CVE-2022-29901

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.

The Linux Kernel, the operating system core itself.

Security Fix(es):

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.(CVE-2022-29901)

A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition.(CVE-2022-4269)

A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data.(CVE-2023-1079)

Kernel: denial of service in tipc_conn_close(CVE-2023-1382)

do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference).(CVE-2023-28466)

Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2.(CVE-2023-1281)

The Linux Kernel, the operating system core itself.

Security Fix(es):

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.(CVE-2022-29901)

A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition.(CVE-2022-4269)

A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data.(CVE-2023-1079)

Kernel: denial of service in tipc_conn_close(CVE-2023-1382)

do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference).(CVE-2023-28466)

Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2.(CVE-2023-1281)

The Linux Kernel, the operating system core itself.

Security Fix(es):

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.(CVE-2022-29901)

A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition.(CVE-2022-4269)

A null pointer dereference issue was found in the unix protocol in net/unix/diag.c in Linux before 6.0. In unix_diag_get_exact, the newly allocated skb does not have sk, leading to null pointer. A local user could use this flaw to crash the system or potentially cause a denial of service.

Reference: https://lore.kernel.org/netdev/CAO4mrfdvyjFpokhNsiwZiP-wpdSD0AStcJwfKcKQdAALQ9_2Qw@mail.gmail.com/ https://lore.kernel.org/netdev/[email protected]/ https://lore.kernel.org/netdev/[email protected]/T/(CVE-2023-28327)

Kernel: A denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c(CVE-2023-28328)

A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service.(CVE-2023-1380)

A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.(CVE-2023-1513)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• A use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)

• Information leak in scsi_ioctl() (CVE-2022-0494)

• A kernel-info-leak issue in pfkey_register (CVE-2022-1353)

• RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)

• Branch Type Confusion (non-retbleed) (CVE-2022-23825)

• RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Add s390_iommu_aperture kernel parameter (BZ#2081324)

• Blackscreen and hangup after resume from hibernate or S3 with DFGX WX3200 (BZ#2091065)

• Update NVME subsystem with bug fixes and minor changes (BZ#2106017)

• Fix parsing of nw_proto for IPv6 fragments (BZ#2106703)

• "vmcore failed, _exitcode:139" error observed while capturing vmcore during fadump after memory remove. incomplete vmcore is captured. (BZ#2107488)

• 'disable_policy' is ignored for addresses configured on a down interface (BZ#2109971)

• Backport request for new cpufreq.default_governor kernel command line parameter (BZ#2109996)

• Panics in mpt3sas mpt3sas_halt_firmware() if mpt3sas_fwfault_debug=1 enabled when poweroff issued to server (BZ#2111140)

• IOMMU/DMA update for 8.7 (BZ#2111692)

• Update Broadcom Emulex lpfc driver for Rocky Linux8.7 with bug fixes (14.0.0.13) (BZ#2112103)

• Incorrect Socket(s) & "Core(s) per socket" reported by lscpu command. (BZ#2112820)

• Panic in ch_release() due to NULL ch->device pointer, backport upstream fix (BZ#2115965)

• pyverbs-tests fail over qede IW HCAs on "test_query_rc_qp" (tests.test_qp.QPTest) (BZ#2119122)

• qedi shutdown handler hangs upon reboot (BZ#2119847)

• cache link_info for ethtool (BZ#2120197)

• Important iavf bug fixes (BZ#2120225)

• Hibernate crash with Aquantia 2.5/5 Gb LAN card (BZ#2124966)

• While using PTimekeeper the qede driver produces excessive log messages (BZ#2125477)

• general protection fault handling rpc_xprt.timer (BZ#2126184)

• Not enough device MSI-X vectors (BZ#2126482)

• Atlantic driver panic on wakeup after hybernate (BZ#2127845)

• Memory leak in vxlan_xmit_one (BZ#2131255)

• Missing hybernate/resume fixes (BZ#2131936)

Enhancement(s):

• Update smartpqi driver to latest upstream Second Set of Patches (BZ#2112354)

• qed/qede/qedr - driver updates to latest upstream (BZ#2120611)

• Update qedi driver to latest upstream (BZ#2120612)

• Update qedf driver to latest upstream (BZ#2120613)

• Include the support for new NVIDIA Mobile GFX GA103 on ADL Gen Laptops (BZ#2127122)

• Need to enable hpilo to support new HPE RL300 Gen11 for ARM (aarch64) (BZ#2129923)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)

• kernel: information leak in scsi_ioctl() (CVE-2022-0494)

• Kernel: A kernel-info-leak issue in pfkey_register (CVE-2022-1353)

• hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)

• hw: cpu: AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)

• hw: cpu: Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [Rocky Linux8-rt] BUG: using __this_cpu_add() in preemptible [00000000] - caller is __mod_memcg_lruvec_state+0x69/0x1c0 (BZ#2122600)

• The latest Rocky Linux 8.6.z4 kernel changes need to be merged into the RT source tree to keep source parity between the two kernels. (BZ#2125396)

