CVE-2023-39189

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.

The Linux Kernel, the operating system core itself.

Security Fix(es):

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39189)

A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39193)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39189)

A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39193)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach().(CVE-2022-44033)

An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.(CVE-2022-45919)

VUL-0: CVE-2023-2593: kernel: Linux Kernel ksmbd Memory Exhaustion Denial-of-Service Vulnerability(CVE-2023-2593)

There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem.(CVE-2023-2898)

An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur.(CVE-2023-31083)

An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.(CVE-2023-31085)

VUL-0: CVE-2023-32246: kernel: Linux Kernel ksmbd RCU Callback Race Condition Local Privilege Escalation Vulnerability(CVE-2023-32246)

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.(CVE-2023-32254)

Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable. A (malicious) guest administrator could cause a denial of service (DoS) in a backend domain (other than dom0) by disabling a paravirtualized device. A malicious backend could cause DoS in a guest running a Linux kernel by disabling a paravirtualized device.(CVE-2023-34324)

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39189)

A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure.(CVE-2023-39192)

A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39193)

A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information…

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach().(CVE-2022-44033)

An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.(CVE-2022-45919)

VUL-0: CVE-2023-2593: kernel: Linux Kernel ksmbd Memory Exhaustion Denial-of-Service Vulnerability(CVE-2023-2593)

There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem.(CVE-2023-2898)

An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur.(CVE-2023-31083)

An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.(CVE-2023-31085)

VUL-0: CVE-2023-32246: kernel: Linux Kernel ksmbd RCU Callback Race Condition Local Privilege Escalation Vulnerability(CVE-2023-32246)

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.(CVE-2023-32254)

Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable. A (malicious) guest administrator could cause a denial of service (DoS) in a backend domain (other than dom0) by disabling a paravirtualized device. A malicious backend could cause DoS in a guest running a Linux kernel by disabling a paravirtualized device.(CVE-2023-34324)

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39189)

A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure.(CVE-2023-39192)

A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39193)

A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information…

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach().(CVE-2022-44033)

An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.(CVE-2022-45919)

VUL-0: CVE-2023-2593: kernel: Linux Kernel ksmbd Memory Exhaustion Denial-of-Service Vulnerability(CVE-2023-2593)

There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem.(CVE-2023-2898)

An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur.(CVE-2023-31083)

An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.(CVE-2023-31085)

VUL-0: CVE-2023-32246: kernel: Linux Kernel ksmbd RCU Callback Race Condition Local Privilege Escalation Vulnerability(CVE-2023-32246)

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.(CVE-2023-32254)

Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable. A (malicious) guest administrator could cause a denial of service (DoS) in a backend domain (other than dom0) by disabling a paravirtualized device. A malicious backend could cause DoS in a guest running a Linux kernel by disabling a paravirtualized device.(CVE-2023-34324)

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39189)

A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure.(CVE-2023-39192)

A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39193)

A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux SIG Cloud 8.10 Release Notes linked from the References section.

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)
• kernel: multiple use-after-free vulnerabilities (CVE-2024-1086, CVE-2023-3567, CVE-2023-4133, CVE-2023-6932, CVE-2023-39198, CVE-2023-51043, CVE-2023-51779, CVE-2023-51780, CVE-2024-1085, CVE-2024-26582)
• kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)
• kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)
• kernel: multiple NULL pointer dereference vulnerabilities (CVE-2022-38096, CVE-2023-6622, CVE-2023-6915, CVE-2023-42754, CVE-2023-46862, CVE-2023-52574, CVE-2024-0841, CVE-2023-52448)
• kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934)
• kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040)
• kernel: GC's deletion of an SKB races with unix_stream_read_generic() leading to UAF (CVE-2023-6531)
• kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931)
• kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023)
• kernel: irdma: Improper access control (CVE-2023-25775)
• Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464)
• kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c (CVE-2023-28866)
• kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl (CVE-2023-31083)
• kernel: multiple out-of-bounds read vulnerabilities (CVE-2023-37453, CVE-2023-39189, CVE-2023-39193, CVE-2023-6121, CVE-2023-39194)
• kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP (CVE-2023-42756)
• kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write (CVE-2023-45863)
• kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)
• kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489)
• kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522)
• kernel: multiple memory leak vulnerabilities (CVE-2023-52529, CVE-2023-52581)
• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)
• kernel: net/core: kernel crash in ETH_P_1588 flow dissector (CVE-2023-52580)
• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)
• kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (CVE-2024-0565)
• kernel: tls: race between async notify and socket close (CVE-2024-26583)
• kernel: tls: handle backlogging of crypto requests (CVE-2024-26584)
• kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585)
• kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)
• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)
• kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)
• kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-26609)
• kernel: local dos vulnerability in scatterwalk_copychunks (CVE-2023-6176)
• kernel: perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476)
• kernel: netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620)
• kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2023-31085 // CVE-url: https://ubuntu.com/security/CVE-2023-31085
  • ubi: Refuse attaching if mtd's erasesize is 0
• Jammy update: v5.15.121 upstream stable release (LP: #2032689) // CVE-url: https://ubuntu.com/security/CVE-2023-4132
  • media: usb: siano: Fix warning due to null work_func_t function pointer
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-4132
  • media: usb: siano: Fix use after free bugs caused by do_submit_urb
• CVE-2023-5717 // CVE-url: https://ubuntu.com/security/CVE-2023-5717
  • perf: Disallow mis-matched inherited group reads
• CVE-url: https://ubuntu.com/security/CVE-2023-1838
  • Fix double fget() in vhost_net_set_backend()
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-1077
  • sched/rt: pick_next_rt_entity(): check list_entry
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-1076
  • net: add sock_init_data_uid()
  • tun: tun_chr_open(): correctly initialize socket uid
  • tap: tap_open(): correctly initialize socket uid
• CVE-url: https://ubuntu.com/security/CVE-2023-45863
  • kobject: Fix slab-out-of-bounds in fill_kobj_path()
• CVE-url: https://ubuntu.com/security/CVE-2023-45871
  • igb: set max size RX buffer when store bad packet is enabled
• Jammy update: v5.15.100 upstream stable release (LP: #2020387) // CVE-url: https://ubuntu.com/security/CVE-2023-45862
  • USB: ene_usb6250: Allocate enough memory for full object
• CVE-url: https://ubuntu.com/security/CVE-2023-39189
  • netfilter: nfnetlink_osf: avoid OOB read

