CVE-2023-51779

bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free because of a bt_sock_ioctl race condition.

The Linux Kernel, the operating system core itself.

Security Fix(es):

A flaw was found in the Bluetooth subsystem of the Linux kernel. A race condition between the bt_sock_recvmsg() and bt_sock_ioctl() functions could lead to a use-after-free on a socket buffer ("skb"). This flaw allows a local user to cause a denial of service condition or potential code execution.(CVE-2023-51779)

An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.(CVE-2023-51780)

An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition.(CVE-2023-51781)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A flaw was found in the Bluetooth subsystem of the Linux kernel. A race condition between the bt_sock_recvmsg() and bt_sock_ioctl() functions could lead to a use-after-free on a socket buffer ("skb"). This flaw allows a local user to cause a denial of service condition or potential code execution.(CVE-2023-51779)

An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.(CVE-2023-51780)

An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition.(CVE-2023-51781)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A flaw was found in the Bluetooth subsystem of the Linux kernel. A race condition between the bt_sock_recvmsg() and bt_sock_ioctl() functions could lead to a use-after-free on a socket buffer ("skb"). This flaw allows a local user to cause a denial of service condition or potential code execution.(CVE-2023-51779)

An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.(CVE-2023-51780)

An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition.(CVE-2023-51781)

An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-after-free because of a rose_accept race condition.(CVE-2023-51782)

An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).(CVE-2023-6121)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A flaw was found in the Bluetooth subsystem of the Linux kernel. A race condition between the bt_sock_recvmsg() and bt_sock_ioctl() functions could lead to a use-after-free on a socket buffer ("skb"). This flaw allows a local user to cause a denial of service condition or potential code execution.(CVE-2023-51779)

An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.(CVE-2023-51780)

An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition.(CVE-2023-51781)

An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-after-free because of a rose_accept race condition.(CVE-2023-51782)

An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).(CVE-2023-6121)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A flaw was found in the Bluetooth subsystem of the Linux kernel. A race condition between the bt_sock_recvmsg() and bt_sock_ioctl() functions could lead to a use-after-free on a socket buffer ("skb"). This flaw allows a local user to cause a denial of service condition or potential code execution.(CVE-2023-51779)

An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.(CVE-2023-51780)

An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition.(CVE-2023-51781)

An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-after-free because of a rose_accept race condition.(CVE-2023-51782)

An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).(CVE-2023-6121)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A flaw was found in the Bluetooth subsystem of the Linux kernel. A race condition between the bt_sock_recvmsg() and bt_sock_ioctl() functions could lead to a use-after-free on a socket buffer ("skb"). This flaw allows a local user to cause a denial of service condition or potential code execution.(CVE-2023-51779)

An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.(CVE-2023-51780)

An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition.(CVE-2023-51781)

An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).(CVE-2023-6121)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux SIG Cloud 8.10 Release Notes linked from the References section.

bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free because of a bt_sock_ioctl race condition.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)
• kernel: multiple use-after-free vulnerabilities (CVE-2024-1086, CVE-2023-3567, CVE-2023-4133, CVE-2023-6932, CVE-2023-39198, CVE-2023-51043, CVE-2023-51779, CVE-2023-51780, CVE-2024-1085, CVE-2024-26582)
• kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)
• kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)
• kernel: multiple NULL pointer dereference vulnerabilities (CVE-2022-38096, CVE-2023-6622, CVE-2023-6915, CVE-2023-42754, CVE-2023-46862, CVE-2023-52574, CVE-2024-0841, CVE-2023-52448)
• kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934)
• kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040)
• kernel: GC's deletion of an SKB races with unix_stream_read_generic() leading to UAF (CVE-2023-6531)
• kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931)
• kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023)
• kernel: irdma: Improper access control (CVE-2023-25775)
• Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464)
• kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c (CVE-2023-28866)
• kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl (CVE-2023-31083)
• kernel: multiple out-of-bounds read vulnerabilities (CVE-2023-37453, CVE-2023-39189, CVE-2023-39193, CVE-2023-6121, CVE-2023-39194)
• kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP (CVE-2023-42756)
• kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write (CVE-2023-45863)
• kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)
• kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489)
• kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522)
• kernel: multiple memory leak vulnerabilities (CVE-2023-52529, CVE-2023-52581)
• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)
• kernel: net/core: kernel crash in ETH_P_1588 flow dissector (CVE-2023-52580)
• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)
• kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (CVE-2024-0565)
• kernel: tls: race between async notify and socket close (CVE-2024-26583)
• kernel: tls: handle backlogging of crypto requests (CVE-2024-26584)
• kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585)
• kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)
• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)
• kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)
• kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-26609)
• kernel: local dos vulnerability in scatterwalk_copychunks (CVE-2023-6176)
• kernel: perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476)
• kernel: netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620)
• kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free because of a bt_sock_ioctl race condition.

• CVE-url: https://ubuntu.com/security/CVE-2022-36402
  • drm/vmwgfx: Add support for SVGA3dCmdDefineGBSurface_v3
  • drm/vmwgfx: Add SM4_1 flag
  • drm/vmwgfx: Add CAP2 support in vmwgfx
  • drm/vmwgfx: Bump version patchlevel and date
  • drm/vmwgfx: Expose SM4_1 param to user space
  • drm/vmwgfx: Update the device headers
  • drm/vmwgfx: Fix shader stage validation
• CVE-url: https://ubuntu.com/security/CVE-2023-6040
  • netfilter: nf_tables: Reject tables of unsupported family
• CVE-2023-4244 // CVE-url: https://ubuntu.com/security/CVE-2023-4244
  • netfilter: nf_tables: don't skip expired elements during walk
  • netfilter: nf_tables: GC transaction API to avoid race with control plane
  • netfilter: nf_tables: adapt set backend to use GC transaction API
  • netfilter: nf_tables: remove busy mark and gc batch API
  • netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path
  • netfilter: nf_tables: GC transaction race with netns dismantle
  • netfilter: nf_tables: GC transaction race with abort path
• CVE-url: https://ubuntu.com/security/CVE-2023-4244
  • netfilter: nf_tables: pass ctx to nf_tables_expr_destroy()
  • netfilter: nf_tables: use net_generic infra for transaction data
  • netfilter: nftables: add nft_pernet() helper function
  • netfilter: nftables: rename set element data activation/deactivation functions
  • netfilter: nf_tables: fix chain dependency validation
  • netfilter: nf_tables: place all set backends in one single module
  • netfilter: nf_tables: make sets built-in
• Bionic update: upstream stable patchset 2022-07-06 (LP: #1980879) // CVE- url: https://ubuntu.com/security/CVE-2022-48619
  • Input: add bounds checking to input_set_capability()
• CVE-url: https://ubuntu.com/security/CVE-2023-51780
  • atm: Fix Use-After-Free in do_vcc_ioctl
• CVE-url: https://ubuntu.com/security/CVE-2023-51782
  • net/rose: Fix Use-After-Free in rose_ioctl
• CVE-url: https://ubuntu.com/security/CVE-2023-51781
  • appletalk: Fix Use-After-Free in atalk_ioctl
• CVE-url: https://ubuntu.com/security/CVE-2023-0597
  • random32: add noise from network and scheduling activity
• CVE-2023-51779 // CVE-url: https://ubuntu.com/security/CVE-2023-51779
  • Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
• Jammy update: v5.15.135 upstream stable release (LP: #2045809) // CVE-url: https://ubuntu.com/security/CVE-2023-34324
  • xen/events: replace evtchn_rwlock with RCU
• kernel crash : net_sched race condition in tcindex_destroy() (LP: #1825942) // CVE-url: https://ubuntu.com/security/CVE-2023-34324
  • RCU, workqueue: Implement rcu_work
• Miscellaneous Ubuntu changes
  • [Config] updateconfigs for CONFIG_NFT_SET_RBTREE CONFIG_NFT_SET_HASH CONFIG_NFT_SET_BITMAP
• Miscellaneous upstream changes
  • drm/vmwgfx: Use enum to represent graphics context capabilities