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• A use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)
• Information leak in scsi_ioctl() (CVE-2022-0494)
• A kernel-info-leak issue in pfkey_register (CVE-2022-1353)
• RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)
• Branch Type Confusion (non-retbleed) (CVE-2022-23825)
• RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Add s390_iommu_aperture kernel parameter (BZ#2081324)
• Blackscreen and hangup after resume from hibernate or S3 with DFGX WX3200 (BZ#2091065)
• Update NVME subsystem with bug fixes and minor changes (BZ#2106017)
• Fix parsing of nw_proto for IPv6 fragments (BZ#2106703)
• "vmcore failed, _exitcode:139" error observed while capturing vmcore during fadump after memory remove. incomplete vmcore is captured. (BZ#2107488)
• 'disable_policy' is ignored for addresses configured on a down interface (BZ#2109971)
• Backport request for new cpufreq.default_governor kernel command line parameter (BZ#2109996)
• Panics in mpt3sas mpt3sas_halt_firmware() if mpt3sas_fwfault_debug=1 enabled when poweroff issued to server (BZ#2111140)
• IOMMU/DMA update for 8.7 (BZ#2111692)
• Update Broadcom Emulex lpfc driver for AlmaLinux8.7 with bug fixes (14.0.0.13) (BZ#2112103)
• Incorrect Socket(s) & "Core(s) per socket" reported by lscpu command. (BZ#2112820)
• Panic in ch_release() due to NULL ch->device pointer, backport upstream fix (BZ#2115965)
• pyverbs-tests fail over qede IW HCAs on "test_query_rc_qp" (tests.test_qp.QPTest) (BZ#2119122)
• qedi shutdown handler hangs upon reboot (BZ#2119847)
• cache link_info for ethtool (BZ#2120197)
• Important iavf bug fixes (BZ#2120225)
• Hibernate crash with Aquantia 2.5/5 Gb LAN card (BZ#2124966)
• While using PTimekeeper the qede driver produces excessive log messages (BZ#2125477)
• general protection fault handling rpc_xprt.timer (BZ#2126184)
• Not enough device MSI-X vectors (BZ#2126482)
• Atlantic driver panic on wakeup after hybernate (BZ#2127845)
• Memory leak in vxlan_xmit_one (BZ#2131255)
• Missing hybernate/resume fixes (BZ#2131936)

Enhancement(s):

• Update smartpqi driver to latest upstream Second Set of Patches (BZ#2112354)
• qed/qede/qedr - driver updates to latest upstream (BZ#2120611)
• Update qedi driver to latest upstream (BZ#2120612)
• Update qedf driver to latest upstream (BZ#2120613)
• Include the support for new NVIDIA Mobile GFX GA103 on ADL Gen Laptops (BZ#2127122)
• Need to enable hpilo to support new HPE RL300 Gen11 for ARM (aarch64) (BZ#2129923)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)
• kernel: information leak in scsi_ioctl() (CVE-2022-0494)
• Kernel: A kernel-info-leak issue in pfkey_register (CVE-2022-1353)
• hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)
• hw: cpu: AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)
• hw: cpu: Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [almalinux8-rt] BUG: using __this_cpu_add() in preemptible [00000000] - caller is __mod_memcg_lruvec_state+0x69/0x1c0 (BZ#2122600)
• The latest AlmaLinux 8.6.z4 kernel changes need to be merged into the RT source tree to keep source parity between the two kernels. (BZ#2125396)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
• smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)
• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
• uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
• race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
• concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)
• kernel info leak issue in pfkey_register (CVE-2022-1353)
• use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)
• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
• fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998)
• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
• slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
• incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123)
• incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)
• incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166)
• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
• AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)
• AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)
• Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
• double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
• use after free in SUNRPC subsystem (CVE-2022-28893)
• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
• Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)
• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
• nf_tables disallow binding to already bound chain (CVE-2022-39190)
• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
• smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)
• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
• uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
• race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
• concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)
• kernel info leak issue in pfkey_register (CVE-2022-1353)
• use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)
• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
• fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998)
• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
• integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
• slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
• incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123)
• incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)
• incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166)
• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
• AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)
• AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)
• Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
• double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
• use after free in SUNRPC subsystem (CVE-2022-28893)
• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
• Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)
• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
• nf_tables disallow binding to already bound chain (CVE-2022-39190)
• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• Bionic update: upstream stable patchset 2022-12-01 (LP: #1998542) // CVE-2022-26373
  • x86/speculation: Add RSB VM Exit protections
• Bionic update: upstream stable patchset 2022-12-01 (LP: #1998542)
  • Revert "x86/cpu: Add a steppings field to struct x86_cpu_id"
  • x86/cpufeature: Add facility to check for min microcode revisions
  • x86/cpufeature: Fix various quality problems in the <asm/cpu_device_hd.h> header
  • x86/devicetable: Move x86 specific macro out of generic code
  • x86/cpu: Add consistent CPU match macros
  • x86/cpu: Add a steppings field to struct x86_cpu_id
  • x86/cpufeatures: Move RETPOLINE flags to word 11
  • x86/bugs: Report AMD retbleed vulnerability
  • x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value
  • x86/entry: Add kernel IBRS implementation
  • x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS
  • x86/speculation: Add LFENCE to RSB fill sequence
  • KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  • x86/speculation: Fill RSB on vmexit for IBRS
  • x86/cpu/amd: Enumerate BTC_NO
  • x86/speculation: Disable RRSBA behavior
  • x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts
• Bionic update: upstream stable patchset 2022-12-01 (LP: #1998542) // CVE-2022-29901
  • x86/bugs: Optimize SPEC_CTRL MSR writes
  • x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation()
  • x86/bugs: Report Intel retbleed vulnerability
  • entel_idle: Disable IBRS during long idle
  • x86/speculation: Change FILL_RETURN_BUFFER to work with objtool
  • x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n
  • x86/speculation: Fix firmware entry SPEC_CTRL handling
  • x86/speculation: Fix SPEC_CTRL write on SMT state change
  • x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit
  • x86/speculation: Remove x86_spec_ctrl_mask
  • x86/common: Stamp out the stepping madness
  • x86/bugs: Add Cannon lake to RETBleed affected CPU list
  • x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current
• Bionic update: upstream stable patchset 2022-12-01 (LP: #1998542) // CVE-2022-29900
  • x86/bugs: Add AMD retbleed= boot parameter
• Bionic update: upstream stable patchset 2022-10-06 (LP: #1992112)
  • x86/bugs: Add "unknown" reporting for MMIO Stale Data
• CVE-2021-26401
  • x86/speculation: Warn about Spectre v2 LFENCE mitigation
  • x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT
• CVE-2022-0001
  • x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting
• Bionic update: upstream stable patchset 2019-10-07 (LP: #1847155)
  • x86/cpu: Add Tiger Lake to Intel family
• CVE-url: https://ubuntu.com/security/CVE-2023-4622
  • af_unix: Fix null-ptr-deref in unix_stream_sendpage().
• CVE-url: https://ubuntu.com/security/CVE-2022-45919
  • media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
• Miscellaneous upstream changes
  • Revert "x86/enter: Use IBRS on syscall and interrupts"