• CVE-2023-31085 // CVE-url: https://ubuntu.com/security/CVE-2023-31085
  • ubi: Refuse attaching if mtd's erasesize is 0
• Jammy update: v5.15.121 upstream stable release (LP: #2032689) // CVE-url: https://ubuntu.com/security/CVE-2023-4132
  • media: usb: siano: Fix warning due to null work_func_t function pointer
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-4132
  • media: usb: siano: Fix use after free bugs caused by do_submit_urb
• CVE-2023-5717 // CVE-url: https://ubuntu.com/security/CVE-2023-5717
  • perf: Disallow mis-matched inherited group reads
• CVE-url: https://ubuntu.com/security/CVE-2023-1838
  • Fix double fget() in vhost_net_set_backend()
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-1077
  • sched/rt: pick_next_rt_entity(): check list_entry
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-1076
  • net: add sock_init_data_uid()
  • tun: tun_chr_open(): correctly initialize socket uid
  • tap: tap_open(): correctly initialize socket uid
• CVE-url: https://ubuntu.com/security/CVE-2023-45863
  • kobject: Fix slab-out-of-bounds in fill_kobj_path()
• CVE-url: https://ubuntu.com/security/CVE-2023-45871
  • igb: set max size RX buffer when store bad packet is enabled
• Jammy update: v5.15.100 upstream stable release (LP: #2020387) // CVE-url: https://ubuntu.com/security/CVE-2023-45862
  • USB: ene_usb6250: Allocate enough memory for full object
• CVE-url: https://ubuntu.com/security/CVE-2023-39189
  • netfilter: nfnetlink_osf: avoid OOB read

• CVE-url: https://ubuntu.com/security/CVE-2023-45871
  • igb: Limit maximum frame Rx based on MTU
  • igb: Only sync size of expected frame in ethtool testing
  • igb: Add support for ethtool private flag to allow use of legacy Rx
  • igb: Add support for using order 1 pages to receive large frames
  • igb: set max size RX buffer when store bad packet is enabled
• CVE-2023-31085 // CVE-url: https://ubuntu.com/security/CVE-2023-31085
  • ubi: Refuse attaching if mtd's erasesize is 0
• CVE-2023-5717 // CVE-url: https://ubuntu.com/security/CVE-2023-5717
  • perf: Disallow mis-matched inherited group reads
• Bionic update: upstream stable patchset 2022-09-23 (LP: #1990698) // CVE- url: https://ubuntu.com/security/CVE-2022-3629
  • vsock: Fix memory leak in vsock_connect()
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-1077
  • sched/rt: pick_next_rt_entity(): check list_entry
• CVE-url: https://ubuntu.com/security/CVE-2023-1077
  • sched/debug: Add SCHED_WARN_ON()
• CVE-url: https://ubuntu.com/security/CVE-2023-45863
  • kobject: Fix slab-out-of-bounds in fill_kobj_path()
• Jammy update: v5.15.100 upstream stable release (LP: #2020387) // CVE-url: https://ubuntu.com/security/CVE-2023-45862
  • USB: ene_usb6250: Allocate enough memory for full object
• CVE-url: https://ubuntu.com/security/CVE-2023-39189
  • netfilter: nfnetlink_osf: avoid OOB read

• CVE-url: https://ubuntu.com/security/CVE-2023-45871
  • igb: Limit maximum frame Rx based on MTU
  • igb: Only sync size of expected frame in ethtool testing
  • igb: Add support for ethtool private flag to allow use of legacy Rx
  • igb: Add support for using order 1 pages to receive large frames
  • igb: set max size RX buffer when store bad packet is enabled
• CVE-2023-31085 // CVE-url: https://ubuntu.com/security/CVE-2023-31085
  • ubi: Refuse attaching if mtd's erasesize is 0
• CVE-2023-5717 // CVE-url: https://ubuntu.com/security/CVE-2023-5717
  • perf: Disallow mis-matched inherited group reads
• Bionic update: upstream stable patchset 2022-09-23 (LP: #1990698) // CVE- url: https://ubuntu.com/security/CVE-2022-3629
  • vsock: Fix memory leak in vsock_connect()
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-1077
  • sched/rt: pick_next_rt_entity(): check list_entry
• CVE-url: https://ubuntu.com/security/CVE-2023-1077
  • sched/debug: Add SCHED_WARN_ON()
• CVE-url: https://ubuntu.com/security/CVE-2023-45863
  • kobject: Fix slab-out-of-bounds in fill_kobj_path()
• Jammy update: v5.15.100 upstream stable release (LP: #2020387) // CVE-url: https://ubuntu.com/security/CVE-2023-45862
  • USB: ene_usb6250: Allocate enough memory for full object
• CVE-url: https://ubuntu.com/security/CVE-2023-39189
  • netfilter: nfnetlink_osf: avoid OOB read