• CVE-url: https://ubuntu.com/security/CVE-2022-36402
  • drm/vmwgfx: Add support for SVGA3dCmdDefineGBSurface_v3
  • drm/vmwgfx: Add SM4_1 flag
  • drm/vmwgfx: Add CAP2 support in vmwgfx
  • drm/vmwgfx: Bump version patchlevel and date
  • drm/vmwgfx: Expose SM4_1 param to user space
  • drm/vmwgfx: Update the device headers
  • drm/vmwgfx: Fix shader stage validation
• CVE-url: https://ubuntu.com/security/CVE-2023-6040
  • netfilter: nf_tables: Reject tables of unsupported family
• CVE-2023-4244 // CVE-url: https://ubuntu.com/security/CVE-2023-4244
  • netfilter: nf_tables: don't skip expired elements during walk
  • netfilter: nf_tables: GC transaction API to avoid race with control plane
  • netfilter: nf_tables: adapt set backend to use GC transaction API
  • netfilter: nf_tables: remove busy mark and gc batch API
  • netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path
  • netfilter: nf_tables: GC transaction race with netns dismantle
  • netfilter: nf_tables: GC transaction race with abort path
• CVE-url: https://ubuntu.com/security/CVE-2023-4244
  • netfilter: nf_tables: pass ctx to nf_tables_expr_destroy()
  • netfilter: nf_tables: use net_generic infra for transaction data
  • netfilter: nftables: add nft_pernet() helper function
  • netfilter: nftables: rename set element data activation/deactivation functions
  • netfilter: nf_tables: fix chain dependency validation
  • netfilter: nf_tables: place all set backends in one single module
  • netfilter: nf_tables: make sets built-in
• Bionic update: upstream stable patchset 2022-07-06 (LP: #1980879) // CVE- url: https://ubuntu.com/security/CVE-2022-48619
  • Input: add bounds checking to input_set_capability()
• CVE-url: https://ubuntu.com/security/CVE-2023-51780
  • atm: Fix Use-After-Free in do_vcc_ioctl
• CVE-url: https://ubuntu.com/security/CVE-2023-51782
  • net/rose: Fix Use-After-Free in rose_ioctl
• CVE-url: https://ubuntu.com/security/CVE-2023-51781
  • appletalk: Fix Use-After-Free in atalk_ioctl
• CVE-url: https://ubuntu.com/security/CVE-2023-0597
  • random32: add noise from network and scheduling activity
• CVE-2023-51779 // CVE-url: https://ubuntu.com/security/CVE-2023-51779
  • Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
• Jammy update: v5.15.135 upstream stable release (LP: #2045809) // CVE-url: https://ubuntu.com/security/CVE-2023-34324
  • xen/events: replace evtchn_rwlock with RCU
• kernel crash : net_sched race condition in tcindex_destroy() (LP: #1825942) // CVE-url: https://ubuntu.com/security/CVE-2023-34324
  • RCU, workqueue: Implement rcu_work
• Miscellaneous Ubuntu changes
  • [Config] updateconfigs for CONFIG_NFT_SET_RBTREE CONFIG_NFT_SET_HASH CONFIG_NFT_SET_BITMAP
• Miscellaneous upstream changes
  • drm/vmwgfx: Use enum to represent graphics context capabilities

• Jammy update: v5.15.140 upstream stable release (LP: #2050038) // CVE-url: https://ubuntu.com/security/CVE-2024-0607
  • netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
• CVE-url: https://ubuntu.com/security/CVE-2024-0607
  • netfilter: nf_tables: Introduce new 64-bit helper register functions
• Focal update: Focal update: v5.4.235 upstream stable release (LP: #2017706) // CVE-url: https://ubuntu.com/security/CVE-2023-1079
  • HID: asus: Remove check for same LED brightness on set
  • HID: asus: use spinlock to protect concurrent accesses
  • HID: asus: use spinlock to safely schedule workers
• CVE-url: https://ubuntu.com/security/CVE-2022-36402
  • drm/vmwgfx: Add SM4_1 flag
  • drm/vmwgfx: Add support for SVGA3dCmdDefineGBSurface_v3
  • drm/vmwgfx: Add CAP2 support in vmwgfx
  • drm/vmwgfx: Bump version patchlevel and date
  • drm/vmwgfx: Expose SM4_1 param to user space
  • drm/vmwgfx: Update the device headers
  • drm/vmwgfx: Fix shader stage validation
• CVE-url: https://ubuntu.com/security/CVE-2024-0639
  • sctp: fix potential deadlock on &net->sctp.addr_wq_lock
• CVE-url: https://ubuntu.com/security/CVE-2023-6915
  • ida: Fix crash in ida_free when the bitmap is empty
• CVE-url: https://ubuntu.com/security/CVE-2023-6040
  • netfilter: nf_tables: Reject tables of unsupported family
• CVE-url: https://ubuntu.com/security/CVE-2023-51780
  • atm: Fix Use-After-Free in do_vcc_ioctl
• CVE-url: https://ubuntu.com/security/CVE-2023-51782
  • net/rose: Fix Use-After-Free in rose_ioctl
• CVE-url: https://ubuntu.com/security/CVE-2023-51781
  • appletalk: Fix Use-After-Free in atalk_ioctl
• CVE-url: https://ubuntu.com/security/CVE-2024-0340
  • vhost: use kzalloc() instead of kmalloc() followed by memset()
• CVE-2023-51779 // CVE-url: https://ubuntu.com/security/CVE-2023-51779
  • Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
• Jammy update: v5.15.135 upstream stable release (LP: #2045809) // CVE-url: https://ubuntu.com/security/CVE-2023-34324
  • xen/events: replace evtchn_rwlock with RCU
• Miscellaneous upstream changes
  • drm/vmwgfx: Use enum to represent graphics context capabilities

• Jammy update: v5.15.140 upstream stable release (LP: #2050038) // CVE-url: https://ubuntu.com/security/CVE-2024-0607
  • netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
• CVE-url: https://ubuntu.com/security/CVE-2024-0607
  • netfilter: nf_tables: Introduce new 64-bit helper register functions
• Focal update: Focal update: v5.4.235 upstream stable release (LP: #2017706) // CVE-url: https://ubuntu.com/security/CVE-2023-1079
  • HID: asus: Remove check for same LED brightness on set
  • HID: asus: use spinlock to protect concurrent accesses
  • HID: asus: use spinlock to safely schedule workers
• CVE-url: https://ubuntu.com/security/CVE-2022-36402
  • drm/vmwgfx: Add SM4_1 flag
  • drm/vmwgfx: Add support for SVGA3dCmdDefineGBSurface_v3
  • drm/vmwgfx: Add CAP2 support in vmwgfx
  • drm/vmwgfx: Bump version patchlevel and date
  • drm/vmwgfx: Expose SM4_1 param to user space
  • drm/vmwgfx: Update the device headers
  • drm/vmwgfx: Fix shader stage validation
• CVE-url: https://ubuntu.com/security/CVE-2024-0639
  • sctp: fix potential deadlock on &net->sctp.addr_wq_lock
• CVE-url: https://ubuntu.com/security/CVE-2023-6915
  • ida: Fix crash in ida_free when the bitmap is empty
• CVE-url: https://ubuntu.com/security/CVE-2023-6040
  • netfilter: nf_tables: Reject tables of unsupported family
• CVE-url: https://ubuntu.com/security/CVE-2023-51780
  • atm: Fix Use-After-Free in do_vcc_ioctl
• CVE-url: https://ubuntu.com/security/CVE-2023-51782
  • net/rose: Fix Use-After-Free in rose_ioctl
• CVE-url: https://ubuntu.com/security/CVE-2023-51781
  • appletalk: Fix Use-After-Free in atalk_ioctl
• CVE-url: https://ubuntu.com/security/CVE-2024-0340
  • vhost: use kzalloc() instead of kmalloc() followed by memset()
• CVE-2023-51779 // CVE-url: https://ubuntu.com/security/CVE-2023-51779
  • Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
• Jammy update: v5.15.135 upstream stable release (LP: #2045809) // CVE-url: https://ubuntu.com/security/CVE-2023-34324
  • xen/events: replace evtchn_rwlock with RCU
• Miscellaneous upstream changes
  • drm/vmwgfx: Use enum to represent graphics context capabilities