• Bionic update: upstream stable patchset 2022-12-01 (LP: #1998542) // CVE-2022-26373
  • x86/speculation: Add RSB VM Exit protections
• Bionic update: upstream stable patchset 2022-12-01 (LP: #1998542)
  • Revert "x86/cpu: Add a steppings field to struct x86_cpu_id"
  • x86/cpufeature: Add facility to check for min microcode revisions
  • x86/cpufeature: Fix various quality problems in the <asm/cpu_device_hd.h> header
  • x86/devicetable: Move x86 specific macro out of generic code
  • x86/cpu: Add consistent CPU match macros
  • x86/cpu: Add a steppings field to struct x86_cpu_id
  • x86/cpufeatures: Move RETPOLINE flags to word 11
  • x86/bugs: Report AMD retbleed vulnerability
  • x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value
  • x86/entry: Add kernel IBRS implementation
  • x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS
  • x86/speculation: Add LFENCE to RSB fill sequence
  • KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  • x86/speculation: Fill RSB on vmexit for IBRS
  • x86/cpu/amd: Enumerate BTC_NO
  • x86/speculation: Disable RRSBA behavior
  • x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts
• Bionic update: upstream stable patchset 2022-12-01 (LP: #1998542) // CVE-2022-29901
  • x86/bugs: Optimize SPEC_CTRL MSR writes
  • x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation()
  • x86/bugs: Report Intel retbleed vulnerability
  • entel_idle: Disable IBRS during long idle
  • x86/speculation: Change FILL_RETURN_BUFFER to work with objtool
  • x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n
  • x86/speculation: Fix firmware entry SPEC_CTRL handling
  • x86/speculation: Fix SPEC_CTRL write on SMT state change
  • x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit
  • x86/speculation: Remove x86_spec_ctrl_mask
  • x86/common: Stamp out the stepping madness
  • x86/bugs: Add Cannon lake to RETBleed affected CPU list
  • x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current
• Bionic update: upstream stable patchset 2022-12-01 (LP: #1998542) // CVE-2022-29900
  • x86/bugs: Add AMD retbleed= boot parameter
• Bionic update: upstream stable patchset 2022-10-06 (LP: #1992112)
  • x86/bugs: Add "unknown" reporting for MMIO Stale Data
• CVE-2021-26401
  • x86/speculation: Warn about Spectre v2 LFENCE mitigation
  • x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT
• CVE-2022-0001
  • x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting
• Bionic update: upstream stable patchset 2019-10-07 (LP: #1847155)
  • x86/cpu: Add Tiger Lake to Intel family
• CVE-url: https://ubuntu.com/security/CVE-2023-4622
  • af_unix: Fix null-ptr-deref in unix_stream_sendpage().
• CVE-url: https://ubuntu.com/security/CVE-2022-45919
  • media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
• Miscellaneous upstream changes
  • Revert "x86/enter: Use IBRS on syscall and interrupts"

This kernel update is based on upstream 5.15.58 and fixes at least the following security issues:

Kernel lockdown bypass when UEFI secure boot is disabled / unavailable and IMA appraisal is enabled (CVE-2022-21505).

Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure (CVE-2022-23825).

Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions (CVE-2022-29900, RetBleed).

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions (CVE-2022-29901).

The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges (CVE-2022-36123).

An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice (CVE-2022-36879).

nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len (CVE-2022-36946).

Other fixes in this update:

• fs: sendfile handles O_NONBLOCK of out_fd
• hugetlb: fix memoryleak in hugetlb_mcopy_atomic_pte
• mm: fix page leak with multiple threads mapping the same page
• x86/bugs: Do not enable IBPB at firmware entry when IBPB is not available
• x86/speculation: Make all RETbleed mitigations 64-bit only

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.15.58 and fixes at least the following security issues:

Kernel lockdown bypass when UEFI secure boot is disabled / unavailable and IMA appraisal is enabled (CVE-2022-21505).

Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure (CVE-2022-23825).

Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions (CVE-2022-29900, RetBleed).

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions (CVE-2022-29901).

The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges (CVE-2022-36123).

An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice (CVE-2022-36879).

For other upstream fixes, see the referenced changelogs.

