warning while accessing Eth segment in mlx5 (bsc#1223203).
CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
CVE-2024-27042: Fixed potential out-of-bounds access in…

Record: SUSE-SU-2024:2190-1
Updated: 2026-11-02

OSVSUSE-SU-2024:2341-1 No score

Security update for the Linux Kernel (Live Patch 43 for SLE 15 SP2)

This update for the Linux Kernel 5.3.18-150200_24_172 fixes several issues.