• net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() {CVE-2024-26882}
• tls: fix use-after-free on failed backlog decryption {CVE-2024-26800}
• tls: separate no-async decryption request handling from async {CVE-2024-26584}
• tls: decrement decrypt_pending if no async completion will be called {CVE-2024-26584}
• net: tls: fix use-after-free with partial reads and async decrypt {CVE-2024-26582}
• net: tls: handle backlogging of crypto requests {CVE-2024-26584}
• net: tls: factor out tls_*crypt_async_wait()
• tap: tap_open(): correctly initialize socket uid {CVE-2023-1076}
• tun: tun_chr_open(): correctly initialize socket uid {CVE-2023-1076}
• net: add sock_init_data_uid() {CVE-2023-1076}
• netfilter: nf_tables: bail out on mismatching dynset and set expressions {CVE-2023-6622}
• drm/qxl: fix UAF on handle creation {CVE-2023-39198}
• smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
• USB: core: Fix deadlock in port "disable" sysfs attribute {CVE-2024-26933}
• USB: core: Add hub_get() and hub_put() routines {CVE-2024-26933}
• USB: core: Fix deadlock in usb_deauthorize_interface() {CVE-2024-26934}
• scsi: qla2xxx: Fix double free of fcport {CVE-2024-26929}
• netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() {CVE-2024-27020}
• net: ip_tunnel: prevent perpetual headroom growth {CVE-2024-26804}
• netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout {CVE-2024-26643}
• netfilter: nf_tables: disallow anonymous set with timeout flag {CVE-2024-26642}
• netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations {CVE-2024-26673}
• ipv6: sr: fix possible use-after-free and null-ptr-deref {CVE-2024-26735}
• fs: sysfs: Fix reference leak in sysfs_break_active_protection() {CVE-2024-26993}
• cifs: fix underflow in parse_server_interfaces() {CVE-2024-26828}
• mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path {CVE-2024-26595}
• mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code {CVE-2024-26595}
• mlxsw: spectrum_acl_tcam: Make fini symmetric to init {CVE-2024-26595}
• mlxsw: spectrum_acl_tcam: Add missing mutex_destroy() {CVE-2024-26595}
• net: xfrm: Fix xfrm_address_filter OOB read {CVE-2023-39194}
• exfat: check if filename entries exceeds max filename length {CVE-2023-4273}
• xfrm: add NULL check in xfrm_update_ae_params {CVE-2023-3772}
• firmware: arm_scmi: Harden accesses to the reset domains {CVE-2022-48655}
• tcp: Reduce chance of collisions in inet6_hashfn(). {CVE-2023-1206}
• ipv4: fix null-deref in ipv4_link_failure {CVE-2023-42754}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2023-39189}
• netfilter: xt_sctp: validate the flag_info count {CVE-2023-39193}
• net: qcom/emac: Fix use after free bug in emac_remove due to race condition {CVE-2023-33203}
• net/tls: tls_is_tx_ready() checked list_entry {CVE-2023-1075}
• HID: asus: use spinlock to safely schedule workers {CVE-2023-1079}
• HID: asus: use spinlock to protect concurrent accesses {CVE-2023-1079}
• HID: intel_ish-hid: Add check for ishtp_dma_tx_map {CVE-2023-3358}
• gfs2: Don't deref jdesc in evict {CVE-2023-3212}
• fbcon: Check font dimension limits {CVE-2023-3161}
• KVM: nVMX: add missing consistency checks for CR0 and CR4 {CVE-2023-30456}
• hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition {CVE-2023-1855}
• Bluetooth: HCI: Fix global-out-of-bounds {CVE-2023-28866}
• HID: check empty report_list in hid_validate_values() {CVE-2023-1073}
• net: mpls: fix stale pointer if allocation fails during device rename {CVE-2023-26545}
• r8152: Rate limit overflow messages {CVE-2022-3594}
• drm/vmwgfx: Fix shader stage validation {CVE-2022-36402}
• Bluetooth: L2CAP: Fix attempting to access uninitialized memory {CVE-2022-42895}
• dm ioctl: fix nested locking in table_clear() to remove deadlock concern {CVE-2023-2269}
• mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy() {CVE-2023-52562} -…

• libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
• drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
• netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
• scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
• drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
• ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
• tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
• wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
• ethtool: do not perform operations on net devices being unregistered {CVE-2021-47517}
• cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
• bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
• asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
• kyber: fix out of bounds access when preempted {CVE-2021-46984}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• tls: separate no-async decryption request handling from async {CVE-2024-58240}
• ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
• Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
• nfsd: fix use-after-free due to delegation race {CVE-2021-47506}
• drm: bridge/panel: Cleanup connector on bridge detach {CVE-2021-47063}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2023-39189}
• crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer {CVE-2021-47226}
• kvm: LAPIC: Restore guard to prevent illegal APIC register access {CVE-2021-47255}
• tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
• macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• RDMA/cxgb4: Do not dma memory off of the stack {CVE-2019-17075}
• netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) {CVE-2019-7221}
• RDMA/umad: Reject negative data_len in…

This kernel update is based on upstream 6.5.11 and fixes or adds mitigations for at least the following security issues:

A use-after-free vulnerability was found in drivers/nvme/target/tcp.cinnvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation in case that the attacker already has local privileges. (CVE-2023-5178)

x86: KVM: SVM: always update the x2avic msr interception: The following problem exists since x2avic was enabled in the KVM: svm_set_x2apic_msr_interception is called to enable the interception of the x2apic msrs. In particular it is called at the moment the guest resets its apic. Assuming that the guest's apic is in x2apic mode, the reset will bring it back to the xapic mode. The svm_set_x2apic_msr_interception however has an erroneous check for '!apic_x2apic_mode()' which prevents it from doing anything in this case. As a result of this, all x2apic msrs are left unintercepted, and that exposes the bare metal x2apic (if enabled) to the guest. Removing the erroneous '!apic_x2apic_mode()' check fixes that. (CVE-2023-5090)

In unprivileged Xen guests event handling can cause a deadlock with Xen console handling. The evtchn_rwlock and the hvc_lock are taken in opposite sequence in __hvc_poll() and in Xen console IRQ handling. This is fixed by xen/events: replace evtchn_rwlock with RCU (CVE-2023-34324)

A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free. We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705 (CVE-2023-5345)

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (CVE-2023-39189)

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges. (CVE-2023-5633)

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06. (CVE-2023-5717)

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it. (CVE-2023-46813)