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

The following non-security bugs were fixed:

• ALSA: hda/conexant: Fix missing beep setup (git-fixes).
• ALSA: hda/realtek - Add HW8326 support (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD70PNT (git-fixes).
• ALSA: hda/realtek - ALC897 headset MIC no sound (git-fixes).
• ALSA: hda/via: Fix missing beep setup (git-fixes).
• arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 (git-fixes)
• arm64: ftrace: fix branch range checks (git-fixes)
• ASoC: cs35l36: Update digital volume TLV (git-fixes).
• ASoC: cs42l52: Correct TLV for Bypass Volume (git-fixes).
• ASoC: cs42l52: Fix TLV scales for mixer controls (git-fixes).
• ASoC: cs42l56: Correct typo in minimum level for SX volume controls (git-fixes).
• ASoC: cs53l30: Correct number of volume levels on SX controls (git-fixes).
• ASoC: es8328: Fix event generation for deemphasis control (git-fixes).
• ASoC: nau8822: Add operation for internal PLL off and on (git-fixes).
• ASoC: wm8962: Fix suspend while playing music (git-fixes).
• ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (git-fixes).
• bcache: avoid journal no-space deadlock by reserving 1 journal bucket (git-fixes).
• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• bcache: fixup multiple threads crash (git-fixes).
• bcache: improve multithreaded bch_btree_check() (git-fixes).
• bcache: improve multithreaded bch_sectors_dirty_init() (git-fixes).
• bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() (git-fixes).
• bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() (git-fixes).
• bio: fix page leak bio_add_hw_page failure (git-fixes).
• blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats (git-fixes).
• blk-iolatency: Fix inflight count imbalances and IO hangs on offline (bsc#1200825).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: do not update io_ticks with passthrough requests (bsc#1200816).
• blk-mq: drop workarounds for cpu hotplug queue management (bsc#1185762)
• blk-mq: update hctx->dispatch_busy in case of real scheduler (git-fixes). -…

These are all security issues fixed in the kernel-devel-5.18.11-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.6.17-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the spectre-meltdown-checker-26.36.0602723-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

The following non-security bugs were fixed:

• ALSA: hda/conexant: Fix missing beep setup (git-fixes).
• ALSA: hda/realtek - Add HW8326 support (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD70PNT (git-fixes).
• ALSA: hda/realtek - ALC897 headset MIC no sound (git-fixes).
• ALSA: hda/via: Fix missing beep setup (git-fixes).
• arm64: ftrace: fix branch range checks (git-fixes)
• ASoC: cs35l36: Update digital volume TLV (git-fixes).
• ASoC: cs42l52: Correct TLV for Bypass Volume (git-fixes).
• ASoC: cs42l52: Fix TLV scales for mixer controls (git-fixes).
• ASoC: cs42l56: Correct typo in minimum level for SX volume controls (git-fixes).
• ASoC: cs53l30: Correct number of volume levels on SX controls (git-fixes).
• ASoC: es8328: Fix event generation for deemphasis control (git-fixes).
• ASoC: nau8822: Add operation for internal PLL off and on (git-fixes).
• ASoC: wm8962: Fix suspend while playing music (git-fixes).
• ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (git-fixes).
• bcache: avoid journal no-space deadlock by reserving 1 journal bucket (git-fixes).
• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• bcache: fixup multiple threads crash (git-fixes).
• bcache: improve multithreaded bch_btree_check() (git-fixes).
• bcache: improve multithreaded bch_sectors_dirty_init() (git-fixes).
• bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() (git-fixes).
• bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() (git-fixes).
• bio: fix page leak bio_add_hw_page failure (git-fixes).
• blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats (git-fixes).
• blk-iolatency: Fix inflight count imbalances and IO hangs on offline (bsc#1200825).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: do not update io_ticks with passthrough requests (bsc#1200816).
• blk-mq: drop workarounds for cpu hotplug queue management (bsc#1185762)
• blk-mq: update hctx->dispatch_busy in case of real scheduler (git-fixes).
• block: advance iov_iter on bio_add_hw_page failure (git-fixes).
• block: do not merge across cgroup boundaries if blkcg is enabled (bsc#1198020).
• block: Fix handling of offline queues in blk_mq_alloc_request_hctx() (bsc#1185762).
• block: Fix kABI in blk-merge.c (bsc#1198020).
• block/keyslot-manager: prevent crash when…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• audit: fix a race condition with the auditd tracking code (bsc#1197170).
• block: bio-integrity: Advance seed correctly for larger interval sizes (git-fixes).
• bnxt_en: Remove the setting of dev_port (git-fixes).
• bonding: fix bond_neigh_init() (git-fixes).
• dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() (git-fixes).
• drbd: fix duplicate array initializer (git-fixes).
• drbd: remove assign_p_sizes_qlim (git-fixes).
• drbd: use bdev_alignment_offset instead of queue_alignment_offset (git-fixes).
• drbd: use bdev based limit helpers in drbd_send_sizes (git-fixes).
• exec: Force single empty string when argv is empty (bsc#1200571).
• ext4: fix bug_on ext4_mb_use_inode_pa (bsc#1200810).
• ext4: fix bug_on in __es_tree_search (bsc#1200809).
• ext4: fix bug_on in ext4_writepages (bsc#1200872).
• ext4: fix overhead calculation to account for the reserved gdt blocks (bsc#1200869).
• ext4: fix race condition between ext4_write and ext4_convert_inline_data (bsc#1200807).
• ext4: fix symlink file size not match to file content (bsc#1200868).
• ext4: fix use-after-free in ext4_rename_dir_prepare (bsc#1200871).
• ext4: force overhead calculation if the s_overhead_cluster makes no sense (bsc#1200870).
• ext4: limit length to bitmap_maxbytes - blocksize in punch_hole (bsc#1200806).
• ext4: make variable 'count' signed (bsc#1200820).
• fs-writeback: writeback_sb_inodes Recalculate 'wrote' according skipped pages (bsc#1200873).
• i915_vma: Rename vma_lookup to i915_vma_lookup (git-fixes).
• ibmvnic: Properly dispose of all skbs during a failover (bsc#1200925).
• init: Initialize noop_backing_dev_info early (bsc#1200822).
• inotify: show inotify mask flags in proc fdinfo (bsc#1200600).
• Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag (git-fixes).
• Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (git-fixes).
• Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (git-fixes).
• Input: omap4-keypad - fix pm_runtime_get_sync() error checking (git-fixes).
• iomap: iomap_write_failed fix (bsc#1200829). -…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2017-16525: Fixed a use-after-free after failed setup in usb/serial/console (bsc#1066618).