• af_unix: Fix garbage collector racing against connect() {CVE-2024-26923}
• netfilter: nft_limit: reject configurations that cause integer overflow {CVE-2024-26668}
• libbpf: Fix use-after-free in btf_dump_name_dups {CVE-2022-3534}
• bpf: Fix partial dynptr stack slot reads/writes {CVE-2023-39191}
• ima: Fix use-after-free on a dentry's dname.name {CVE-2024-39494}
• ima: define ima_max_digest_data struct without a flexible array variable
• ima: detect changes to the backing overlay file
• tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
• tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux {CVE-2023-6546}
• tty: n_gsm: fix restart handling via CLD command
• r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586}
• netfilter: tproxy: bail out if IP has been disabled on the device {CVE-2024-36270}
• tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). {CVE-2024-36904}
• Bluetooth: Fix double free in hci_conn_cleanup {CVE-2023-28464}
• fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super {CVE-2024-0841}
• net/ipv6: avoid possible UAF in ip6_route_mpath_notify() {CVE-2024-26852}
• tipc: fix UAF in error path {CVE-2024-36886}
• Bluetooth: af_bluetooth: Fix deadlock {CVE-2024-26886}
• Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
• dma-mapping: benchmark: handle NUMA_NO_NODE correctly {CVE-2024-39277}
• net/mlx5e: Prevent deadlock while disabling aRFS {CVE-2024-27014}
• net/mlx5e: Introduce flow steering API {CVE-2024-27014}
• x86/sev: Harden #VC instruction emulation somewhat {CVE-2024-25742}
• x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25742}
• x86: Introduce ia32_enabled() {CVE-2024-25742}
• x86/entry: Do not allow external 0x80 interrupts {CVE-2024-25742}
• x86/entry: Convert INT 0x80 emulation to IDTENTRY {CVE-2024-25742}
• RDMA/srpt: Support specifying the srpt_service_guid parameter {CVE-2024-26744}
• platform/x86: think-lmi: Fix reference leak {CVE-2023-52520}
• USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command {CVE-2024-27059}
• fat: fix uninitialized field in nostale filehandles {CVE-2024-26973}
• usb: xhci: Add error handling in xhci_map_urb_for_dma {CVE-2024-26964}
• wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete {CVE-2024-26897}
• wifi: mac80211: fix race condition on enabling fast-xmit {CVE-2024-26779}
• RDMA/qedr: Fix qedr_create_user_qp error flow {CVE-2024-26743}
• wifi: iwlwifi: fix a memory corruption {CVE-2024-26610}
• x86/fpu: Stop relying on userspace for info to fault in xsave buffer {CVE-2024-26603}
• wifi: rt2x00: restart beacon queue when hardware reset {CVE-2023-52595}
• wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
• net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg {CVE-2023-52528}
• RDMA/siw: Fix connection failure handling {CVE-2023-52513}
• usb: hub: Guard against accesses to uninitialized BOS descriptors {CVE-2023-52477}
• tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc {CVE-2021-47185}
• sctp: fail if no bound addresses can be used for a given scope {CVE-2023-1074}
• memcg: enable accounting for file lock caches {CVE-2022-0480}
• net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() {CVE-2023-6176}
• RDMA/srpt: Do not register event handler until srpt device is fully setup {CVE-2024-26872}
• drm/amd/display: Atom Integrated System Info v2_2 for DCN35 {CVE-2024-36897}
• net/mlx5e: fix a potential double-free in fs_any_create_groups {CVE-2023-52667}
• ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() {CVE-2024-36902}
• ipv6: prevent NULL dereference in ip6_output() {CVE-2024-36901}
• vt: fix memory overlapping when deleting chars in the buffer {CVE-2022-48627}
• hwmon: (coretemp) Fix out-of-bounds memory access {CVE-2024-26664}
• i2c: Fix a potential use after free {CVE-2019-25162}
• net/smc: fix…

• netfilter: nf_tables: use timestamp to check for set element timeout {CVE-2024-27397}
• x86/sev: Harden #VC instruction emulation somewhat {CVE-2024-25742}
• bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD {CVE-2024-42161}
• selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro {CVE-2024-42161}
• pinctrl: core: delete incorrect free in pinctrl_enable() {CVE-2024-36940}
• pinctrl: core: fix possible memory leak in pinctrl_enable() {CVE-2024-36940}
• net: fix information leakage in /proc/net/ptype {CVE-2022-48757}
• wifi: mt76: replace skb_put with skb_put_zero {CVE-2024-42225}
• ata: libata-core: Fix double free on error {CVE-2024-41087}
• drm/amdgpu: add error handle to avoid out-of-bounds {CVE-2024-39471}
• drm/amd/display: Fix potential index out of bounds in color transformation function {CVE-2024-38552}
• net: sched: sch_multiq: fix possible OOB write in multiq_tune() {CVE-2024-36978}
• drm/vmwgfx: Fix invalid reads in fence signaled events {CVE-2024-36960}
• net/sched: flower: Fix chain template offload {CVE-2024-26669}
• ipv6: Remove extra counter pull before gc {CVE-2023-52340}
• ipv6: remove max_size check inline with ipv4 {CVE-2023-52340}
• net/dst: use a smaller percpu_counter batch for dst entries accounting {CVE-2023-52340}
• net: add a route cache full diagnostic message {CVE-2023-52340}
• Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
• tcp_metrics: validate source addr length {CVE-2024-42154}
• net: fix out-of-bounds access in ops_init {CVE-2024-36883}
• tap: add missing verification for short frame {CVE-2024-41090}
• tun: add missing verification for short frame {CVE-2024-41091}
• iommu: Fix potential use-after-free during probe {CVE-2022-48796}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• nvme-tcp: fix possible use-after-free in transport error_recovery work {CVE-2022-48789}
• nvme-rdma: fix possible use-after-free in transport error_recovery work {CVE-2022-48788}
• ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() {CVE-2024-26773}
• ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() {CVE-2024-26772}
• ext4: fix double-free of blocks due to wrong extents moved_len {CVE-2024-26704}
• hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove {CVE-2024-26698}
• ubi: Check for too small LEB size in VTBL code {CVE-2024-25739}
• scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool {CVE-2023-52811}
• arp: Prevent overflow in arp_req_get(). {CVE-2024-26733}
• SUNRPC: Fix a suspicious RCU usage warning {CVE-2023-52623}
• ext4: avoid online resizing failures due to oversized flex bg {CVE-2023-52622}
• pstore/ram: Fix crash when setting number of cpus to an odd number {CVE-2023-52619}
• wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
• drm: Don't unref the same fb many times by mistake due to deadlock handling {CVE-2023-52486}
• net: amd-xgbe: Fix skb data length underflow {CVE-2022-48743}
• tracing: Restructure trace_clock_global() to never block {CVE-2021-46939}
• tcp: make sure init the accept_queue's spinlocks once {CVE-2024-26614}
• drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc {CVE-2024-42228}
• gfs2: Fix potential glock use-after-free on unmount {CVE-2024-38570}
• gfs2: Rename sd_{ glock => kill }_wait {CVE-2024-38570}
• gfs2: Use container_of() for gfs2_glock(aspace) {CVE-2024-38570}
• gfs2: Wake up when sd_glock_disposal becomes zero {CVE-2024-38570}
• gfs2: Remove ill-placed consistency check {CVE-2024-38570}
• gfs2: introduce new gfs2_glock_assert_withdraw {CVE-2024-38570}
• gfs2: simplify gdlm_put_lock with out_free label {CVE-2024-38570}
• gfs2: Expect -EBUSY after canceling dlm locking requests {CVE-2024-38570}
• gfs2: Don't call dlm after protocol is unmounted {CVE-2024-38570}
• gfs2: Don't skip dlm unlock if glock has an lvb {CVE-2024-38570}
• netfilter: nf_tables: release mutex after nft_gc_seq_end…

• dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list {CVE-2024-40956}
• userfaultfd: fix a race between writeprotect and exit_mmap() {CVE-2021-47461}
• netfilter: nf_tables: use timestamp to check for set element timeout {CVE-2024-27397}
• x86/sev: Harden #VC instruction emulation somewhat {CVE-2024-25742}
• bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD {CVE-2024-42161}
• selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro {CVE-2024-42161}
• pinctrl: core: delete incorrect free in pinctrl_enable() {CVE-2024-36940}
• pinctrl: core: fix possible memory leak in pinctrl_enable() {CVE-2024-36940}
• net: fix information leakage in /proc/net/ptype {CVE-2022-48757}
• wifi: mt76: replace skb_put with skb_put_zero {CVE-2024-42225}
• ata: libata-core: Fix double free on error {CVE-2024-41087}
• drm/amdgpu: add error handle to avoid out-of-bounds {CVE-2024-39471}
• drm/amd/display: Fix potential index out of bounds in color transformation function {CVE-2024-38552}
• net: sched: sch_multiq: fix possible OOB write in multiq_tune() {CVE-2024-36978}
• drm/vmwgfx: Fix invalid reads in fence signaled events {CVE-2024-36960}
• net/sched: flower: Fix chain template offload {CVE-2024-26669}
• ipv6: Remove extra counter pull before gc {CVE-2023-52340}
• ipv6: remove max_size check inline with ipv4 {CVE-2023-52340}
• net/dst: use a smaller percpu_counter batch for dst entries accounting {CVE-2023-52340}
• net: add a route cache full diagnostic message {CVE-2023-52340}
• Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
• tcp_metrics: validate source addr length {CVE-2024-42154}
• net: fix out-of-bounds access in ops_init {CVE-2024-36883}
• tap: add missing verification for short frame {CVE-2024-41090}
• tun: add missing verification for short frame {CVE-2024-41091}
• iommu: Fix potential use-after-free during probe {CVE-2022-48796}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• nvme-tcp: fix possible use-after-free in transport error_recovery work {CVE-2022-48789}
• nvme-rdma: fix possible use-after-free in transport error_recovery work {CVE-2022-48788}
• ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() {CVE-2024-26773}
• ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() {CVE-2024-26772}
• ext4: fix double-free of blocks due to wrong extents moved_len {CVE-2024-26704}
• hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove {CVE-2024-26698}
• ubi: Check for too small LEB size in VTBL code {CVE-2024-25739}
• scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool {CVE-2023-52811}
• arp: Prevent overflow in arp_req_get(). {CVE-2024-26733}
• SUNRPC: Fix a suspicious RCU usage warning {CVE-2023-52623}
• ext4: avoid online resizing failures due to oversized flex bg {CVE-2023-52622}
• pstore/ram: Fix crash when setting number of cpus to an odd number {CVE-2023-52619}
• wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
• drm: Don't unref the same fb many times by mistake due to deadlock handling {CVE-2023-52486}
• net: amd-xgbe: Fix skb data length underflow {CVE-2022-48743}
• tracing: Restructure trace_clock_global() to never block {CVE-2021-46939}
• tcp: make sure init the accept_queue's spinlocks once {CVE-2024-26614}
• drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc {CVE-2024-42228}
• gfs2: Fix potential glock use-after-free on unmount {CVE-2024-38570}
• gfs2: Rename sd_{ glock => kill }_wait {CVE-2024-38570}
• gfs2: Use container_of() for gfs2_glock(aspace) {CVE-2024-38570}
• gfs2: Remove ill-placed consistency check {CVE-2024-38570}
• gfs2: introduce new gfs2_glock_assert_withdraw {CVE-2024-38570}
• gfs2: simplify gdlm_put_lock with out_free label {CVE-2024-38570}
• gfs2: Expect -EBUSY after canceling dlm locking requests {CVE-2024-38570}
• netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path {CVE-2024-26925} -…

• wifi: mac80211: Avoid address calculations via out of bounds array indexing {CVE-2024-41071}
• bnx2x: Fix multiple UBSAN array-index-out-of-bounds {CVE-2024-42148}
• exec: Fix ToCToU between perm check and set-uid/gid usage {CVE-2024-43882}
• scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}
• ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
• fou: remove warn in gue_gro_receive on unsupported protocol {CVE-2024-44940}
• media: xc2028: avoid use-after-free in load_firmware_cb() {CVE-2024-43900}
• dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
• mISDN: Fix a use after free in hfcmulti_tx() {CVE-2024-42280}
• netfilter: nftables: exthdr: fix 4-byte stack OOB write {CVE-2023-52628}
• Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}

• nfs: fix UAF in direct writes {CVE-2024-26958}
• NFSD: Fix the behavior of READ near OFFSET_MAX {CVE-2022-48827}
• thermal: core: prevent potential string overflow {CVE-2023-52868}
• ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 {CVE-2021-47633}
• RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests {CVE-2021-47391}
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
• wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
• crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
• netfilter: validate user input for expected length {CVE-2024-35896}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
• net: bridge: xmit: make sure we have at least eth header len bytes {CVE-2024-38538}
• bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() {CVE-2024-39487}
• SUNRPC: Fix UAF in svc_tcp_listen_data_ready() {CVE-2023-52885}
• tty: Fix out-of-bound vmalloc access in imageblit {CVE-2021-47383}
• watchdog: Fix possible use-after-free by calling del_timer_sync() {CVE-2021-47321}
• virtio-net: Add validation for used length {CVE-2021-47352}
• USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
• scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
• xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
• scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
• jffs2: prevent xattr node from overflowing the eraseblock {CVE-2024-38599}
• ecryptfs: Fix buffer size for tag 66 packet {CVE-2024-38578}
• dlm: fix plock invalid read {CVE-2022-49407}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• jfs: fix shift-out-of-bounds in dbSplit {CVE-2024-56597}
• wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
• pid: take a reference when initializing cad_pid {CVE-2021-47118}
• Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
• sched/rt: pick_next_rt_entity(): check list_entry {CVE-2023-1077}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23038}
• media: dvb-core: Fix use-after-free due to race at dvb_register_device() {CVE-2022-45884}
• media: dvb-core: Fix use-after-free due on race condition at dvb_net {CVE-2022-45886}
• media: dvb-core: Fix use-after-free on race condition at dvb_frontend {CVE-2022-45885}
• media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 {CVE-2022-45919}
• x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit {CVE-2022-25265}
• x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK {CVE-2022-25265}
• x86/elf: Add table to document READ_IMPLIES_EXEC {CVE-2022-25265}
• i2c: i801: Don't generate an interrupt on bus reset {CVE-2021-47153}

