CVE-2024-50154

In the Linux kernel, the following vulnerability has been resolved:

tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().

Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler().

""" We are seeing a use-after-free from a bpf prog attached to trace_tcp_retransmit_synack. The program passes the req->sk to the bpf_sk_storage_get_tracing kernel helper which does check for null before using it. """

The commit 83fccfc3940c ("inet: fix potential deadlock in reqsk_queue_unlink()") added timer_pending() in reqsk_queue_unlink() not to call del_timer_sync() from reqsk_timer_handler(), but it introduced a small race window.

Before the timer is called, expire_timers() calls detach_timer(timer, true) to clear timer->entry.pprev and marks it as not pending.

If reqsk_queue_unlink() checks timer_pending() just after expire_timers() calls detach_timer(), TCP will miss del_timer_sync(); the reqsk timer will continue running and send multiple SYN+ACKs until it expires.

The reported UAF could happen if req->sk is close()d earlier than the timer expiration, which is 63s by default.

The scenario would be

1. inet_csk_complete_hashdance() calls inet_csk_reqsk_queue_drop(), but del_timer_sync() is missed

2. reqsk timer is executed and scheduled again

3. req->sk is accept()ed and reqsk_put() decrements rsk_refcnt, but reqsk timer still has another one, and inet_csk_accept() does not clear req->sk for non-TFO sockets

4. sk is close()d

5. reqsk timer is executed again, and BPF touches req->sk

Let's not use timer_pending() by passing the caller context to __inet_csk_reqsk_queue_drop().

Note that reqsk timer is pinned, so the issue does not happen in most use cases. [1]

[0] BUG: KFENCE: use-after-free read in bpf_sk_storage_get_tracing+0x2e/0x1b0

Use-after-free read at 0x00000000a891fb3a (in kfence-#1): bpf_sk_storage_get_tracing+0x2e/0x1b0 bpf_prog_5ea3e95db6da0438_tcp_retransmit_synack+0x1d20/0x1dda bpf_trace_run2+0x4c/0xc0 tcp_rtx_synack+0xf9/0x100 reqsk_timer_handler+0xda/0x3d0 run_timer_softirq+0x292/0x8a0 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 intel_idle_irq+0x5a/0xa0 cpuidle_enter_state+0x94/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb

kfence-#1: 0x00000000a72cc7b6-0x00000000d97616d9, size=2376, cache=TCPv6

allocated by task 0 on cpu 9 at 260507.901592s: sk_prot_alloc+0x35/0x140 sk_clone_lock+0x1f/0x3f0 inet_csk_clone_lock+0x15/0x160 tcp_create_openreq_child+0x1f/0x410 tcp_v6_syn_recv_sock+0x1da/0x700 tcp_check_req+0x1fb/0x510 tcp_v6_rcv+0x98b/0x1420 ipv6_list_rcv+0x2258/0x26e0 napi_complete_done+0x5b1/0x2990 mlx5e_napi_poll+0x2ae/0x8d0 net_rx_action+0x13e/0x590 irq_exit_rcu+0xf5/0x320 common_interrupt+0x80/0x90 asm_common_interrupt+0x22/0x40 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb

freed by task 0 on cpu 9 at 260507.927527s: rcu_core_si+0x4ff/0xf10 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb

In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler(). """ We are seeing a use-after-free from a bpf prog attached to trace_tcp_retransmit_synack. The program passes the req->sk to the bpf_sk_storage_get_tracing kernel helper which does check for null before using it. """ The commit 83fccfc3940c ("inet: fix potential deadlock in reqsk_queue_unlink()") added timer_pending() in reqsk_queue_unlink() not to call del_timer_sync() from reqsk_timer_handler(), but it introduced a small race window. Before the timer is called, expire_timers() calls detach_timer(timer, true) to clear timer->entry.pprev and marks it as not pending. If reqsk_queue_unlink() checks timer_pending() just after expire_timers() calls detach_timer(), TCP will miss del_timer_sync(); the reqsk timer will continue running and send multiple SYN+ACKs until it expires. The reported UAF could happen if req->sk is close()d earlier than the timer expiration, which is 63s by default. The scenario would be 1. inet_csk_complete_hashdance() calls inet_csk_reqsk_queue_drop(), but del_timer_sync() is missed 2. reqsk timer is executed and scheduled again 3. req->sk is accept()ed and reqsk_put() decrements rsk_refcnt, but reqsk timer still has another one, and inet_csk_accept() does not clear req->sk for non-TFO sockets 4. sk is close()d 5. reqsk timer is executed again, and BPF touches req->sk Let's not use timer_pending() by passing the caller context to __inet_csk_reqsk_queue_drop(). Note that reqsk timer is pinned, so the issue does not happen in most use cases. [1] [0] BUG: KFENCE: use-after-free read in bpf_sk_storage_get_tracing+0x2e/0x1b0 Use-after-free read at 0x00000000a891fb3a (in kfence-#1): bpf_sk_storage_get_tracing+0x2e/0x1b0 bpf_prog_5ea3e95db6da0438_tcp_retransmit_synack+0x1d20/0x1dda bpf_trace_run2+0x4c/0xc0 tcp_rtx_synack+0xf9/0x100 reqsk_timer_handler+0xda/0x3d0 run_timer_softirq+0x292/0x8a0 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 intel_idle_irq+0x5a/0xa0 cpuidle_enter_state+0x94/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb kfence-#1: 0x00000000a72cc7b6-0x00000000d97616d9, size=2376, cache=TCPv6 allocated by task 0 on cpu 9 at 260507.901592s: sk_prot_alloc+0x35/0x140 sk_clone_lock+0x1f/0x3f0 inet_csk_clone_lock+0x15/0x160 tcp_create_openreq_child+0x1f/0x410 tcp_v6_syn_recv_sock+0x1da/0x700 tcp_check_req+0x1fb/0x510 tcp_v6_rcv+0x98b/0x1420 ipv6_list_rcv+0x2258/0x26e0 napi_complete_done+0x5b1/0x2990 mlx5e_napi_poll+0x2ae/0x8d0 net_rx_action+0x13e/0x590 irq_exit_rcu+0xf5/0x320 common_interrupt+0x80/0x90 asm_common_interrupt+0x22/0x40 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb freed by task 0 on cpu 9 at 260507.927527s: rcu_core_si+0x4ff/0xf10 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: single: fix potential NULL dereference in pcs_get_function()

pinmux_generic_get_function() can return NULL and the pointer 'function' was dereferenced without checking against NULL. Add checking of pointer 'function' in pcs_get_function().