The following non-security bugs were fixed:

• exec: Force single empty string when argv is empty (bsc#1200571).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• add mainline tag for a pci-hyperv change
• audit: fix a race condition with the auditd tracking code (bsc#1197170).
• block: bio-integrity: Advance seed correctly for larger interval sizes (git-fixes).
• bnxt_en: Remove the setting of dev_port (git-fixes).
• bonding: fix bond_neigh_init() (git-fixes).
• dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() (git-fixes).
• drbd: fix duplicate array initializer (git-fixes).
• drbd: remove assign_p_sizes_qlim (git-fixes).
• drbd: use bdev_alignment_offset instead of queue_alignment_offset (git-fixes).
• drbd: use bdev based limit helpers in drbd_send_sizes (git-fixes).
• exec: Force single empty string when argv is empty (bsc#1200571).
• ext4: fix bug_on ext4_mb_use_inode_pa (bsc#1200810).
• ext4: fix bug_on in __es_tree_search (bsc#1200809).
• ext4: fix bug_on in ext4_writepages (bsc#1200872).
• ext4: fix overhead calculation to account for the reserved gdt blocks (bsc#1200869).
• ext4: fix race condition between ext4_write and ext4_convert_inline_data (bsc#1200807).
• ext4: fix symlink file size not match to file content (bsc#1200868).
• ext4: fix use-after-free in ext4_rename_dir_prepare (bsc#1200871).
• ext4: force overhead calculation if the s_overhead_cluster makes no sense (bsc#1200870).
• ext4: limit length to bitmap_maxbytes - blocksize in punch_hole (bsc#1200806).
• ext4: make variable 'count' signed (bsc#1200820).
• fs-writeback: writeback_sb_inodes Recalculate 'wrote' according skipped pages (bsc#1200873).
• i915_vma: Rename vma_lookup to i915_vma_lookup (git-fixes).
• ibmvnic: Properly dispose of all skbs during a failover (bsc#1200925).
• init: Initialize noop_backing_dev_info early (bsc#1200822).
• inotify: show inotify mask flags in proc fdinfo (bsc#1200600).
• Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag (git-fixes).
• Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (git-fixes).
• Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (git-fixes).
• Input: omap4-keypad - fix pm_runtime_get_sync() error checking (git-fixes). -…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space (bsc#1200144).
• CVE-2022-1975: Fixed a bug that allows an attacker to crash the linux kernel by simulating nfc device from user-space (bsc#1200143).
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed a use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (bsc#1198577).
• CVE-2022-21499: Lock down kgdb to prohibit secure-boot bypass (bsc#1199426).
• CVE-2019-19377: Fixed a user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image (bsc#1158266).

The following non-security bugs were fixed:

• btrfs: tree-checker: fix incorrect printk format (bsc#1200249).
• exec: Force single empty string when argv is empty (bsc#1200571).

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)

The following non-security bugs were fixed:

• exec: Force single empty string when argv is empty (bsc#1200571).

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).

The following non-security bugs were fixed:

• exec: Force single empty string when argv is empty (bsc#1200571).

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to 3.12.31 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

The following non-security bugs were fixed:

• Add missing recommends of kernel-install-tools to kernel-source-vanilla (bsc#1200442)
• Add various fsctl structs (bsc#1200217).
• ALSA: hda/conexant: Fix missing beep setup (git-fixes).
• ALSA: hda/realtek - Add HW8326 support (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD70PNT (git-fixes).
• ALSA: hda/realtek - ALC897 headset MIC no sound (git-fixes).
• ALSA: hda/via: Fix missing beep setup (git-fixes).
• arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 (git-fixes)
• arm64: ftrace: fix branch range checks (git-fixes)
• ASoC: cs35l36: Update digital volume TLV (git-fixes).
• ASoC: cs42l52: Correct TLV for Bypass Volume (git-fixes).
• ASoC: cs42l52: Fix TLV scales for mixer controls (git-fixes).
• ASoC: cs42l56: Correct typo in minimum level for SX volume controls (git-fixes).
• ASoC: cs53l30: Correct number of volume levels on SX controls (git-fixes).
• ASoC: es8328: Fix event generation for deemphasis control (git-fixes).
• ASoC: nau8822: Add operation for internal PLL off and on (git-fixes).
• ASoC: wm8962: Fix suspend while playing music (git-fixes).
• ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (git-fixes).
• bcache: avoid journal no-space deadlock by reserving 1 journal bucket (git-fixes).
• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• bcache: fixup multiple threads crash (git-fixes).
• bcache: improve multithreaded bch_btree_check() (git-fixes).
• bcache: improve multithreaded bch_sectors_dirty_init() (git-fixes).
• bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() (git-fixes).
• bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() (git-fixes).
• bio: fix page leak bio_add_hw_page failure (git-fixes).
• blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats (git-fixes).
• blk-iolatency: Fix inflight count imbalances and IO hangs on offline (bsc#1200825).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: do not update io_ticks with passthrough requests (bsc#1200816).
• blk-mq: drop workarounds for cpu hotplug queue management (bsc#1185762)
• blk-mq: update hctx->dispatch_busy in case of…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to 3.12.31 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

The following non-security bugs were fixed:

• Add missing recommends of kernel-install-tools to kernel-source-vanilla (bsc#1200442)
• Add various fsctl structs (bsc#1200217).
• ALSA: hda/conexant: Fix missing beep setup (git-fixes).
• ALSA: hda/realtek - Add HW8326 support (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD70PNT (git-fixes).
• ALSA: hda/realtek - ALC897 headset MIC no sound (git-fixes).
• ALSA: hda/via: Fix missing beep setup (git-fixes).
• arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 (git-fixes)
• arm64: ftrace: fix branch range checks (git-fixes)
• ASoC: cs35l36: Update digital volume TLV (git-fixes).
• ASoC: cs42l52: Correct TLV for Bypass Volume (git-fixes).
• ASoC: cs42l52: Fix TLV scales for mixer controls (git-fixes).
• ASoC: cs42l56: Correct typo in minimum level for SX volume controls (git-fixes).
• ASoC: cs53l30: Correct number of volume levels on SX controls (git-fixes).
• ASoC: es8328: Fix event generation for deemphasis control (git-fixes).
• ASoC: nau8822: Add operation for internal PLL off and on (git-fixes).
• ASoC: wm8962: Fix suspend while playing music (git-fixes).
• ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (git-fixes).
• bcache: avoid journal no-space deadlock by reserving 1 journal bucket (git-fixes).
• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• bcache: fixup multiple threads crash (git-fixes).
• bcache: improve multithreaded bch_btree_check() (git-fixes).
• bcache: improve multithreaded bch_sectors_dirty_init() (git-fixes).
• bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() (git-fixes).
• bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() (git-fixes).
• bio: fix page leak bio_add_hw_page failure (git-fixes).
• blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats (git-fixes).
• blk-iolatency: Fix inflight count imbalances and IO hangs on offline (bsc#1200825).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: do not update io_ticks with passthrough requests (bsc#1200816).
• blk-mq: drop workarounds for cpu hotplug queue management (bsc#1185762)
• blk-mq: update hctx->dispatch_busy in case of…

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2017-16525: Fixed a use-after-free after failed setup in usb/serial/console (bsc#1066618).

The following non-security bugs were fixed:

• exec: Force single empty string when argv is empty (bsc#1200571).

The SUSE Linux Enterprise 15 SP4 kernel was updated.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-33743: Fixed a Denial of Service related to XDP (bsc#1200763).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bnc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bnc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-1998: Fixed a use after free in the file system notify functionality (bnc#1200284).
• CVE-2022-1966: Fixed a use-after-free vulnerability in the Netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1852: Fixed a null-ptr-deref in the kvm module which can lead to DoS. (bsc#1199875)
• CVE-2022-1789: Fixed a NULL pointer dereference when shadow paging is enabled. (bnc#1199674)
• CVE-2022-1508: Fixed an out-of-bounds read flaw that could cause the system to crash. (bsc#1198968)
• CVE-2022-1671: Fixed a null-ptr-deref bugs in net/rxrpc/server_key.c, unprivileged users could easily trigger it via ioctl. (bsc#1199439)
• CVE-2022-1651: Fixed a bug in ACRN Device Model emulates virtual NICs in VM. This flaw may allow a local privileged attacker to leak kernel unauthorized information and also cause a denial of service problem. (bsc#1199433)
• CVE-2022-29582: Fixed a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently. (bnc#1198811)
• CVE-2022-0494: Fixed a kernel information leak flaw in the scsi_ioctl function. This flaw allowed a local attacker with a special user privilege to create issues with confidentiality. (bnc#1197386)
• CVE-2021-4204: Fixed a vulnerability that allows local attackers to escalate privileges on affected installations via ebpf. (bnc#1194111)
• CVE-2022-23222: Fixed a bug that allowed local users to gain privileges. (bnc#1194765)
• CVE-2022-0264: Fixed a vulnerability in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. (bnc#1194826)
• CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

The following non-security bugs were fixed:

• ALSA: hda/conexant: Fix missing beep setup (git-fixes).
• ALSA: hda/realtek - Add HW8326 support (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD70PNT (git-fixes).
• ALSA: hda/realtek - ALC897 headset MIC no sound (git-fixes).
• ALSA: hda/via: Fix missing beep setup (git-fixes).
• arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 (git-fixes)
• arm64: ftrace: fix branch range checks (git-fixes)
• ASoC: cs35l36: Update digital volume TLV (git-fixes).
• ASoC: cs42l52: Correct TLV for Bypass Volume (git-fixes).
• ASoC: cs42l52: Fix TLV scales for mixer controls (git-fixes).
• ASoC: cs42l56: Correct typo in minimum level for SX volume controls (git-fixes).
• ASoC: cs53l30: Correct number of volume levels on SX controls (git-fixes).
• ASoC: es8328: Fix event generation for deemphasis control (git-fixes).
• ASoC: nau8822: Add operation for internal PLL off and on (git-fixes).
• ASoC: wm8962: Fix suspend while playing music (git-fixes).
• ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (git-fixes).
• bcache: avoid journal no-space deadlock by reserving 1 journal bucket (git-fixes).
• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• bcache: fixup multiple threads crash (git-fixes).
• bcache: improve multithreaded bch_btree_check() (git-fixes).
• bcache: improve multithreaded bch_sectors_dirty_init() (git-fixes).
• bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() (git-fixes).
• bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() (git-fixes).
• bio: fix page leak bio_add_hw_page failure (git-fixes).
• blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats (git-fixes).
• blk-iolatency: Fix inflight count imbalances and IO hangs on offline (bsc#1200825).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: do not update io_ticks with passthrough requests (bsc#1200816).
• blk-mq: drop workarounds for cpu hotplug queue management (bsc#1185762)
• blk-mq: update hctx->dispatch_busy in case of real scheduler (git-fixes). -…