A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to crash the system or escalate their privileges on the system. (CVE-2023-6176)

Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of…

This kernel update is based on upstream 6.5.11 and fixes or adds mitigations for at least the following security issues:

A use-after-free vulnerability was found in drivers/nvme/target/tcp.cinnvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation in case that the attacker already has local privileges. (CVE-2023-5178)

x86: KVM: SVM: always update the x2avic msr interception: The following problem exists since x2avic was enabled in the KVM: svm_set_x2apic_msr_interception is called to enable the interception of the x2apic msrs. In particular it is called at the moment the guest resets its apic. Assuming that the guest's apic is in x2apic mode, the reset will bring it back to the xapic mode. The svm_set_x2apic_msr_interception however has an erroneous check for '!apic_x2apic_mode()' which prevents it from doing anything in this case. As a result of this, all x2apic msrs are left unintercepted, and that exposes the bare metal x2apic (if enabled) to the guest. Removing the erroneous '!apic_x2apic_mode()' check fixes that. (CVE-2023-5090)

In unprivileged Xen guests event handling can cause a deadlock with Xen console handling. The evtchn_rwlock and the hvc_lock are taken in opposite sequence in __hvc_poll() and in Xen console IRQ handling. This is fixed by xen/events: replace evtchn_rwlock with RCU (CVE-2023-34324)

A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free. We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705 (CVE-2023-5345)

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (CVE-2023-39189)

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges. (CVE-2023-5633)

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06. (CVE-2023-5717)

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it. (CVE-2023-46813)

A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to crash the system or escalate their privileges on the system. (CVE-2023-6176)

Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-5178: Fixed an UAF in queue intialization setup. (bsc#1215768)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)
• CVE-2023-39191: Fixed a lack of validation of dynamic pointers within user-supplied eBPF programs that may have allowed an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code. (bsc#1215863)
• CVE-2023-2860: Fixed an out-of-bounds read vulnerability in the processing of seg6 attributes. This flaw allowed a privileged local user to disclose sensitive information. (bsc#1211592)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
• ALSA: hda/realtek - ALC287 I2S speaker platform support (git-fixes).
• ALSA: hda/realtek - ALC287 merge RTK codec with CS CS35L41 AMP (git-fixes).
• ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (git-fixes).
• ALSA: hda/realtek - Fixed two speaker platform (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV (git-fixes).
• ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
• ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx (git-fixes).
• ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (git-fixes).
• ALSA: hda: intel-dsp-cfg: add LunarLake support (git-fixes).
• ALSA: hda: intel-sdw-acpi: Use u8 type for link index (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Nexigo webcam (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
• ASoC: amd: yc: Fix non-functional mic on Lenovo 82YM (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
• ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
• ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
• ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag (git-fixes).
• ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link (git-fixes).
• ASoC: pxa: fix a memory leak in probe() (git-fixes).
• Bluetooth: Avoid redundant authentication (git-fixes).
• Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
• Bluetooth: ISO: Fix handling of listen for unicast (git-fixes).
• Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes).
• Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
• Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
• Bluetooth: hci_codec: Fix leaking content of local_codecs (git-fixes).
• Bluetooth: hci_event: Fix coding style (git-fixes).
• Bluetooth: hci_event: Fix using memcmp when comparing keys (git-fixes).
• Bluetooth: hci_event: Ignore NULL link key (git-fixes).
• Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes). -…