Found by code review.(CVE-2024-46685)

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Mark XDomain as unplugged when router is removed

I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another host connected with enabled paths we hang in tearing them down. This is due to fact that the Thunderbolt networking driver also tries to cleanup the paths and ends up blocking in tb_disconnect_xdomain_paths() waiting for the domain lock.

However, at this point we already cleaned the paths in tb_stop() so there is really no need for tb_disconnect_xdomain_paths() to do that anymore. Furthermore it already checks if the XDomain is unplugged and bails out early so take advantage of that and mark the XDomain as unplugged when we remove the parent router.(CVE-2024-46702)

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]

[WHY & HOW] num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets - 1].

This fixes an OVERRUN issue reported by Coverity.(CVE-2024-46815)

In the Linux kernel, the following vulnerability has been resolved: vfs: fix race between evice_inodes() and find_inode()&iput() Hi, all Recently I noticed a bug[1] in btrfs, after digged it into and I believe it'a race in vfs. Let's assume there's a inode (ie ino 261) with i_count 1 is called by iput(), and there's a concurrent thread calling generic_shutdown_super(). cpu0: cpu1: iput() // i_count is 1 ->spin_lock(inode) ->dec i_count to 0 ->iput_final() generic_shutdown_super() ->__inode_add_lru() ->evict_inodes() // cause some reason[2] ->if (atomic_read(inode->i_count)) continue; // return before // inode 261 passed the above check // list_lru_add_obj() // and then schedule out ->spin_unlock() // note here: the inode 261 // was still at sb list and hash list, // and I_FREEING|I_WILL_FREE was not been set btrfs_iget() // after some function calls ->find_inode() // found the above inode 261 ->spin_lock(inode) // check I_FREEING|I_WILL_FREE // and passed ->__iget() ->spin_unlock(inode) // schedule back ->spin_lock(inode) // check (I_NEW|I_FREEING|I_WILL_FREE) flags, // passed and set I_FREEING iput() ->spin_unlock(inode) ->spin_lock(inode) ->evict() // dec i_count to 0 ->iput_final() ->spin_unlock() ->evict() Now, we have two threads simultaneously evicting the same inode, which may trigger the BUG(inode->i_state & I_CLEAR) statement both within clear_inode() and iput(). To fix the bug, recheck the inode->i_count after holding i_lock. Because in the most scenarios, the first check is valid, and the overhead of spin_lock() can be reduced. If there is any misunderstanding, please let me know, thanks. [1]: https://lore.kernel.org/linux-btrfs/[email protected]/ [2]: The reason might be 1. SB_ACTIVE was removed or 2. mapping_shrinkable() return false when I reproduced the bug.(CVE-2024-47679)

In the Linux…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: single: fix potential NULL dereference in pcs_get_function()

pinmux_generic_get_function() can return NULL and the pointer 'function' was dereferenced without checking against NULL. Add checking of pointer 'function' in pcs_get_function().

Found by code review.(CVE-2024-46685)

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Mark XDomain as unplugged when router is removed

I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another host connected with enabled paths we hang in tearing them down. This is due to fact that the Thunderbolt networking driver also tries to cleanup the paths and ends up blocking in tb_disconnect_xdomain_paths() waiting for the domain lock.

However, at this point we already cleaned the paths in tb_stop() so there is really no need for tb_disconnect_xdomain_paths() to do that anymore. Furthermore it already checks if the XDomain is unplugged and bails out early so take advantage of that and mark the XDomain as unplugged when we remove the parent router.(CVE-2024-46702)

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]

[WHY & HOW] num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets - 1].

This fixes an OVERRUN issue reported by Coverity.(CVE-2024-46815)

In the Linux kernel, the following vulnerability has been resolved: vfs: fix race between evice_inodes() and find_inode()&iput() Hi, all Recently I noticed a bug[1] in btrfs, after digged it into and I believe it'a race in vfs. Let's assume there's a inode (ie ino 261) with i_count 1 is called by iput(), and there's a concurrent thread calling generic_shutdown_super(). cpu0: cpu1: iput() // i_count is 1 ->spin_lock(inode) ->dec i_count to 0 ->iput_final() generic_shutdown_super() ->__inode_add_lru() ->evict_inodes() // cause some reason[2] ->if (atomic_read(inode->i_count)) continue; // return before // inode 261 passed the above check // list_lru_add_obj() // and then schedule out ->spin_unlock() // note here: the inode 261 // was still at sb list and hash list, // and I_FREEING|I_WILL_FREE was not been set btrfs_iget() // after some function calls ->find_inode() // found the above inode 261 ->spin_lock(inode) // check I_FREEING|I_WILL_FREE // and passed ->__iget() ->spin_unlock(inode) // schedule back ->spin_lock(inode) // check (I_NEW|I_FREEING|I_WILL_FREE) flags, // passed and set I_FREEING iput() ->spin_unlock(inode) ->spin_lock(inode) ->evict() // dec i_count to 0 ->iput_final() ->spin_unlock() ->evict() Now, we have two threads simultaneously evicting the same inode, which may trigger the BUG(inode->i_state & I_CLEAR) statement both within clear_inode() and iput(). To fix the bug, recheck the inode->i_count after holding i_lock. Because in the most scenarios, the first check is valid, and the overhead of spin_lock() can be reduced. If there is any misunderstanding, please let me know, thanks. [1]: https://lore.kernel.org/linux-btrfs/[email protected]/ [2]: The reason might be 1. SB_ACTIVE was removed or 2. mapping_shrinkable() return false when I reproduced the bug.(CVE-2024-47679)

In the Linux…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: single: fix potential NULL dereference in pcs_get_function()

pinmux_generic_get_function() can return NULL and the pointer 'function' was dereferenced without checking against NULL. Add checking of pointer 'function' in pcs_get_function().