• nfs: fix UAF in direct writes {CVE-2024-26958}
• NFSD: Fix the behavior of READ near OFFSET_MAX {CVE-2022-48827}
• thermal: core: prevent potential string overflow {CVE-2023-52868}
• ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 {CVE-2021-47633}
• RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests {CVE-2021-47391}
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
• wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
• crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
• netfilter: validate user input for expected length {CVE-2024-35896}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
• net: bridge: xmit: make sure we have at least eth header len bytes {CVE-2024-38538}
• bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() {CVE-2024-39487}
• SUNRPC: Fix UAF in svc_tcp_listen_data_ready() {CVE-2023-52885}
• tty: Fix out-of-bound vmalloc access in imageblit {CVE-2021-47383}
• watchdog: Fix possible use-after-free by calling del_timer_sync() {CVE-2021-47321}
• virtio-net: Add validation for used length {CVE-2021-47352}
• USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
• scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
• xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
• scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
• jffs2: prevent xattr node from overflowing the eraseblock {CVE-2024-38599}
• ecryptfs: Fix buffer size for tag 66 packet {CVE-2024-38578}
• dlm: fix plock invalid read {CVE-2022-49407}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• jfs: fix shift-out-of-bounds in dbSplit {CVE-2024-56597}
• wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
• pid: take a reference when initializing cad_pid {CVE-2021-47118}
• Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
• sched/rt: pick_next_rt_entity(): check list_entry {CVE-2023-1077}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23038}
• media: dvb-core: Fix use-after-free due to race at dvb_register_device() {CVE-2022-45884}
• media: dvb-core: Fix use-after-free due on race condition at dvb_net {CVE-2022-45886}
• media: dvb-core: Fix use-after-free on race condition at dvb_frontend {CVE-2022-45885}
• media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 {CVE-2022-45919}
• x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit {CVE-2022-25265}
• x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK {CVE-2022-25265}
• x86/elf: Add table to document READ_IMPLIES_EXEC {CVE-2022-25265}
• i2c: i801: Don't generate an interrupt on bus reset {CVE-2021-47153}

• Bump kernel ABI to 29: ship the ELS kernel as 4.19.0-29-*, distinct from the prior 4.19.0-28.
• CVE-2021-46984
  • kyber: fix out of bounds access when preempted {CVE-2021-46984}
• CVE-2021-47049
  • Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}
• CVE-2021-47101
  • asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
• CVE-2021-47191
  • scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• CVE-2021-47352
  • virtio-net: Add validation for used length {CVE-2021-47352}
• CVE-2021-47379
  • blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd {CVE-2021-47379}
• CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests {CVE-2021-47391}
• CVE-2021-47479
  • staging: rtl8712: fix use-after-free in rtl8712_dl_fw {CVE-2021-47479}
• CVE-2022-21546
  • scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• CVE-2022-39189
  • KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• CVE-2022-43945
  • SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
  • NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2022-49026
  • e100: Fix possible use after free in e100_xmit_prepare {CVE-2022-49026}
• CVE-2022-49720
  • block: Fix handling of offline queues in blk_mq_alloc_request_hctx() {CVE-2022-49720}
• CVE-2022-49975
  • bpf: Don't redirect packets with invalid pkt_len {CVE-2022-49975}
  • bpf: Move skb->len == 0 checks into __bpf_redirect {CVE-2022-49975}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2022-50103
  • sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• CVE-2022-50129
  • RDMA/srpt: Introduce a reference count in struct srpt_device {CVE-2022-50129}
  • RDMA/srpt: Fix a use-after-free {CVE-2022-50129}
• CVE-2022-50300
  • btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300}
• CVE-2022-50406
  • iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50552
  • blk-mq: use quiesced elevator switch when reinitializing queues {CVE-2022-50552}
• CVE-2023-51779
  • Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
• CVE-2023-52434
  • smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• CVE-2023-52515
  • RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
• CVE-2023-52531
  • wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
• CVE-2023-52741
  • cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
• CVE-2023-53000
  • netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• CVE-2023-53039
  • workqueue: Add resource managed version of delayed work init {CVE-2023-53039}
  • devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc {CVE-2023-53039}
  • devm-helpers: Add resource managed version of work init {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc {CVE-2023-53039}
• CVE-2023-53111
  • loop: Fix use-after-free issues {CVE-2023-53111}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-26555: Fixed an issue during BR/EDR PIN code pairing in the Bluetooth subsystem that would allow replay attacks (bsc#1179610 bsc#1215237).
• CVE-2023-6121: Fixed an information leak via dmesg when receiving a crafted packet in the NVMe-oF/TCP subsystem (bsc#1217250).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsystem when adding a new event (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free issue when receiving an IGMP query packet due to reference count mismanagement (bsc#1218253).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).

The following non-security bugs were fixed:

• Reviewed and added more information to README.SUSE (jsc#PED-5021).
• Enabled multibuild for kernel packages (JSC-SLE#5501, boo#1211226, bsc#1218184).
• clocksource: Avoid accidental unstable marking of clocksources (bsc#1218105).
• clocksource: Suspend the watchdog temporarily when high read latency detected (bsc#1218105).
• efi/mokvar: Reserve the table only if it is in boot services data (bsc#1215375).

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table which could be exploited by network adjacent attackers, increasing CPU usage by 95% (bsc#1212703).
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS (bsc#1210778).
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure (bsc#1216046).
• CVE-2023-39192: Fixed an out of bounds read in the netfilter (bsc#1215858).
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).

The following non-security bugs were fixed:

• Fix termination state for idr_for_each_entry_ul() (bsc#1109837).
• Input: powermate - fix use-after-free in powermate_config_complete (git-fixes).
• KVM: s390/mm: Properly reset no-dat (git-fixes bsc#1218057).
• KVM: s390: vsie: fix wrong VIR 37 when MSO is used (git-fixes bsc#1217936).
• Limit kernel-source build to architectures for which the kernel binary is built (bsc#1108281).
• PCI: Disable ATS for specific Intel IPU E2000 devices (bsc#1218622).
• Resolve build warnings from previous series due to missing commit for Ice Lake freerunning counters perf/x86/intel/uncore: Add box_offsets for free-running counters (jsc#PED-5023 bsc#1211439).
• Revert 'Limit kernel-source-azure build to architectures for which we build binaries (bsc#1108281).'
• bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent (git-fixes).
• bcache: Remove unnecessary NULL point check in node allocations (git-fixes).
• bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (git-fixes).
• bcache: check return value from btree_node_alloc_replacement() (git-fixes).
• bcache: prevent potential division by zero error (git-fixes).
• bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce() (git-fixes).
• bcache: revert replacing IS_ERR_OR_NULL with IS_ERR (git-fixes).
• dm cache policy smq: ensure IO does not prevent cleaner policy progress (git-fixes).
• dm cache: add cond_resched() to various workqueue loops (git-fixes).
• dm crypt: add cond_resched() to dmcrypt_write() (git-fixes).
• dm flakey: do not corrupt the zero page (git-fixes).
• dm flakey: fix a crash with invalid table line (git-fixes).
• dm flakey: fix logic when corrupting a bio (git-fixes).
• dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (git-fixes).
• dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths (git-fixes).
• dm stats: check for and propagate alloc_percpu failure (git-fixes).
• dm thin: add cond_resched() to various workqueue loops (git-fixes).
• dm verity: do not perform FEC for failed readahead IO (git-fixes).
• dm verity: fix error handling for check_at_most_once on FEC (git-fixes).
• dm verity: skip redundant verity_handle_err() on I/O errors (git-fixes).
• dm-integrity: do not modify bio's immutable bio_vec in integrity_metadata() (git-fixes).
• dm-verity: align struct dm_verity_fec_io properly (git-fixes).
• dm: remove flush_scheduled_work() during local_exit() (git-fixes).
• doc/README.SUSE: Add how to update the config for module signing (jsc#PED-5021)
• doc/README.SUSE: Remove how to build…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1218335).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).
• CVE-2023-6622: Fixed a null pointer dereference vulnerability in nft_dynset_init() that could allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service (bsc#1217938).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).