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-46813: Fixed an incorrect access checking in the VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses that could lead to arbitrary write access to kernel memory. (bsc#1212649)
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-5178: Fixed an UAF in queue intialization setup. (bsc#1215768)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
• ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (git-fixes).
• ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
• ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
• ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
• ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag (git-fixes).
• ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link (git-fixes).
• ASoC: pxa: fix a memory leak in probe() (git-fixes).
• ata: libata-core: Do not register PM operations for SAS ports (git-fixes).
• ata: libata-core: Fix ata_port_request_pm() locking (git-fixes).
• ata: libata-core: Fix port and device removal (git-fixes).
• ata: libata-sata: increase PMP SRST timeout to 10s (git-fixes).
• ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES (git-fixes).
• blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init (bsc#1216062).
• blk-cgroup: support to track if policy is online (bsc#1216062).
• Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
• Bluetooth: Avoid redundant authentication (git-fixes).
• Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
• Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
• Bluetooth: hci_event: Fix coding style (git-fixes).
• Bluetooth: hci_event: Fix using memcmp when comparing keys (git-fixes).
• Bluetooth: hci_event: Ignore NULL link key (git-fixes).
• Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes).
• Bluetooth: hci_sock: fix slab oob read in create_monitor_event (git-fixes).
• Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes).
• Bluetooth: vhci: Fix race when opening vhci device (git-fixes).
• bpf: propagate precision in ALU/ALU64 operations (git-fixes).
• bus: ti-sysc: Fix missing AM35xx SoC matching (git-fixes).
• bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset()…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• audit: fix potential double free on error path from fsnotify_add_inode_mark (git-fixes).
• crypto: virtio: Fix use-after-free in virtio_crypto_skcipher_finalize_req() (git-fixes).
• iommu/amd: Fix IOMMU interrupt generation in X2APIC mode (bsc#1206010).
• iommu/amd: Remove useless irq affinity notifier (bsc#1206010).
• iommu/amd: Set iommu->int_enabled consistently when interrupts are set up (bsc#1206010).
• kabi: iommu/amd: Fix IOMMU interrupt generation in X2APIC mode (bsc#1206010).
• KVM: s390: fix sthyi error handling (git-fixes bsc#1216107).
• memcg: drop kmem.limit_in_bytes (bsc#1208788) This brings a breaking commit for easier backport, it'll be fixed differently in a following commit.
• mm, memcg: reconsider kmem.limit_in_bytes deprecation (bsc#1208788 bsc#1213705).
• net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read (git-fixes).
• net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (git-fixes).
• ratelimit: Fix data-races in ___ratelimit() (git-fixes).
• ring-buffer: Fix bytes info in per_cpu buffer stats (git-fixes).
• s390/pci: fix iommu bitmap allocation (git-fixes bsc#1216513).
• s390/ptrace: fix setting syscall number (git-fixes bsc#1216340).
• s390/vdso: add missing FORCE to build targets (git-fixes bsc#1216140).
• s390/zcrypt: change reply buffer size offering (LTC#203322 bsc#1213950).
• s390/zcrypt: fix reply buffer calculations for CCA replies (LTC#203322 bsc#1213950).
• sched: Avoid scale real weight down to zero (git fixes (sched)).
• sched: correct SD_flags returned by tl->sd_flags() (git fixes (sched)).
• sched: Reenable interrupts in do_sched_yield() (git fixes (sched)).
• sched/core: Fix migration to invalid CPU in __set_cpus_allowed_ptr() (git fixes (sched)).
• sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain() (git fixes (sched)).
• sched/fair: Do not balance task to its current running CPU (git fixes (sched)).
• sched/rt: Minimize rq->lock contention in do_sched_rt_period_timer() (git fixes (sched)).
• sched/rt: Restore rt_runtime after disabling RT_RUNTIME_SHARE (git fixes (sched)).
• scsi: zfcp: Defer fc_rport blocking until after ADISC response (LTC#203327 bsc#1213977 git-fixes).
• scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes bsc#1216514).
• tools/thermal: Fix possible path truncations (git-fixes).
• tracing: Fix cpu buffers unavailable due to 'record_disabled' missed (git-fixes).
• tracing: Fix memleak due to race between current_tracer and trace (git-fixes).
• tracing: Fix race issue between cpu buffer write and swap (git-fixes).
• uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 (git-fixes).
• usb: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs (git-fixes).
• usb: typec: altmodes/displayport: Fix configure initial pin assignment (git-fixes).
• usb: typec: altmodes/displayport: fix pin_assignment_show (git-fixes).
• vhost-scsi: unbreak any layout for response (git-fixes).
• virtio_balloon: fix deadlock on OOM (git-fixes).
• virtio_balloon: fix increment of vb->num_pfns in fill_balloon() (git-fixes).
• virtio_net: Fix error unwinding of XDP initialization (git-fixes). -…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)
• CVE-2023-39194: Fixed an out of bounds read in the XFRM subsystem (bsc#1215861).
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-39192: Fixed an out of bounds read in the netfilter (bsc#1215858).
• CVE-2023-42754: Fixed a NULL pointer dereference in the IPv4 stack that could lead to denial of service (bsc#1215467).
• CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table which could be exploited by network adjacent attackers, increasing CPU usage by 95% (bsc#1212703).
• CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be exploited to achieve local privilege escalation (bsc#1215275).
• CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215117).
• CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to achieve local privilege escalation (bsc#1215115).
• CVE-2020-36766: Fixed a potential information leak in in the CEC driver (bsc#1215299).
• CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs which could be exploited to crash the system (bsc#1210169).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
• CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995).

The following non-security bugs were fixed:

• check-for-config-changes: ignore BUILTIN_RETURN_ADDRESS_STRIPS_PAC (bsc#1214380). gcc7 on SLE 15 does not support this while later gcc does.
• mkspec: Allow unsupported KMPs (bsc#1214386)
• old-flavors: Drop 2.6 kernels. 2.6 based kernels are EOL, upgrading from them is no longer suported.

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-39194: Fixed an out of bounds read in the XFRM subsystem (bsc#1215861).
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-39192: Fixed an out of bounds read in the netfilter (bsc#1215858).
• CVE-2023-42754: Fixed a NULL pointer dereference in the IPv4 stack that could lead to denial of service (bsc#1215467).

The following non-security bugs were fixed:

• bpf: propagate precision in ALU/ALU64 operations (git-fixes).
• KVM: x86: fix sending PV IPI (git-fixes, bsc#1210853, bsc#1216134).
• nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() (bsc#1214842).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• audit: fix potential double free on error path from fsnotify_add_inode_mark (git-fixes).
• CKC: Clarify usage
• crypto: virtio: Fix use-after-free in virtio_crypto_skcipher_finalize_req() (git-fixes).
• iommu/amd: Fix IOMMU interrupt generation in X2APIC mode (bsc#1206010).
• iommu/amd: Remove useless irq affinity notifier (bsc#1206010).
• iommu/amd: Set iommu->int_enabled consistently when interrupts are set up (bsc#1206010).
• kabi: iommu/amd: Fix IOMMU interrupt generation in X2APIC mode (bsc#1206010).
• KVM: s390: fix sthyi error handling (git-fixes bsc#1216107).
• memcg: drop kmem.limit_in_bytes (bsc#1208788)
• mm, memcg: reconsider kmem.limit_in_bytes deprecation (bsc#1208788 bsc#1213705).
• net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read (git-fixes).
• net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (git-fixes).
• ratelimit: Fix data-races in ___ratelimit() (git-fixes).
• ring-buffer: Fix bytes info in per_cpu buffer stats (git-fixes).
• s390/pci: fix iommu bitmap allocation (git-fixes bsc#1216513).
• s390/ptrace: fix setting syscall number (git-fixes bsc#1216340).
• s390/vdso: add missing FORCE to build targets (git-fixes bsc#1216140).
• s390/zcrypt: change reply buffer size offering (LTC#203322 bsc#1213950).
• s390/zcrypt: fix reply buffer calculations for CCA replies (LTC#203322 bsc#1213950).
• sched: Avoid scale real weight down to zero (git fixes (sched)).
• sched: correct SD_flags returned by tl->sd_flags() (git fixes (sched)).
• sched: Reenable interrupts in do_sched_yield() (git fixes (sched)).
• sched/core: Fix migration to invalid CPU in __set_cpus_allowed_ptr() (git fixes (sched)).
• sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain() (git fixes (sched)).
• sched/fair: Do not balance task to its current running CPU (git fixes (sched)).
• sched/rt: Minimize rq->lock contention in do_sched_rt_period_timer() (git fixes (sched)).
• sched/rt: Restore rt_runtime after disabling RT_RUNTIME_SHARE (git fixes (sched)).
• scsi: zfcp: Defer fc_rport blocking until after ADISC response (LTC#203327 bsc#1213977 git-fixes).
• scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes bsc#1216514).
• tools/thermal: Fix possible path truncations (git-fixes).
• tracing: Fix cpu buffers unavailable due to 'record_disabled' missed (git-fixes).
• tracing: Fix memleak due to race between current_tracer and trace (git-fixes).
• tracing: Fix race issue between cpu buffer write and swap (git-fixes).
• uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 (git-fixes).
• usb: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs (git-fixes).
• usb: typec: altmodes/displayport: Fix configure initial pin assignment (git-fixes).
• usb: typec: altmodes/displayport: fix pin_assignment_show (git-fixes).
• use optional first argument as a base-ref instead of upstream branch
• vhost-scsi: unbreak any layout for response (git-fixes).
• virtio_balloon: fix deadlock on OOM (git-fixes).
• virtio_balloon: fix increment of vb->num_pfns in fill_balloon() (git-fixes).
• virtio_net: Fix error unwinding of XDP initialization (git-fixes).
• virtio: Protect vqs…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1212649).
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-5178: Fixed an UAF in queue intialization setup. (bsc#1215768)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
• ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
• ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
• ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
• ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
• ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag (git-fixes).
• ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link (git-fixes).
• ASoC: pxa: fix a memory leak in probe() (git-fixes).
• Bluetooth: Avoid redundant authentication (git-fixes).
• Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
• Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes).
• Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
• Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
• Bluetooth: hci_event: Fix coding style (git-fixes).
• Bluetooth: hci_event: Fix using memcmp when comparing keys (git-fixes).
• Bluetooth: hci_event: Ignore NULL link key (git-fixes).
• Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes).
• Bluetooth: hci_sock: fix slab oob read in create_monitor_event (git-fixes).
• Bluetooth: vhci: Fix race when opening vhci device (git-fixes).
• Documentation: qat: change kernel version (PED-6401).
• Documentation: qat: rewrite description (PED-6401).
• Drivers: hv: vmbus: Call hv_synic_free() if hv_synic_alloc() fails (git-fixes).
• Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs (git-fixes).
• Fix metadata references
• HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (git-fixes).
• HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit (git-fixes).
• HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (git-fixes).
• HID: multitouch: Add required quirk for Synaptics 0xcd7e device (git-fixes).
• HID: sony: Fix a potential memory leak in sony_probe() (git-fixes).
• HID: sony: remove duplicate NULL check before calling usb_free_urb() (git-fixes).
• IB/mlx4: Fix the size of a buffer in add_port_entries() (git-fixes)
• Input: goodix - ensure int GPIO is in input for gpio_count == 1…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-39194: Fixed an out of bounds read in the XFRM subsystem (bsc#1215861).
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-39192: Fixed an out of bounds read in the netfilter (bsc#1215858).
• CVE-2023-42754: Fixed a NULL pointer dereference in the IPv4 stack that could lead to denial of service (bsc#1215467).

The following non-security bugs were fixed:

• nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() (bsc#1214842).

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• audit: fix potential double free on error path from fsnotify_add_inode_mark (git-fixes).
• crypto: virtio: Fix use-after-free in virtio_crypto_skcipher_finalize_req() (git-fixes).
• iommu/amd: Fix IOMMU interrupt generation in X2APIC mode (bsc#1206010).
• iommu/amd: Remove useless irq affinity notifier (bsc#1206010).
• iommu/amd: Set iommu->int_enabled consistently when interrupts are set up (bsc#1206010).
• kabi: iommu/amd: Fix IOMMU interrupt generation in X2APIC mode (bsc#1206010).
• KVM: s390: fix sthyi error handling (git-fixes bsc#1216107).
• memcg: drop kmem.limit_in_bytes (bsc#1208788)
• mm, memcg: reconsider kmem.limit_in_bytes deprecation (bsc#1208788 bsc#1213705).
• net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read (git-fixes).
• net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (git-fixes).
• ratelimit: Fix data-races in ___ratelimit() (git-fixes).
• ring-buffer: Fix bytes info in per_cpu buffer stats (git-fixes).
• s390/pci: fix iommu bitmap allocation (git-fixes bsc#1216513).
• s390/ptrace: fix setting syscall number (git-fixes bsc#1216340).
• s390/vdso: add missing FORCE to build targets (git-fixes bsc#1216140).
• s390/zcrypt: change reply buffer size offering (LTC#203322 bsc#1213950).
• s390/zcrypt: fix reply buffer calculations for CCA replies (LTC#203322 bsc#1213950).
• scsi: zfcp: Defer fc_rport blocking until after ADISC response (LTC#203327 bsc#1213977 git-fixes).
• scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes bsc#1216514).
• tools/thermal: Fix possible path truncations (git-fixes).
• tracing: Fix cpu buffers unavailable due to 'record_disabled' missed (git-fixes).
• tracing: Fix memleak due to race between current_tracer and trace (git-fixes).
• tracing: Fix race issue between cpu buffer write and swap (git-fixes).
• uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 (git-fixes).
• usb: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs (git-fixes).
• usb: typec: altmodes/displayport: Fix configure initial pin assignment (git-fixes).
• usb: typec: altmodes/displayport: fix pin_assignment_show (git-fixes).
• vhost-scsi: unbreak any layout for response (git-fixes).
• virtio_balloon: fix deadlock on OOM (git-fixes).
• virtio_balloon: fix increment of vb->num_pfns in fill_balloon() (git-fixes).
• virtio_net: Fix error unwinding of XDP initialization (git-fixes).
• virtio: Protect vqs list access (git-fixes).
• vsock/virtio: add transport parameter to the virtio_transport_reset_no_sock() (git-fixes).
• xen-netback: use default TX queue size for vifs (git-fixes).
• xen/x86: obtain full video frame buffer address for Dom0 also under EFI (bsc#1215743).
• xen/x86: obtain upper 32 bits of video frame buffer address for Dom0 (bsc#1215743).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1212649).
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-5178: Fixed an use-after-free and a double-free flaw that could allow a malicious user to execute a remote code execution. (bsc#1215768)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)
• CVE-2023-39191: Fixed a lack of validation of dynamic pointers within user-supplied eBPF programs that may have allowed an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code. (bsc#1215863)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
• ALSA: hda/realtek - ALC287 I2S speaker platform support (git-fixes).
• ALSA: hda/realtek - ALC287 merge RTK codec with CS CS35L41 AMP (git-fixes).
• ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (git-fixes).
• ALSA: hda/realtek - Fixed two speaker platform (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV (git-fixes).
• ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
• ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx (git-fixes).
• ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (git-fixes).
• ALSA: hda: intel-dsp-cfg: add LunarLake support (git-fixes).
• ALSA: hda: intel-sdw-acpi: Use u8 type for link index (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Nexigo webcam (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
• ASoC: amd: yc: Fix non-functional mic on Lenovo 82YM (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
• ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
• ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
• ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag (git-fixes).
• ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link (git-fixes).
• ASoC: pxa: fix a memory leak in probe() (git-fixes).
• Bluetooth: Avoid redundant authentication (git-fixes).
• Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
• Bluetooth: ISO: Fix handling of listen for unicast (git-fixes).
• Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes).
• Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
• Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
• Bluetooth: hci_codec: Fix leaking content of local_codecs (git-fixes).
• Bluetooth: hci_event: Fix coding style (git-fixes).
• Bluetooth: hci_event: Fix using memcmp when comparing keys (git-fixes).
• Bluetooth: hci_event: Ignore NULL link key (git-fixes).
• Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes). -…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-39194: Fixed an out of bounds read in the XFRM subsystem (bsc#1215861).
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-39192: Fixed an out of bounds read in the netfilter (bsc#1215858).
• CVE-2023-42754: Fixed a NULL pointer dereference in the IPv4 stack that could lead to denial of service (bsc#1215467).