Found by code review.(CVE-2024-46685)

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Mark XDomain as unplugged when router is removed

I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another host connected with enabled paths we hang in tearing them down. This is due to fact that the Thunderbolt networking driver also tries to cleanup the paths and ends up blocking in tb_disconnect_xdomain_paths() waiting for the domain lock.

However, at this point we already cleaned the paths in tb_stop() so there is really no need for tb_disconnect_xdomain_paths() to do that anymore. Furthermore it already checks if the XDomain is unplugged and bails out early so take advantage of that and mark the XDomain as unplugged when we remove the parent router.(CVE-2024-46702)

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]

[WHY & HOW] num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets - 1].

This fixes an OVERRUN issue reported by Coverity.(CVE-2024-46815)

In the Linux kernel, the following vulnerability has been resolved: vfs: fix race between evice_inodes() and find_inode()&iput() Hi, all Recently I noticed a bug[1] in btrfs, after digged it into and I believe it'a race in vfs. Let's assume there's a inode (ie ino 261) with i_count 1 is called by iput(), and there's a concurrent thread calling generic_shutdown_super(). cpu0: cpu1: iput() // i_count is 1 ->spin_lock(inode) ->dec i_count to 0 ->iput_final() generic_shutdown_super() ->__inode_add_lru() ->evict_inodes() // cause some reason[2] ->if (atomic_read(inode->i_count)) continue; // return before // inode 261 passed the above check // list_lru_add_obj() // and then schedule out ->spin_unlock() // note here: the inode 261 // was still at sb list and hash list, // and I_FREEING|I_WILL_FREE was not been set btrfs_iget() // after some function calls ->find_inode() // found the above inode 261 ->spin_lock(inode) // check I_FREEING|I_WILL_FREE // and passed ->__iget() ->spin_unlock(inode) // schedule back ->spin_lock(inode) // check (I_NEW|I_FREEING|I_WILL_FREE) flags, // passed and set I_FREEING iput() ->spin_unlock(inode) ->spin_lock(inode) ->evict() // dec i_count to 0 ->iput_final() ->spin_unlock() ->evict() Now, we have two threads simultaneously evicting the same inode, which may trigger the BUG(inode->i_state & I_CLEAR) statement both within clear_inode() and iput(). To fix the bug, recheck the inode->i_count after holding i_lock. Because in the most scenarios, the first check is valid, and the overhead of spin_lock() can be reduced. If there is any misunderstanding, please let me know, thanks. [1]: https://lore.kernel.org/linux-btrfs/[email protected]/ [2]: The reason might be 1. SB_ACTIVE was removed or 2. mapping_shrinkable() return false when I reproduced the bug.(CVE-2024-47679)

In the Linux…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: bpf: support non-r10 register spill/fill to/from stack in precision tracking Use instruction (jump) history to record instructions that performed register spill/fill to/from stack, regardless if this was done through read-only r10 register, or any other register after copying r10 into it and potentially adjusting offset. To make this work reliably, we push extra per-instruction flags into instruction history, encoding stack slot index (spi) and stack frame number in extra 10 bit flags we take away from prev_idx in instruction history. We don't touch idx field for maximum performance, as it's checked most frequently during backtracking. This change removes basically the last remaining practical limitation of precision backtracking logic in BPF verifier. It fixes known deficiencies, but also opens up new opportunities to reduce number of verified states, explored in the subsequent patches. There are only three differences in selftests' BPF object files according to veristat, all in the positive direction (less states). File Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF) -------------------------------------- ------------- --------- --------- ------------- ---------- ---------- ------------- test_cls_redirect_dynptr.bpf.linked3.o cls_redirect 2987 2864 -123 (-4.12%) 240 231 -9 (-3.75%) xdp_synproxy_kern.bpf.linked3.o syncookie_tc 82848 82661 -187 (-0.23%) 5107 5073 -34 (-0.67%) xdp_synproxy_kern.bpf.linked3.o syncookie_xdp 85116 84964 -152 (-0.18%) 5162 5130 -32 (-0.62%) Note, I avoided renaming jmp_history to more generic insn_hist to minimize number of lines changed and potential merge conflicts between bpf and bpf-next trees. Notice also cur_hist_entry pointer reset to NULL at the beginning of instruction verification loop. This pointer avoids the problem of relying on last jump history entry's insn_idx to determine whether we already have entry for current instruction or not. It can happen that we added jump history entry because current instruction is_jmp_point(), but also we need to add instruction flags for stack access. In this case, we don't want to entries, so we need to reuse last added entry, if it is present. Relying on insn_idx comparison has the same ambiguity problem as the one that was fixed recently in [0], so we avoid that. [0] https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/(CVE-2023-52920)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: only mark 'subflow' endp as available

Adding the following warning ...

WARN_ON_ONCE(msk->pm.local_addr_used == 0)

... before decrementing the local_addr_used counter helped to find a bug when running the "remove single address" subtest from the mptcp_join.sh selftests.

Removing a 'signal' endpoint will trigger the removal of all subflows linked to this endpoint via mptcp_pm_nl_rm_addr_or_subflow() with rm_type == MPTCP_MIB_RMSUBFLOW. This will decrement the local_addr_used counter, which is wrong in this case because this counter is linked to 'subflow' endpoints, and here it is a 'signal' endpoint that is being removed.