The following non-security bugs were fixed:

• Documentation: KVM: add separate directories for architecture-specific documentation (jsc#PED-7167).
• Documentation: KVM: update amd-memory-encryption.rst references (jsc#PED-7167).
• Documentation: KVM: update msr.rst reference (jsc#PED-7167).
• Documentation: KVM: update s390-diag.rst reference (jsc#PED-7167).
• Documentation: KVM: update s390-pv.rst reference (jsc#PED-7167).
• Documentation: drop more IDE boot options and ide-cd.rst (git-fixes).
• Documentation: qat: Use code block for qat sysfs example (git-fixes).
• Drop Documentation/ide/ (git-fixes).
• Fix crash on screen resize (bsc#1218229)
• Fix drm gem object underflow (bsc#1218092)
• KVM: arm64: Prevent kmemleak from accessing pKVM memory (jsc#PED-7167).
• KVM: s390/mm: Properly reset no-dat (git-fixes bsc#1218056).
• KVM: s390: vsie: fix wrong VIR 37 when MSO is used (git-fixes bsc#1217933).
• Revert 'PCI/ASPM: Remove pcie_aspm_pm_state_change()' (git-fixes).
• Revert 'PCI: acpiphp: Reassign resources on bridge if necessary' (git-fixes).
• Revert 'md: unlock mddev before reap sync_thread in action_store' (git-fixes).
• Revert 'swiotlb: panic if nslabs is too small' (git-fixes).
• Revert 'xhci: Loosen RPM as default policy to cover for AMD xHC 1.1' (git-fixes).
• USB: serial: ftdi_sio: update Actisense PIDs constant names (git-fixes).
• USB: serial: option: add Foxconn T99W265 with new baseline (git-fixes).
• USB: serial: option: add Quectel EG912Y module support (git-fixes).
• USB: serial: option: add Quectel RM500Q R13 firmware support (git-fixes).
• Update: drm/vmwgfx: Keep a gem reference to user bos in surfaces
• acpi: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 (git-fixes).
• acpi: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects (git-fixes).
• acpica: Add AML_NO_OPERAND_RESOLVE flag to Timer (git-fixes).
• afs: Fix afs_server_list to be cleaned up with RCU (git-fixes).
• afs: Fix dynamic root lookup DNS check (git-fixes).
• afs: Fix file locking on R/O volumes to operate in local mode (git-fixes).
• afs: Fix overwriting of result of DNS query (git-fixes).
• afs: Fix refcount underflow from error handling race…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095).
• CVE-2023-6121: Fixed an information leak via dmesg when receiving a crafted packet in the NVMe-oF/TCP subsystem (bsc#1217250).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsystem when adding a new event (bsc#1214158 bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free issue when receiving an IGMP query packet due to reference count mismanagement (bsc#1218253).
• CVE-2020-26555: Fixed an issue during BR/EDR PIN code pairing in the Bluetooth subsystem that would allow replay attacks (bsc#1179610 bsc#1215237).
• CVE-2023-51779: Fixed a use-after-free issue due to a race condition during Bluetooth message reception (bsc#1218559).

The following non-security bugs were fixed:

• Enabled the LLC counters for “perf” (perf stat) on the Ice-Lake and Rocket-Lake CPUs (jsc#PED-5023 bsc#1211439).
• Reviewed and added more information to README.SUSE (jsc#PED-5021).
• Enabled multibuild for kernel packages (JSC-SLE#5501, boo#1211226, bsc#1218184).
• Fix termination state for idr_for_each_entry_ul() (bsc#1109837).
• KVM: s390/mm: Properly reset no-dat (bsc#1218057).
• KVM: s390: vsie: fix wrong VIR 37 when MSO is used (bsc#1217936).
• PCI: Disable ATS for specific Intel IPU E2000 devices (bsc#1218622).
• gve: Add XDP DROP and TX support for GQI-QPL format (bsc#1214479).
• gve: Add XDP REDIRECT support for GQI-QPL format (bsc#1214479).
• gve: Changes to add new TX queues (bsc#1214479).
• gve: Control path for DQO-QPL (bsc#1214479).
• gve: Do not fully free QPL pages on prefill errors (bsc#1214479).
• gve: Fix gve interrupt names (bsc#1214479).
• gve: Fixes for napi_poll when budget is 0 (bsc#1214479).
• gve: RX path for DQO-QPL (bsc#1214479).
• gve: Set default duplex configuration to full (bsc#1214479).
• gve: Tx path for DQO-QPL (bsc#1214479).
• gve: Unify duplicate GQ min pkt desc size constants (bsc#1214479).
• gve: XDP support GQI-QPL: helper function changes (bsc#1214479).
• gve: fix frag_list chaining (bsc#1214479).
• gve: trivial spell fix Recive to Receive (bsc#1214479).
• gve: unify driver name usage (bsc#1214479).
• net/tg3: fix race condition in tg3_reset_task() (bsc#1217801).
• net/tg3: resolve deadlock in tg3_reset_task() during EEH (bsc#1217801).
• s390/vx: fix save/restore of fpu kernel context (bsc#1218362).
• tracing: Fix a possible race when disabling buffered events (bsc#1217036).
• tracing: Fix a warning when allocating buffered events fails (bsc#1217036).
• tracing: Fix incomplete locking when disabling buffered events (bsc#1217036).
• tracing: Fix warning in trace_buffered_event_disable() (bsc#1217036).

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-26555: Fixed an issue during BR/EDR PIN code pairing in the Bluetooth subsystem that would allow replay attacks (bsc#1179610 bsc#1215237).
• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsystem when adding a new event (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free issue when receiving an IGMP query packet due to reference count mismanagement (bsc#1218253).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).