The following non-security bugs were fixed:

• KVM: x86: fix sending PV IPI (git-fixes, bsc#1210853, bsc#1216134).
• bpf: propagate precision in ALU/ALU64 operations (git-fixes).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)
• CVE-2023-5178: Fixed an UAF in queue intialization setup. (bsc#1215768)
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
• ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (git-fixes).
• ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
• ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
• ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
• ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag (git-fixes).
• ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link (git-fixes).
• ASoC: pxa: fix a memory leak in probe() (git-fixes).
• ata: libata-core: Do not register PM operations for SAS ports (git-fixes).
• ata: libata-core: Fix ata_port_request_pm() locking (git-fixes).
• ata: libata-core: Fix port and device removal (git-fixes).
• ata: libata-sata: increase PMP SRST timeout to 10s (git-fixes).
• ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES (git-fixes).
• blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init (bsc#1216062).
• blk-cgroup: support to track if policy is online (bsc#1216062).
• Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
• Bluetooth: Avoid redundant authentication (git-fixes).
• Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
• Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
• Bluetooth: hci_event: Fix coding style (git-fixes).
• Bluetooth: hci_event: Fix using memcmp when comparing keys (git-fixes).
• Bluetooth: hci_event: Ignore NULL link key (git-fixes).
• Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes).
• Bluetooth: hci_sock: fix slab oob read in create_monitor_event (git-fixes).
• Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes).
• Bluetooth: vhci: Fix race when opening vhci device (git-fixes).
• bpf: propagate precision in ALU/ALU64 operations (git-fixes).
• bus: ti-sysc: Fix missing AM35xx SoC matching (git-fixes).
• bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset() (git-fixes).
• cgroup: Remove duplicates in cgroup v1 tasks file (bsc#1211307).
• cgroup/cpuset: Change references of cpuset_mutex to cpuset_rwsem (bsc#1215955).
• clk: tegra: fix error return case for recalc_rate (git-fixes).
• counter: microchip-tcb-capture: Fix the use of internal GCLK logic (git-fixes).
• crypto: qat - add fw_counters debugfs file (PED-6401).
• crypto: qat - add…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1212649).
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-5178: Fixed an UAF in queue intialization setup. (bsc#1215768)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)
• CVE-2023-39191: Fixed a lack of validation of dynamic pointers within user-supplied eBPF programs that may have allowed an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code. (bsc#1215863)
• CVE-2023-2860: Fixed an out-of-bounds read vulnerability in the processing of seg6 attributes. This flaw allowed a privileged local user to disclose sensitive information. (bsc#1211592)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
• ALSA: hda/realtek - ALC287 I2S speaker platform support (git-fixes).
• ALSA: hda/realtek - ALC287 merge RTK codec with CS CS35L41 AMP (git-fixes).
• ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (git-fixes).
• ALSA: hda/realtek - Fixed two speaker platform (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV (git-fixes).
• ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
• ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx (git-fixes).
• ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (git-fixes).
• ALSA: hda: intel-dsp-cfg: add LunarLake support (git-fixes).
• ALSA: hda: intel-sdw-acpi: Use u8 type for link index (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Nexigo webcam (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
• ASoC: amd: yc: Fix non-functional mic on Lenovo 82YM (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
• ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
• ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
• ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag (git-fixes).
• ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link (git-fixes).
• ASoC: pxa: fix a memory leak in probe() (git-fixes).
• Bluetooth: Avoid redundant authentication (git-fixes).
• Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
• Bluetooth: ISO: Fix handling of listen for unicast (git-fixes).
• Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes).
• Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
• Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
• Bluetooth: hci_codec: Fix leaking content of local_codecs…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table which could be exploited by network adjacent attackers, increasing CPU usage by 95% (bsc#1212703).
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS (bsc#1210778).
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure (bsc#1216046).
• CVE-2023-39192: Fixed an out of bounds read in the netfilter (bsc#1215858).
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).