Now, the counter is decremented, only if the ID is being used outside of mptcp_pm_nl_rm_addr_or_subflow(), only for 'subflow' endpoints, and if the ID is not 0 -- local_addr_used is not taking into account these ones. This marking of the ID as being available, and the decrement is done no matter if a subflow using this ID is currently available, because the subflow could have been closed before.(CVE-2024-45010)

In the Linux…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler(). """ We are seeing a use-after-free from a bpf prog attached to trace_tcp_retransmit_synack. The program passes the req->sk to the bpf_sk_storage_get_tracing kernel helper which does check for null before using it. """ The commit 83fccfc3940c ("inet: fix potential deadlock in reqsk_queue_unlink()") added timer_pending() in reqsk_queue_unlink() not to call del_timer_sync() from reqsk_timer_handler(), but it introduced a small race window. Before the timer is called, expire_timers() calls detach_timer(timer, true) to clear timer->entry.pprev and marks it as not pending. If reqsk_queue_unlink() checks timer_pending() just after expire_timers() calls detach_timer(), TCP will miss del_timer_sync(); the reqsk timer will continue running and send multiple SYN+ACKs until it expires. The reported UAF could happen if req->sk is close()d earlier than the timer expiration, which is 63s by default. The scenario would be 1. inet_csk_complete_hashdance() calls inet_csk_reqsk_queue_drop(), but del_timer_sync() is missed 2. reqsk timer is executed and scheduled again 3. req->sk is accept()ed and reqsk_put() decrements rsk_refcnt, but reqsk timer still has another one, and inet_csk_accept() does not clear req->sk for non-TFO sockets 4. sk is close()d 5. reqsk timer is executed again, and BPF touches req->sk Let's not use timer_pending() by passing the caller context to __inet_csk_reqsk_queue_drop(). Note that reqsk timer is pinned, so the issue does not happen in most use cases. [1] [0] BUG: KFENCE: use-after-free read in bpf_sk_storage_get_tracing+0x2e/0x1b0 Use-after-free read at 0x00000000a891fb3a (in kfence-#1): bpf_sk_storage_get_tracing+0x2e/0x1b0 bpf_prog_5ea3e95db6da0438_tcp_retransmit_synack+0x1d20/0x1dda bpf_trace_run2+0x4c/0xc0 tcp_rtx_synack+0xf9/0x100 reqsk_timer_handler+0xda/0x3d0 run_timer_softirq+0x292/0x8a0 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 intel_idle_irq+0x5a/0xa0 cpuidle_enter_state+0x94/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb kfence-#1: 0x00000000a72cc7b6-0x00000000d97616d9, size=2376, cache=TCPv6 allocated by task 0 on cpu 9 at 260507.901592s: sk_prot_alloc+0x35/0x140 sk_clone_lock+0x1f/0x3f0 inet_csk_clone_lock+0x15/0x160 tcp_create_openreq_child+0x1f/0x410 tcp_v6_syn_recv_sock+0x1da/0x700 tcp_check_req+0x1fb/0x510 tcp_v6_rcv+0x98b/0x1420 ipv6_list_rcv+0x2258/0x26e0 napi_complete_done+0x5b1/0x2990 mlx5e_napi_poll+0x2ae/0x8d0 net_rx_action+0x13e/0x590 irq_exit_rcu+0xf5/0x320 common_interrupt+0x80/0x90 asm_common_interrupt+0x22/0x40 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb freed by task 0 on cpu 9 at 260507.927527s: rcu_core_si+0x4ff/0xf10 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb(CVE-2024-50154)

In the Linux kernel, the following vulnerability has been resolved: ceph: remove the incorrect Fw reference check when dirtying pages When doing the direct-io reads it will also try to mark pages dirty, but for the read path it won't hold the Fw caps and there is case will it get the Fw reference.(CVE-2024-50179)

In the Linux kernel, the following vulnerability has been resolved: nilfs2: propagate directory read errors from nilfs_find_entry() Syzbot reported that a task hang occurs in vcs_open() during a fuzzing test for…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)

• kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)

• kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler(). """ We are seeing a use-after-free from a bpf prog attached to trace_tcp_retransmit_synack. The program passes the req->sk to the bpf_sk_storage_get_tracing kernel helper which does check for null before using it. """ The commit 83fccfc3940c ("inet: fix potential deadlock in reqsk_queue_unlink()") added timer_pending() in reqsk_queue_unlink() not to call del_timer_sync() from reqsk_timer_handler(), but it introduced a small race window. Before the timer is called, expire_timers() calls detach_timer(timer, true) to clear timer->entry.pprev and marks it as not pending. If reqsk_queue_unlink() checks timer_pending() just after expire_timers() calls detach_timer(), TCP will miss del_timer_sync(); the reqsk timer will continue running and send multiple SYN+ACKs until it expires. The reported UAF could happen if req->sk is close()d earlier than the timer expiration, which is 63s by default. The scenario would be 1. inet_csk_complete_hashdance() calls inet_csk_reqsk_queue_drop(), but del_timer_sync() is missed 2. reqsk timer is executed and scheduled again 3. req->sk is accept()ed and reqsk_put() decrements rsk_refcnt, but reqsk timer still has another one, and inet_csk_accept() does not clear req->sk for non-TFO sockets 4. sk is close()d 5. reqsk timer is executed again, and BPF touches req->sk Let's not use timer_pending() by passing the caller context to __inet_csk_reqsk_queue_drop(). Note that reqsk timer is pinned, so the issue does not happen in most use cases. [1] [0] BUG: KFENCE: use-after-free read in bpf_sk_storage_get_tracing+0x2e/0x1b0 Use-after-free read at 0x00000000a891fb3a (in kfence-#1): bpf_sk_storage_get_tracing+0x2e/0x1b0 bpf_prog_5ea3e95db6da0438_tcp_retransmit_synack+0x1d20/0x1dda bpf_trace_run2+0x4c/0xc0 tcp_rtx_synack+0xf9/0x100 reqsk_timer_handler+0xda/0x3d0 run_timer_softirq+0x292/0x8a0 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 intel_idle_irq+0x5a/0xa0 cpuidle_enter_state+0x94/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb kfence-#1: 0x00000000a72cc7b6-0x00000000d97616d9, size=2376, cache=TCPv6 allocated by task 0 on cpu 9 at 260507.901592s: sk_prot_alloc+0x35/0x140 sk_clone_lock+0x1f/0x3f0 inet_csk_clone_lock+0x15/0x160 tcp_create_openreq_child+0x1f/0x410 tcp_v6_syn_recv_sock+0x1da/0x700 tcp_check_req+0x1fb/0x510 tcp_v6_rcv+0x98b/0x1420 ipv6_list_rcv+0x2258/0x26e0 napi_complete_done+0x5b1/0x2990 mlx5e_napi_poll+0x2ae/0x8d0 net_rx_action+0x13e/0x590 irq_exit_rcu+0xf5/0x320 common_interrupt+0x80/0x90 asm_common_interrupt+0x22/0x40 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb freed by task 0 on cpu 9 at 260507.927527s: rcu_core_si+0x4ff/0xf10 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)
• kernel: arm64/sve: Discard stale CPU state when handling SVE traps (CVE-2024-50275)
• kernel: i40e: fix race condition by adding filter's intermediate sync state (CVE-2024-53088)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)
• kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)
• kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-url: https://ubuntu.com/security/CVE-2024-26595
  • mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
• CVE-url: https://ubuntu.com/security/CVE-2024-38553/CVE-2024-38597
  • netpoll: make ndo_poll_controller() optional
  • bonding: use netpoll_poll_dev() helper
  • netpoll: do not test NAPI_STATE_SCHED in poll_one_napi()
• CVE-url: https://ubuntu.com/security/CVE-2024-38597
  • eth: sungem: remove .ndo_poll_controller to avoid deadlocks
• CVE-url: https://ubuntu.com/security/CVE-2024-38553
  • net: fec: remove .ndo_poll_controller to avoid deadlocks
• CVE-url: https://ubuntu.com/security/CVE-2024-42252
  • closures: Change BUG_ON() to WARN_ON()
• CVE-url: https://ubuntu.com/security/CVE-2024-41066
  • ibmvnic: Add tx check to prevent skb leak
• CVE-url: https://ubuntu.com/security/CVE-2024-40982
  • ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
• CVE-url: https://ubuntu.com/security/CVE-2024-26689
  • ceph: prevent use-after-free in encode_cap_msg()
  • fixup! ceph: prevent use-after-free in encode_cap_msg()
• CVE-url: https://ubuntu.com/security/CVE-2024-56595
  • jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
• CVE-url: https://ubuntu.com/security/CVE-2024-57892
  • ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
• CVE-url: https://ubuntu.com/security/CVE-2024-57896
  • btrfs: fix hang during unmount when stopping a space reclaim worker
  • btrfs: wait for fixup workers before stopping cleaner kthread during umount
  • btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
• CVE-url: https://ubuntu.com/security/CVE-2024-56598
  • jfs: array-index-out-of-bounds fix in dtReadFirst
• CVE-url: https://ubuntu.com/security/CVE-2024-56551
  • drm/amdgpu: fix usage slab after free
• CVE-url: https://ubuntu.com/security/CVE-2024-56596
  • jfs: fix array-index-out-of-bounds in jfs_readdir
• CVE-url: https://ubuntu.com/security/CVE-2024-56615
  • bpf: fix OOB devmap writes when deleting elements
• CVE-url: https://ubuntu.com/security/CVE-2024-57887
  • drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
• CVE-url: https://ubuntu.com/security/CVE-2024-50154
  • tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
• CVE-url: https://ubuntu.com/security/CVE-2024-56775
  • drm/amd/display: Fix handling of plane refcount
• CVE-url: https://ubuntu.com/security/CVE-2024-57900
  • ila: serialize calls to nf_register_net_hooks()
• CVE-url: https://ubuntu.com/security/CVE-2024-35887
  • ax25: fix use-after-free bugs caused by ax25_ds_del_timer
• CVE-url: https://ubuntu.com/security/CVE-2022-48739
  • ASoC: hdmi-codec: Fix OOB memory accesses
• CVE-url: https://ubuntu.com/security/CVE-2024-56704
  • 9p/xen: fix release of IRQ
• CVE-url: https://ubuntu.com/security/CVE-2024-56606
  • af_packet: avoid erroring out after sock_init_data() in packet_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-53141
  • netfilter: ipset: add missing range check in bitmap_ip_uadt
• CVE-url: https://ubuntu.com/security/CVE-2023-52691
  • drm/amd/pm: fix a double-free in si_dpm_init
• CVE-url: https://ubuntu.com/security/CVE-2024-53165
  • sh: intc: Fix use-after-free bug in register_intc_controller()
• CVE-url: https://ubuntu.com/security/CVE-2023-52818
  • drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
• CVE-url: https://ubuntu.com/security/CVE-2024-56603
  • net: af_can: do not leave a dangling sk pointer in can_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-53173
  • NFSv4.0: Fix a use-after-free problem in the asynchronous open()
• CVE-url: https://ubuntu.com/security/CVE-2024-56602
  • net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-26996 …