The following non-security bugs were fixed:

• Enabled the LLC counters for “perf” (perf stat) on the Ice-Lake and Rocket-Lake CPUs (jsc#PED-5023 bsc#1211439).
• Reviewed and added more information to README.SUSE (jsc#PED-5021).
• Enabled multibuild for kernel packages (JSC-SLE#5501, boo#1211226, bsc#1218184).
• Fix termination state for idr_for_each_entry_ul() (bsc#1109837).
• KVM: s390/mm: Properly reset no-dat (bsc#1218057).
• KVM: s390: vsie: fix wrong VIR 37 when MSO is used (bsc#1217936).
• PCI: Disable ATS for specific Intel IPU E2000 devices (bsc#1218622).
• Previous perf cve-4.12->SLE12-SP5 manual merge was incorrect. Fix.
• gve: Add XDP DROP and TX support for GQI-QPL format (bsc#1214479).
• gve: Add XDP REDIRECT support for GQI-QPL format (bsc#1214479).
• gve: Changes to add new TX queues (bsc#1214479).
• gve: Control path for DQO-QPL (bsc#1214479).
• gve: Do not fully free QPL pages on prefill errors (bsc#1214479).
• gve: Fix gve interrupt names (bsc#1214479).
• gve: Fixes for napi_poll when budget is 0 (bsc#1214479).
• gve: RX path for DQO-QPL (bsc#1214479).
• gve: Set default duplex configuration to full (bsc#1214479).
• gve: Tx path for DQO-QPL (bsc#1214479).
• gve: Unify duplicate GQ min pkt desc size constants (bsc#1214479).
• gve: XDP support GQI-QPL: helper function changes (bsc#1214479).
• gve: fix frag_list chaining (bsc#1214479).
• gve: trivial spell fix Recive to Receive (bsc#1214479).
• gve: unify driver name usage (bsc#1214479).
• net/tg3: fix race condition in tg3_reset_task() (bsc#1217801).
• net/tg3: resolve deadlock in tg3_reset_task() during EEH (bsc#1217801).
• s390/vx: fix save/restore of fpu kernel context (bsc#1218362).
• tracing: Fix a possible race when disabling buffered events (bsc#1217036).
• tracing: Fix a warning when allocating buffered events fails (bsc#1217036).
• tracing: Fix incomplete locking when disabling buffered events (bsc#1217036).
• tracing: Fix warning in trace_buffered_event_disable() (bsc#1217036).

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).
• CVE-2023-6606: Fixed an out-of-bounds read vulnerability in smbCalcSize in fs/smb/client/netmisc.c that could allow a local attacker to crash the system or leak internal kernel information (bsc#1217947).
• CVE-2023-6610: Fixed an out-of-bounds read vulnerability in smb2_dump_detail in fs/smb/client/smb2ops.c that could allow a local attacker to crash the system or leak internal kernel information (bsc#1217946).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).

The following non-security bugs were fixed:

• doc/README.SUSE: Add how to update the config for module signing (jsc#PED-5021)
• doc/README.SUSE: Remove how to build modules using kernel-source (jsc#PED-5021)
• doc/README.SUSE: Simplify the list of references (jsc#PED-5021)

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on (bsc#1218447).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2020-26555: Fixed an issue during BR/EDR PIN code pairing in the Bluetooth subsystem that would allow replay attacks (bsc#1179610 bsc#1215237).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1218335).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).
• CVE-2023-6622: Fixed a null pointer dereference vulnerability in nft_dynset_init() that could allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service (bsc#1217938).
• CVE-2023-6121: Fixed an information leak via dmesg when receiving a crafted packet in the NVMe-oF/TCP subsystem (bsc#1217250).

The following non-security bugs were fixed:

• Reviewed and added more information to README.SUSE (jsc#PED-5021).
• Build in the correct KOTD repository with multibuild (JSC-SLE#5501, boo#1211226, bsc#1218184) With multibuild setting repository flags is no longer supported for individual spec files - see https://github.com/openSUSE/open-build-service/issues/3574 Add ExclusiveArch conditional that depends on a macro set up by bs-upload-kernel instead. With that each package should build only in one repository - either standard or QA. Note: bs-upload-kernel does not interpret rpm conditionals, and only uses the first ExclusiveArch line to determine the architectures to enable.
• KVM: s390/mm: Properly reset no-dat (bsc#1218056).
• KVM: s390: vsie: fix wrong VIR 37 when MSO is used (bsc#1217933).
• KVM: x86: Mask LVTPC when handling a PMI (jsc#PED-7322).
• NFS: Fix O_DIRECT locking issues (bsc#1211162).
• NFS: Fix a few more clear_bit() instances that need release semantics (bsc#1211162).
• NFS: Fix a potential data corruption (bsc#1211162).
• NFS: Fix a use after free in nfs_direct_join_group() (bsc#1211162).
• NFS: Fix error handling for O_DIRECT write scheduling (bsc#1211162).
• NFS: More O_DIRECT accounting fixes for error paths (bsc#1211162).
• NFS: More fixes for nfs_direct_write_reschedule_io() (bsc#1211162).
• NFS: Use the correct commit info in nfs_join_page_group() (bsc#1211162).
• NLM: Defend against file_lock changes after vfs_test_lock() (bsc#1217692).
• Updated SPI patches for NVIDIA Grace enablement (bsc#1212584, jsc#PED-3459).
• block: fix revalidate performance regression (bsc#1216057).
• bpf: Adjust insufficient default bpf_jit_limit (bsc#1218234).
• ceph: fix incorrect revoked caps assert in ceph_fill_file_size() (bsc#1217980).
• ceph: fix type promotion bug on 32bit systems (bsc#1217982).
• clocksource: Add a Kconfig option for WATCHDOG_MAX_SKEW (bsc#1215885 bsc#1217217).
• clocksource: Enable TSC watchdog checking of HPET and PMTMR only when requested (bsc#1215885 bsc#1217217).
• clocksource: Handle negative skews in 'skew is too large' messages (bsc#1215885 bsc#1217217).
• clocksource: Improve 'skew is too large' messages (bsc#1215885 bsc#1217217).
• clocksource: Improve read-back-delay message (bsc#1215885 bsc#1217217).
• clocksource: Loosen clocksource…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1218335).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).
• CVE-2023-6622: Fixed a null pointer dereference vulnerability in nft_dynset_init() that could allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service (bsc#1217938).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).

The following non-security bugs were fixed:

• Documentation: KVM: add separate directories for architecture-specific documentation (jsc#PED-7167).
• Documentation: KVM: update amd-memory-encryption.rst references (jsc#PED-7167).
• Documentation: KVM: update msr.rst reference (jsc#PED-7167).
• Documentation: KVM: update s390-diag.rst reference (jsc#PED-7167).
• Documentation: KVM: update s390-pv.rst reference (jsc#PED-7167).
• Documentation: drop more IDE boot options and ide-cd.rst (git-fixes).
• Documentation: qat: Use code block for qat sysfs example (git-fixes).
• Drop Documentation/ide/ (git-fixes).
• Fix crash on screen resize (bsc#1218229)
• Fix drm gem object underflow (bsc#1218092)
• Revert 'Limit kernel-source-azure build to architectures for which we build binaries (bsc#1108281).'
• Revert 'PCI/ASPM: Remove pcie_aspm_pm_state_change()' (git-fixes).
• Revert 'PCI: acpiphp: Reassign resources on bridge if necessary' (git-fixes).
• Revert 'md: unlock mddev before reap sync_thread in action_store' (git-fixes).
• Revert 'swiotlb: panic if nslabs is too small' (git-fixes).
• Revert 'xhci: Loosen RPM as default policy to cover for AMD xHC 1.1' (git-fixes).
• Update: drm/vmwgfx: Keep a gem reference to user bos in surfaces
• acpi: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 (git-fixes).
• acpi: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects (git-fixes).
• acpica: Add AML_NO_OPERAND_RESOLVE flag to Timer (git-fixes).
• afs: Fix afs_server_list to be cleaned up with RCU (git-fixes).
• afs: Fix dynamic root lookup DNS check (git-fixes).
• afs: Fix file locking on R/O volumes to operate in local mode (git-fixes).
• afs: Fix overwriting of result of DNS query (git-fixes).
• afs: Fix refcount underflow from error handling race (git-fixes).
• afs: Fix the dynamic root's d_delete to always delete unused dentries (git-fixes).
• afs: Fix use-after-free due to get/remove race in volume tree (git-fixes).
• afs: Make error on cell lookup failure consistent with OpenAFS (git-fixes).
• afs: Return ENOENT if no cell DNS record can be found (git-fixes).
• alsa: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).