Yu Hao discovered that the UBI driver in the Linux kernel did not properly check for MTD with zero erasesize during device attachment. A local privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-31085)

Marek Marczykowski-Górecki discovered that the Xen event channel infrastructure implementation in the Linux kernel contained a race condition. An attacker in a guest VM could possibly use this to cause a denial of service (paravirtualized device unavailability). (CVE-2023-34324)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Bien Pham discovered that the netfiler subsystem in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local user could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4244)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference vulnerability. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-42754)

It was discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel did not properly handle network packets in certain conditions, leading to a use after free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4921)

It was discovered that the SMB network file sharing protocol implementation in the Linux kernel did not properly handle certain error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5345)

Yu Hao discovered that the UBI driver in the Linux kernel did not properly check for MTD with zero erasesize during device attachment. A local privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-31085)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did not properly validate u32 packets content, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39192)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate SCTP data, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39193)

Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly handle state filters, leading to an out- of-bounds read vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39194)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference vulnerability. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-42754)

It was discovered that the USB ENE card reader driver in the Linux kernel did not properly allocate enough memory when processing the storage device boot blocks. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-45862)

Manfred Rudigier discovered that the Intel(R) PCI-Express Gigabit (igb) Ethernet driver in the Linux kernel did not properly validate received frames that are larger than the set MTU size, leading to a buffer overflow vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-45871)

Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

Yu Hao discovered that the UBI driver in the Linux kernel did not properly check for MTD with zero erasesize during device attachment. A local privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-31085)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did not properly validate u32 packets content, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39192)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate SCTP data, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39193)

Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly handle state filters, leading to an out- of-bounds read vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39194)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference vulnerability. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-42754)

It was discovered that the USB ENE card reader driver in the Linux kernel did not properly allocate enough memory when processing the storage device boot blocks. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-45862)

Manfred Rudigier discovered that the Intel(R) PCI-Express Gigabit (igb) Ethernet driver in the Linux kernel did not properly validate received frames that are larger than the set MTU size, leading to a buffer overflow vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-45871)

Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. (CVE-2023-20593)

Yu Hao discovered that the UBI driver in the Linux kernel did not properly check for MTD with zero erasesize during device attachment. A local privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-31085)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did not properly validate u32 packets content, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39192)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate SCTP data, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39193)

Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly handle state filters, leading to an out- of-bounds read vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39194)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference vulnerability. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-42754)

It was discovered that the USB ENE card reader driver in the Linux kernel did not properly allocate enough memory when processing the storage device boot blocks. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-45862)

Manfred Rudigier discovered that the Intel(R) PCI-Express Gigabit (igb) Ethernet driver in the Linux kernel did not properly validate received frames that are larger than the set MTU size, leading to a buffer overflow vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-45871)

Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors in certain situations, leading to a out-of-bounds read vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-37453)

Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly initialize a policy data structure, leading to an out-of-bounds vulnerability. A local privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3773)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did not properly validate u32 packets content, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39192)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate SCTP data, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39193)

Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly handle state filters, leading to an out- of-bounds read vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39194)

It was discovered that a race condition existed in QXL virtual GPU driver in the Linux kernel, leading to a use after free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-39198)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference vulnerability. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-42754)

Jason Wang discovered that the virtio ring implementation in the Linux kernel did not properly handle iov buffers in some situations. A local attacker in a guest VM could use this to cause a denial of service (host system crash). (CVE-2023-5158)

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly handle queue initialization failures in certain situations, leading to a use-after-free vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5178)

Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

It was discovered that the Microchip USB Ethernet driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-6039)

It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors in certain situations, leading to a out-of-bounds read vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-37453)

Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly initialize a policy data structure, leading to an out-of-bounds vulnerability. A local privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3773)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did not properly validate u32 packets content, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39192)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate SCTP data, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39193)

Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly handle state filters, leading to an out- of-bounds read vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39194)

It was discovered that a race condition existed in QXL virtual GPU driver in the Linux kernel, leading to a use after free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-39198)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference vulnerability. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-42754)

Jason Wang discovered that the virtio ring implementation in the Linux kernel did not properly handle iov buffers in some situations. A local attacker in a guest VM could use this to cause a denial of service (host system crash). (CVE-2023-5158)

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly handle queue initialization failures in certain situations, leading to a use-after-free vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5178)

Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

It was discovered that the Microchip USB Ethernet driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-6039)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference vulnerability. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-42754)

Yikebaer Aizezi discovered that the ext4 file system implementation in the Linux kernel contained a use-after-free vulnerability when handling inode extent metadata. An attacker could use this to construct a malicious ext4 file system image that, when mounted, could cause a denial of service (system crash). (CVE-2023-45898)

Jason Wang discovered that the virtio ring implementation in the Linux kernel did not properly handle iov buffers in some situations. A local attacker in a guest VM could use this to cause a denial of service (host system crash). (CVE-2023-5158)

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly handle queue initialization failures in certain situations, leading to a use-after-free vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5178)

Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

It was discovered that Spectre-BHB mitigations were missing for Ampere processors. A local attacker could potentially use this to expose sensitive information. (CVE-2023-3006)

It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors in certain situations, leading to a out-of-bounds read vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-37453)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did not properly validate u32 packets content, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39192)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate SCTP data, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39193)

Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly handle state filters, leading to an out- of-bounds read vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39194)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference vulnerability. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-42754)

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly handle queue initialization failures in certain situations, leading to a use-after-free vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5178)

Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

It was discovered that the TLS subsystem in the Linux kernel did not properly perform cryptographic operations in some situations, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6176)