• CVE-url: https://ubuntu.com/security/CVE-2024-26595
  • mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
• CVE-url: https://ubuntu.com/security/CVE-2024-38553/CVE-2024-38597
  • netpoll: make ndo_poll_controller() optional
  • bonding: use netpoll_poll_dev() helper
  • netpoll: do not test NAPI_STATE_SCHED in poll_one_napi()
• CVE-url: https://ubuntu.com/security/CVE-2024-38597
  • eth: sungem: remove .ndo_poll_controller to avoid deadlocks
• CVE-url: https://ubuntu.com/security/CVE-2024-38553
  • net: fec: remove .ndo_poll_controller to avoid deadlocks
• CVE-url: https://ubuntu.com/security/CVE-2024-42252
  • closures: Change BUG_ON() to WARN_ON()
• CVE-url: https://ubuntu.com/security/CVE-2024-41066
  • ibmvnic: Add tx check to prevent skb leak
• CVE-url: https://ubuntu.com/security/CVE-2024-40982
  • ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
• CVE-url: https://ubuntu.com/security/CVE-2024-26689
  • ceph: prevent use-after-free in encode_cap_msg()
  • fixup! ceph: prevent use-after-free in encode_cap_msg()
• CVE-url: https://ubuntu.com/security/CVE-2024-56595
  • jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
• CVE-url: https://ubuntu.com/security/CVE-2024-57892
  • ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
• CVE-url: https://ubuntu.com/security/CVE-2024-57896
  • btrfs: fix hang during unmount when stopping a space reclaim worker
  • btrfs: wait for fixup workers before stopping cleaner kthread during umount
  • btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
• CVE-url: https://ubuntu.com/security/CVE-2024-56598
  • jfs: array-index-out-of-bounds fix in dtReadFirst
• CVE-url: https://ubuntu.com/security/CVE-2024-56551
  • drm/amdgpu: fix usage slab after free
• CVE-url: https://ubuntu.com/security/CVE-2024-56596
  • jfs: fix array-index-out-of-bounds in jfs_readdir
• CVE-url: https://ubuntu.com/security/CVE-2024-56615
  • bpf: fix OOB devmap writes when deleting elements
• CVE-url: https://ubuntu.com/security/CVE-2024-57887
  • drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
• CVE-url: https://ubuntu.com/security/CVE-2024-50154
  • tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
• CVE-url: https://ubuntu.com/security/CVE-2024-56775
  • drm/amd/display: Fix handling of plane refcount
• CVE-url: https://ubuntu.com/security/CVE-2024-57900
  • ila: serialize calls to nf_register_net_hooks()
• CVE-url: https://ubuntu.com/security/CVE-2024-35887
  • ax25: fix use-after-free bugs caused by ax25_ds_del_timer
• CVE-url: https://ubuntu.com/security/CVE-2022-48739
  • ASoC: hdmi-codec: Fix OOB memory accesses
• CVE-url: https://ubuntu.com/security/CVE-2024-56704
  • 9p/xen: fix release of IRQ
• CVE-url: https://ubuntu.com/security/CVE-2024-56606
  • af_packet: avoid erroring out after sock_init_data() in packet_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-53141
  • netfilter: ipset: add missing range check in bitmap_ip_uadt
• CVE-url: https://ubuntu.com/security/CVE-2023-52691
  • drm/amd/pm: fix a double-free in si_dpm_init
• CVE-url: https://ubuntu.com/security/CVE-2024-53165
  • sh: intc: Fix use-after-free bug in register_intc_controller()
• CVE-url: https://ubuntu.com/security/CVE-2023-52818
  • drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
• CVE-url: https://ubuntu.com/security/CVE-2024-56603
  • net: af_can: do not leave a dangling sk pointer in can_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-53173
  • NFSv4.0: Fix a use-after-free problem in the asynchronous open()
• CVE-url: https://ubuntu.com/security/CVE-2024-56602
  • net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-26996 …

• CVE-url: https://ubuntu.com/security/CVE-2024-38553/CVE-2024-38597
  • netpoll: make ndo_poll_controller() optional
  • bonding: use netpoll_poll_dev() helper
  • netpoll: do not test NAPI_STATE_SCHED in poll_one_napi()
• CVE-url: https://ubuntu.com/security/CVE-2024-38597
  • eth: sungem: remove .ndo_poll_controller to avoid deadlocks
• CVE-url: https://ubuntu.com/security/CVE-2024-38553
  • net: fec: remove .ndo_poll_controller to avoid deadlocks
• CVE-url: https://ubuntu.com/security/CVE-2024-41066
  • ibmvnic: Add tx check to prevent skb leak
• CVE-url: https://ubuntu.com/security/CVE-2024-40982
  • ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
• CVE-url: https://ubuntu.com/security/CVE-2024-50154
  • tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
• CVE-url: https://ubuntu.com/security/CVE-2024-56595
  • jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
• CVE-url: https://ubuntu.com/security/CVE-2024-57896
  • btrfs: fix hang during unmount when stopping a space reclaim worker
  • btrfs: wait for fixup workers before stopping cleaner kthread during umount
  • btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
• CVE-url: https://ubuntu.com/security/CVE-2024-56598
  • jfs: array-index-out-of-bounds fix in dtReadFirst
• CVE-url: https://ubuntu.com/security/CVE-2024-56596
  • jfs: fix array-index-out-of-bounds in jfs_readdir
• Bionic update: upstream stable patchset 2022-01-25 (LP: #1959033) // CVE- url: https://ubuntu.com/security/CVE-2021-47485
  • IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
• CVE-url: https://ubuntu.com/security/CVE-2024-56602
  • net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-56601
  • net: inet: do not leave a dangling sk pointer in inet_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-56600
  • sock: struct proto hash function may error
  • net: inet6: do not leave a dangling sk pointer in inet6_create()
• CVE-url: https://ubuntu.com/security/CVE-2023-52818
  • drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
• CVE-url: https://ubuntu.com/security/CVE-2024-35887
  • ax25: fix use-after-free bugs caused by ax25_ds_del_timer
• Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE- url: https://ubuntu.com/security/CVE-2021-47404
  • HID: betop: fix slab-out-of-bounds Write in betop_probe
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47254
  • gfs2: Fix use-after-free in gfs2_glock_shrink_scan
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47506
  • nfsd: fix use-after-free due to delegation race
• CVE-url: https://ubuntu.com/security/CVE-2024-56606
  • af_packet: avoid erroring out after sock_init_data() in packet_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-53141
  • netfilter: ipset: add missing range check in bitmap_ip_uadt
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47280
  • drm: Fix use-after-free read in drm_getunique()
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47235
  • net: ethernet: fix potential use-after-free in ec_bhf_remove
• Bionic update: upstream stable patchset 2021-08-13 (LP: #1939913) // CVE- url: https://ubuntu.com/security/CVE-2021-47309
  • net: validate lwtstate->data before returning from skb_tunnel_info()
• Bionic update: upstream stable patchset 2022-01-06 (LP: #1956614) // CVE- url: https://ubuntu.com/security/CVE-2021-47549
  • sata_fsl: fix UAF in…