The SUSE Linux Enterprise 15 SP4 kernel was updated.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-33743: Fixed a Denial of Service related to XDP (bsc#1200763).
• CVE-2022-1966: Fixed a use-after-free vulnerability in the Netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1852: Fixed a null-ptr-deref in the kvm module which can lead to DoS. (bsc#1199875)
• CVE-2022-1789: Fixed a NULL pointer dereference when shadow paging is enabled. (bnc#1199674)
• CVE-2022-1508: Fixed an out-of-bounds read flaw that could cause the system to crash. (bsc#1198968)
• CVE-2022-1671: Fixed a null-ptr-deref bugs in net/rxrpc/server_key.c, unprivileged users could easily trigger it via ioctl. (bsc#1199439)
• CVE-2022-1651: Fixed a bug in ACRN Device Model emulates virtual NICs in VM. This flaw may allow a local privileged attacker to leak kernel unauthorized information and also cause a denial of service problem. (bsc#1199433)
• CVE-2022-29582: Fixed a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently. (bnc#1198811)
• CVE-2022-0494: Fixed a kernel information leak flaw in the scsi_ioctl function. This flaw allowed a local attacker with a special user privilege to create issues with confidentiality. (bnc#1197386)
• CVE-2021-4204: Fixed a vulnerability that allows local attackers to escalate privileges on affected installations via ebpf. (bnc#1194111)
• CVE-2022-23222: Fixed a bug that allowed local users to gain privileges. (bnc#1194765)
• CVE-2022-0264: Fixed a vulnerability in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. (bnc#1194826)
• CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and write to relative stack data, which can lead to arbitrary code execution. (bsc#1197227)
• CVE-2022-1205: Fixed null pointer dereference and use-after-free vulnerabilities that allow an attacker to crash the linux kernel by simulating Amateur Radio. (bsc#1198027)
• CVE-2022-1198: Fixed an use-after-free vulnerability that allow an attacker to crash the linux kernel by simulating Amateur Radio (bsc#1198030).
• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21123: Fixed a…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1966: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1975: Fixed a sleep-in-atomic bug that allows attacker to crash linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-21499: Reinforce the kernel lockdown feature, until now it's been trivial to break out of it with kgdb or kdb. (bsc#1199426)
• CVE-2022-1836: Fixed a bug in the floppy submodule disabling FDRAWCMD by default. (bsc#1198866)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2021-33655: Fixed memory out of bounds write by ioctl cmd FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem. This flaw allowed a local user to crash the system or read unauthorized random data from memory. (bnc#1198829)
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-21505: Fixed kexec lockdown bypass with ima policy (bsc#1201458).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-36946: Fixed incorrect packet truncation in nfqnl_mangle() that could lead to remote DoS (bnc#1201940).

The following non-security bugs were fixed:

• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• blk-mq: Fix wrong wakeup batch configuration which will cause hang (bsc#1200263).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
• dma-direct: Fix potential NULL pointer dereference (bsc#1196472 ltc#192278).
• dma-mapping: Allow mixing bypass and mapped DMA operation (bsc#1196472 ltc#192278).
• dma-mapping: add a dma_ops_bypass flag to struct device (bsc#1196472 ltc#192278).
• dma-mapping: move the remaining DMA API calls out of line (bsc#1196472 ltc#192278).
• dma: kABI: Add back removed exports (bsc#1196472 ltc#192278).
• exec: Force single empty string when argv is empty (bsc#1200571).
• fsnotify: invalidate dcache before IN_DELETE event (bsc#1195478 bsc#1200905).
• kvm: emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).
• kvm: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930).
• powerpc/dma: Fallback to dma_ops when persistent memory present (bsc#1196472 ltc#192278).
• powerpc/pseries/iommu: Create defines for…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c (bsc#1204631).
• CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c (bsc#1203960).
• CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in net/bluetooth/l2cap_core.c (bsc#1205796).
• CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac (bsc#1204868).
• CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).
• CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
• CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
• CVE-2022-2602: Fixed a local privilege escalation vulnerability involving Unix socket Garbage Collection and io_uring (bsc#1204228).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. (bsc#1205711)
• CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req() which can be used to leak kernel pointers remotely (bsc#1205705).
• CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect() and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively) remotely via Bluetooth (bsc#1205709).
• CVE-2022-3707: Fixed a double free in the Intel GVT-g graphics driver (bsc#1204780).

The following non-security bugs were fixed:

• ALSA: hda/ca0132: add quirk for EVGA Z390 DARK (git-fixes).
• ALSA: hda: fix potential memleak in 'add_widget_node' (git-fixes).
• ALSA: usb-audio: Add DSD support for Accuphase DAC-60 (git-fixes).
• ALSA: usb-audio: Add quirk entry for M-Audio Micro (git-fixes).
• ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (git-fixes).
• ASoC: codecs: jz4725b: Fix spelling mistake 'Sourc' -> 'Source', 'Routee' -> 'Route' (git-fixes).
• ASoC: codecs: jz4725b: add missed Line In power control bit (git-fixes).
• ASoC: codecs: jz4725b: fix capture selector naming (git-fixes).
• ASoC: codecs: jz4725b: fix reported volume for Master ctl (git-fixes).
• ASoC: codecs: jz4725b: use right control for Capture Volume (git-fixes).
• ASoC: core: Fix use-after-free in snd_soc_exit() (git-fixes).
• ASoC: max98373: Add checks for devm_kcalloc (git-fixes).
• ASoC: soc-utils: Remove __exit for snd_soc_util_exit() (git-fixes).
• ASoC: wm5102: Revert 'ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe' (git-fixes).
• ASoC: wm5110: Revert 'ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe' (git-fixes).
• ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK (git-fixes).
• ASoC: wm8997: Revert 'ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe' (git-fixes).
• Bluetooth: L2CAP: Fix attempting to access uninitialized memory (git-fixes).
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm (git-fixes).
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (git-fixes).
• Do not enable CONFIG_ATARI_PARTITION (jsc#PED-1573)
• Drivers: hv: vmbus: Add /sys/bus/vmbus/hibernation (git-fixes).
• Drivers: hv: vmbus: Add VMbus IMC device to unsupported list (git-fixes).
• Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening (bsc#1204017).
• Drivers: hv: vmbus: Drop error message when…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-13695: Fixed fix acpi operand cache leak in nseval.c (bsc#1055710).
• CVE-2018-7755: Fixed bypass of kernel security protections such as KASLR using fd_locked_ioctl function in drivers/block/floppy.c (bnc#1084513).
• CVE-2019-3837: Fixed memory leak due to thread-unsafe implementation of the net_dma code in tcp_recvmsg() (bnc#1131430).
• CVE-2019-3900: Fixed infinite loop while receiving packets in vhost_net (bnc#1133374).
• CVE-2020-15393: Fixed memory leak in usbtest_disconnect in drivers/usb/misc/usbtest.c (bnc#1173514).
• CVE-2020-16119: Fixed use-after-free exploitable by a local attacker due to reuse of a DCCP socket (bnc#1177471).
• CVE-2020-36557: Fixed race condition in the VT_DISALLOCATE ioctl and closing/opening of ttys which could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed race condition in VT_RESIZEX (bsc#1200910).
• CVE-2021-26341: Fixed vulnerablity where some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bnc#1201050).
• CVE-2021-33655: When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds (bnc#1201635).
• CVE-2021-33656: Fixed memory out of bounds write when setting font with malicous data by ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2021-34981: Fixed file refcounter in bluetooth cmtp when cmtp_attach_device fails (bsc#1191961).
• CVE-2021-39713: Fixed race condition in the network scheduling subsystem which could lead to a use-after-free (bsc#1196973).
• CVE-2021-45868: Fixed use-after-free in fs/quota/quota_tree.c (bnc#1197366).
• CVE-2022-1011: Fixed UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (bsc#1197343).
• CVE-2022-1048: Fixed potential AB/BA lock with buffer_mutex and mmap_lock (bsc#1197331).
• CVE-2022-1353: Fixed denial of service in the pfkey_register function in net/key/af_key.c (bnc#1198516).
• CVE-2022-1462: Fixed out-of-bounds read in the TeleTYpe subsystem allowing local user to crash the system or read unauthorized random data from memory (bnc#1198829).
• CVE-2022-1652: Fixed use after free in floppy (bsc#1199063).
• CVE-2022-1679: Fixed use-after-free in the atheros wireless adapter driver (bnc#1199487).
• CVE-2022-20132: Fixed out of bounds read in lg_probe and related functions of hid-lg.c and other USB HID files (bnc#1200619).
• CVE-2022-20166: Fixed out of bounds write due to a heap buffer overflow which could lead to local escalation of privilege with System execution privileges needed (bnc#1200598).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bnc#1202346).
• CVE-2022-20369: Fixed out of bounds write due to improper input validation in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-21166, CVE-2022-21127, CVE-2022-21123, CVE-2022-21125, CVE-2022-21180: Fixed stale MMIO data transient information leaks (INTEL-TA-00615) (bnc#1199650).
• CVE-2022-21385: Fixed warn in rds_message_alloc_sgs (bnc#1202897).
• CVE-2022-21499: Fixed issue where it was trivial to break out of lockdown using kgdb (bsc#1199426).
• CVE-2022-2318: Fixed use-after-free caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges (bnc#1201251).
• CVE-2022-2663: Fixed possible firewall bypass when users are using unencrypted IRC due to message handling confusion in nf_conntrack_irc (bnc#1202097).
• CVE-2022-28356: Fixed refcount leak bug in net/llc/af_llc.c (bnc#1197391).
• CVE-2022-29900: Fixed mis-trained branch predictions for return instructions that may have allowed arbitrary speculative code execution under certain microarchitecture-dependent conditions (bnc#1199657).
• CVE-2022-29901: Fixed vulnerability where an attacker with unprivileged user access can hijack return instructions to…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49492: nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags (bsc#1238954).
• CVE-2022-50116: tty: n_gsm: fix deadlock and link starvation in outgoing data path (bsc#1244824).
• CVE-2023-53117: fs: prevent out-of-bounds array speculation when closing a file descriptor (bsc#1242780).
• CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
• CVE-2024-58239: tls: stop recv() if initial process_rx_list gave us non-DATA (bsc#1248614).
• CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
• CVE-2025-22045: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (bsc#1241433).
• CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
• CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246073).
• CVE-2025-38323: net: atm: add lec_mutex (bsc#1246473).
• CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).
• CVE-2025-38352: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (bsc#1246911).
• CVE-2025-38460: atm: clip: Fix potential null-ptr-deref in to_atmarpd() (bsc#1247143).
• CVE-2025-38468: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (bsc#1247437).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247314).
• CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247374).
• CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (bsc#1247976).
• CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
• CVE-2025-38563: perf/core: Prevent VMA split of buffer mappings (bsc#1248306).
• CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
• CVE-2025-38617: net/packet: fix a race in packet_set_ring() and packet_notifier() (bsc#1248621).
• CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).
• CVE-2025-38644: wifi: mac80211: reject TDLS operations when station is not associated (bsc#1248748).

The following non-security bugs were fixed:

• NFSv4.1: fix backchannel max_resp_sz verification check (bsc#1247518).
• scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() (bsc#1243278).
• scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() (git-fixes).
• Disable N_GSM (jsc#PED-8240).