The following non-security bugs were fixed:

• clocksource: Avoid accidental unstable marking of clocksources (bsc#1218105).
• clocksource: Suspend the watchdog temporarily when high read latency detected (bsc#1218105).
• doc/README.SUSE: Add how to update the config for module signing (jsc#PED-5021)
• doc/README.SUSE: Remove how to build modules using kernel-source (jsc#PED-5021)
• doc/README.SUSE: Simplify the list of references (jsc#PED-5021).
• efi/mokvar: Reserve the table only if it is in boot services data (bsc#1215375).
• io_uring: fix 32-bit compatability with sendmsg/recvmsg (bsc#1217709).

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).

The following non-security bugs were fixed:

• doc/README.SUSE: Add how to update the config for module signing (jsc#PED-5021)
• doc/README.SUSE: Remove how to build modules using kernel-source (jsc#PED-5021)
• doc/README.SUSE: Simplify the list of references (jsc#PED-5021)
• io_uring: fix 32-bit compatability with sendmsg/recvmsg (bsc#1217709).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2020-26555: Fixed an issue during BR/EDR PIN code pairing in the Bluetooth subsystem that would allow replay attacks (bsc#1179610 bsc#1215237).
• CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1218335).
• CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsystem when adding a new event (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free issue when receiving an IGMP query packet due to reference count mismanagement (bsc#1218253).
• CVE-2023-6622: Fixed a null pointer dereference vulnerability in nft_dynset_init() that could allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service (bsc#1217938).
• CVE-2023-6121: Fixed an information leak via dmesg when receiving a crafted packet in the NVMe-oF/TCP subsystem (bsc#1217250).

The following non-security bugs were fixed:

• Reviewed and added more information to README.SUSE (jsc#PED-5021).
• Enabled multibuild for kernel packages (JSC-SLE#5501, boo#1211226, bsc#1218184).
• Drop drm/bridge lt9611uxc patches that have been reverted on stable trees
• KVM: s390/mm: Properly reset no-dat (bsc#1218056).
• KVM: s390: vsie: fix wrong VIR 37 when MSO is used (bsc#1217933).
• KVM: x86: Mask LVTPC when handling a PMI (jsc#PED-7322).
• NFS: Fix O_DIRECT locking issues (bsc#1211162).
• NFS: Fix a few more clear_bit() instances that need release semantics (bsc#1211162).
• NFS: Fix a potential data corruption (bsc#1211162).
• NFS: Fix a use after free in nfs_direct_join_group() (bsc#1211162).
• NFS: Fix error handling for O_DIRECT write scheduling (bsc#1211162).
• NFS: More O_DIRECT accounting fixes for error paths (bsc#1211162).
• NFS: More fixes for nfs_direct_write_reschedule_io() (bsc#1211162).
• NFS: Use the correct commit info in nfs_join_page_group() (bsc#1211162).
• NLM: Defend against file_lock changes after vfs_test_lock() (bsc#1217692).
• Updated SPI patches for NVIDIA Grace enablement (bsc#1212584 jsc#PED-3459)
• block: fix revalidate performance regression (bsc#1216057).
• bpf: Adjust insufficient default bpf_jit_limit (bsc#1218234).
• ceph: fix incorrect revoked caps assert in ceph_fill_file_size() (bsc#1217980).
• ceph: fix type promotion bug on 32bit systems (bsc#1217982).
• clocksource: Add a Kconfig option for WATCHDOG_MAX_SKEW (bsc#1215885 bsc#1217217).
• clocksource: Enable TSC watchdog checking of HPET and PMTMR only when requested (bsc#1215885 bsc#1217217).
• clocksource: Handle negative skews in 'skew is too large' messages (bsc#1215885 bsc#1217217).
• clocksource: Improve 'skew is too large' messages (bsc#1215885 bsc#1217217).
• clocksource: Improve read-back-delay message (bsc#1215885 bsc#1217217).
• clocksource: Loosen clocksource watchdog constraints (bsc#1215885 bsc#1217217).
• clocksource: Print clocksource name when clocksource is tested unstable (bsc#1215885 bsc#1217217).
• clocksource: Verify HPET and PMTMR when TSC unverified (bsc#1215885 bsc#1217217).
• dm_blk_ioctl: implement path failover for SG_IO (bsc#1183045, bsc#1216776).
• fuse: dax: set fc->dax to NULL in fuse_dax_conn_free() (bsc#1218659).
• libceph: use kernel_connect() (bsc#1217981).
• mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors (bsc#1218515). -…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
• CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1218335).
• CVE-2023-6606: Fixed an out-of-bounds read vulnerability in smbCalcSize in fs/smb/client/netmisc.c that could allow a local attacker to crash the system or leak internal kernel information (bsc#1217947).
• CVE-2023-6610: Fixed an out-of-bounds read vulnerability in smb2_dump_detail in fs/smb/client/smb2ops.c that could allow a local attacker to crash the system or leak internal kernel information (bsc#1217946).
• CVE-2023-6622: Fixed a null pointer dereference vulnerability in nft_dynset_init() that could allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service (bsc#1217938).
• CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
• CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).

The following non-security bugs were fixed:

• Documentation: KVM: add separate directories for architecture-specific documentation (jsc#PED-7167).
• Documentation: KVM: update amd-memory-encryption.rst references (jsc#PED-7167).
• Documentation: KVM: update msr.rst reference (jsc#PED-7167).
• Documentation: KVM: update s390-diag.rst reference (jsc#PED-7167).
• Documentation: KVM: update s390-pv.rst reference (jsc#PED-7167).
• Documentation: drop more IDE boot options and ide-cd.rst (git-fixes).
• Documentation: qat: Use code block for qat sysfs example (git-fixes).
• Drop Documentation/ide/ (git-fixes).
• Fix crash in vmw_context_cotables_unref when 3d support is enabled (bsc#1218738)
• Fix crash on screen resize (bsc#1218229)
• Fix drm gem object underflow (bsc#1218092)
• Revert 'PCI/ASPM: Remove pcie_aspm_pm_state_change()' (git-fixes).
• Revert 'PCI: acpiphp: Reassign resources on bridge if necessary' (git-fixes).
• Revert 'md: unlock mddev before reap sync_thread in action_store' (git-fixes).
• Revert 'swiotlb: panic if nslabs is too small' (git-fixes).
• Revert 'xhci: Loosen RPM as default policy to cover for AMD xHC 1.1' (git-fixes).
• Update: drm/vmwgfx: Keep a gem reference to user bos in surfaces
• acpi: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 (git-fixes).
• acpi: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects (git-fixes).
• acpica: Add AML_NO_OPERAND_RESOLVE flag to Timer (git-fixes).
• afs: Fix afs_server_list to be cleaned up with RCU (git-fixes).
• afs: Fix dynamic root lookup DNS check (git-fixes).
• afs: Fix file locking on R/O volumes to operate in local mode (git-fixes).
• afs: Fix overwriting of result of DNS query (git-fixes).
• afs: Fix refcount underflow from error handling race (git-fixes).
• afs: Fix the dynamic root's d_delete to always delete unused dentries (git-fixes).
• afs: Fix use-after-free due to get/remove race in volume tree (git-fixes).
• afs: Make error on cell lookup failure consistent with OpenAFS…