• CVE-url: https://ubuntu.com/security/CVE-2024-38553/CVE-2024-38597
  • netpoll: make ndo_poll_controller() optional
  • bonding: use netpoll_poll_dev() helper
  • netpoll: do not test NAPI_STATE_SCHED in poll_one_napi()
• CVE-url: https://ubuntu.com/security/CVE-2024-38597
  • eth: sungem: remove .ndo_poll_controller to avoid deadlocks
• CVE-url: https://ubuntu.com/security/CVE-2024-38553
  • net: fec: remove .ndo_poll_controller to avoid deadlocks
• CVE-url: https://ubuntu.com/security/CVE-2024-41066
  • ibmvnic: Add tx check to prevent skb leak
• CVE-url: https://ubuntu.com/security/CVE-2024-40982
  • ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
• CVE-url: https://ubuntu.com/security/CVE-2024-50154
  • tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
• CVE-url: https://ubuntu.com/security/CVE-2024-56595
  • jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
• CVE-url: https://ubuntu.com/security/CVE-2024-57896
  • btrfs: fix hang during unmount when stopping a space reclaim worker
  • btrfs: wait for fixup workers before stopping cleaner kthread during umount
  • btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
• CVE-url: https://ubuntu.com/security/CVE-2024-56598
  • jfs: array-index-out-of-bounds fix in dtReadFirst
• CVE-url: https://ubuntu.com/security/CVE-2024-56596
  • jfs: fix array-index-out-of-bounds in jfs_readdir
• Bionic update: upstream stable patchset 2022-01-25 (LP: #1959033) // CVE- url: https://ubuntu.com/security/CVE-2021-47485
  • IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
• CVE-url: https://ubuntu.com/security/CVE-2024-56602
  • net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-56601
  • net: inet: do not leave a dangling sk pointer in inet_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-56600
  • sock: struct proto hash function may error
  • net: inet6: do not leave a dangling sk pointer in inet6_create()
• CVE-url: https://ubuntu.com/security/CVE-2023-52818
  • drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
• CVE-url: https://ubuntu.com/security/CVE-2024-35887
  • ax25: fix use-after-free bugs caused by ax25_ds_del_timer
• Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE- url: https://ubuntu.com/security/CVE-2021-47404
  • HID: betop: fix slab-out-of-bounds Write in betop_probe
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47254
  • gfs2: Fix use-after-free in gfs2_glock_shrink_scan
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47506
  • nfsd: fix use-after-free due to delegation race
• CVE-url: https://ubuntu.com/security/CVE-2024-56606
  • af_packet: avoid erroring out after sock_init_data() in packet_create()
• CVE-url: https://ubuntu.com/security/CVE-2024-53141
  • netfilter: ipset: add missing range check in bitmap_ip_uadt
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47280
  • drm: Fix use-after-free read in drm_getunique()
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47235
  • net: ethernet: fix potential use-after-free in ec_bhf_remove
• Bionic update: upstream stable patchset 2021-08-13 (LP: #1939913) // CVE- url: https://ubuntu.com/security/CVE-2021-47309
  • net: validate lwtstate->data before returning from skb_tunnel_info()
• Bionic update: upstream stable patchset 2022-01-06 (LP: #1956614) // CVE- url: https://ubuntu.com/security/CVE-2021-47549
  • sata_fsl: fix UAF in…

• net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
• smb: client: fix potential deadlock when releasing mids {CVE-2023-52757}
• tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). {CVE-2024-50154}
• ALSA: 6fire: Release resources at card release {CVE-2024-53239}
• smb: client: fix use-after-free of signing key {CVE-2024-53179}
• tun: avoid double free in tun_free_netdev {CVE-2022-4744}
• Revert "tun: call dev_get_valid_name() before register_netdevice()" {CVE-2022-4744}
• USB: serial: io_edgeport: fix use after free in debug printk {CVE-2024-50267}
• igb: Fix use-after-free error during reset {CVE-2021-47301}
• HID: core: zero-initialize the report buffer {CVE-2024-50302}
• usb: musb: sunxi: Fix accessing an released usb phy {CVE-2024-50269}
• dm cache: fix potential out-of-bounds access on the first resume {CVE-2024-50278}
• dm cache: fix out-of-bounds access to the dirty bitset when resizing {CVE-2024-50278}
• wifi: iwlegacy: Clear stale interrupts before resuming device {CVE-2024-50234}
• security/keys: fix slab-out-of-bounds in key_task_permission {CVE-2024-50301}
• udf: fix uninit-value use in udf_get_fileshortad {CVE-2024-50143}
• overflow: Allow mixed type arguments {CVE-2024-50143}
• compiler.h: drop fallback overflow checkers {CVE-2024-50143}
• overflow: Add _must_check attribute to check*() helpers {CVE-2024-50143}
• media: s5p-jpeg: prevent buffer overflows {CVE-2024-53061}
• mptcp: fix double-free on socket dismantle {CVE-2024-26782}
• drm/amdgpu: fix usage slab after free {CVE-2024-56551}
• bpf: fix OOB devmap writes when deleting elements {CVE-2024-56615}
• uprobe: avoid out-of-bounds memory access of fetching args {CVE-2024-50067}

• net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
• smb: client: fix potential deadlock when releasing mids {CVE-2023-52757}
• tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). {CVE-2024-50154}
• ALSA: 6fire: Release resources at card release {CVE-2024-53239}
• smb: client: fix use-after-free of signing key {CVE-2024-53179}
• inet_connection_sock: remove unused parameter of reqsk_queue_unlink func {CVE-2024-50154}
• tun: avoid double free in tun_free_netdev {CVE-2022-4744}
• USB: serial: io_edgeport: fix use after free in debug printk {CVE-2024-50267}
• igb: Fix use-after-free error during reset {CVE-2021-47301}
• HID: core: zero-initialize the report buffer {CVE-2024-50302}
• usb: musb: sunxi: Fix accessing an released usb phy {CVE-2024-50269}
• dm cache: fix potential out-of-bounds access on the first resume {CVE-2024-50278}
• dm cache: fix out-of-bounds access to the dirty bitset when resizing {CVE-2024-50278}
• wifi: iwlegacy: Clear stale interrupts before resuming device {CVE-2024-50234}
• security/keys: fix slab-out-of-bounds in key_task_permission {CVE-2024-50301}
• udf: fix uninit-value use in udf_get_fileshortad {CVE-2024-50143}
• overflow: Allow mixed type arguments {CVE-2024-50143}
• compiler.h: drop fallback overflow checkers {CVE-2024-50143}
• overflow: Add _must_check attribute to check*() helpers {CVE-2024-50143}
• media: s5p-jpeg: prevent buffer overflows {CVE-2024-53061}
• mptcp: fix double-free on socket dismantle {CVE-2024-26782}
• drm/amdgpu: fix usage slab after free {CVE-2024-56551}
• bpf: fix OOB devmap writes when deleting elements {CVE-2024-56615}
• uprobe: avoid out-of-bounds memory access of fetching args {CVE-2024-50067}

• media: uvcvideo: Fix double free in error path {CVE-2024-57980}
• vrf: use RCU protection in l3mdev_l3_out() {CVE-2025-21791}
• geneve: Fix use-after-free in geneve_find_dev(). {CVE-2025-21858}
• ibmvnic: Don't reference skb after sending to VIOS {CVE-2025-21855}
• pfifo_tail_enqueue: Drop new packet when sch->limit == 0 {CVE-2025-21702}
• iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() {CVE-2025-21993}
• vlan: enforce underlying device type {CVE-2025-21920}
• HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
• can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices {CVE-2024-53197}
• net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg {CVE-2023-31436}
• tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). {CVE-2024-50154}
• net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
• smb: client: fix use-after-free of signing key {CVE-2024-53179}
• gso: do not skip outer ip header in case of ipip and net_failover {CVE-2022-48936}

• rds: tcp: block BH in TCP callbacks
• kexec: Improve & fix crash_exclude_mem_range() to handle overlapping ranges
• module: correctly exit module_kallsyms_on_each_symbol when fn() != 0
• module: potential uninitialized return in module_kallsyms_on_each_symbol()
• module: use RCU to synchronize find_module
• kallsyms: refactor {,module_}kallsyms_on_each_symbol
• LTS tag: v5.4.295
• scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
• arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() {CVE-2025-38320}
• perf: Fix sample vs do_exit() {CVE-2025-38424}
• s390/pci: Fix __pcilg_mio_inuser() inline assembly
• rtc: test: Fix invalid format specifier.
• jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() {CVE-2025-38337}
• mm/huge_memory: fix dereferencing invalid pmd migration entry {CVE-2025-37958}
• rtc: Make rtc_time64_to_tm() support dates before 1970
• rtc: Improve performance of rtc_time64_to_tm(). Add tests.
• xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create {CVE-2022-48773}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
• ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
• ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• net: atm: add lec_mutex {CVE-2025-38323}
• calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). {CVE-2025-38181}
• tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer {CVE-2025-38184}
• tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
• atm: atmtcp: Free invalid length skb in atmtcp_c_send(). {CVE-2025-38185}
• mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). {CVE-2025-38324}
• wifi: carl9170: do not ping device which has failed to load firmware {CVE-2025-38420}
• aoe: clean device rq_list in aoedev_downdev() {CVE-2025-38326}
• hwmon: (occ) fix unaligned accesses
• drm/nouveau/bl: increase buffer size to avoid truncate warning
• erofs: remove unused trace event erofs_destroy_inode
• ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
• ALSA: hda/intel: Add Thinkpad E15 to PM deny list
• Input: sparcspkr - avoid unannotated fall-through
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• atm: Revert atm_account_tx() if copy_from_iter_full() fails. {CVE-2025-38190}
• selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
• scsi: s390: zfcp: Ensure synchronous unit_add
• scsi: storvsc: Increase the timeouts to storvsc_timeout
• jffs2: check jffs2_prealloc_raw_node_refs() result in few other places {CVE-2025-38328}
• jffs2: check that raw node were preallocated before writing summary {CVE-2025-38194}
• drivers/rapidio/rio_cm.c: prevent possible heap overwrite {CVE-2025-38090}
• powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
• platform/x86: dell_rbu: Stop overwriting data buffer
• platform: Add Surface platform directory
• Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
• tee: Prevent size calculation wraparound on 32-bit kernels
• ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
• bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
• watchdog: da9052_wdt: respect TWDMIN
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
• sock: Correct error checking condition for (assign|release)_proto_idx()
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• vxlan: Do not treat dst cache initialization errors as fatal
• clk: rockchip: rk3036: mark ddrphy as critical
• wifi: mac80211: do not offer a mesh path if forwarding is disabled
• net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
• pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
• pinctrl: armada-37xx:…

Vanilla upstream kernel version 6.6.61 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

Upstream kernel version 6.6.61 fixes bugs and vulnerabilities. The bluez, kmod-virtualbox and kmod-xtables-addons packages have been updated to work with this new kernel. For information about the vulnerabilities see the links.

These are all security issues fixed in the kernel-devel-6.11.8-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.12.11-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070)
• CVE-2024-50205: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (bsc#1233293).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233453).
• CVE-2024-50267: USB: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).
• CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).
• CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).

The following non-security bugs were fixed:

• Update config files (bsc#1218644).
• e1000e: Correct NVM checksum verification flow (jsc#SLE-8100).
• e1000e: Correct NVM checksum verification flow (jsc#SLE-8100).
• e1000e: Do not take care about recovery NVM checksum (jsc#SLE-8100).
• e1000e: Do not take care about recovery NVM checksum (jsc#SLE-8100).
• ena: Remove rcu_read_lock() around XDP program invocation (bsc#1198778).
• ethernet: amazon: ena: A typo fix in the file ena_com.h (bsc#1198778).
• initramfs: avoid filename buffer overrun (bsc#1232436).
• kernel-binary: Enable livepatch package only when livepatch is enabled Otherwise the filelist may be empty failing the build (bsc#1218644).
• net: ena: Add capabilities field with support for ENI stats capability (bsc#1198778).
• net: ena: Add debug prints for invalid req_id resets (bsc#1198778).
• net: ena: Change ENI stats support check to use capabilities field (bsc#1198778).
• net: ena: Change return value of ena_calc_io_queue_size() to void (bsc#1198778).
• net: ena: Change the name of bad_csum variable (bsc#1198778).
• net: ena: Extract recurring driver reset code into a function (bsc#1198778).
• net: ena: Flush XDP packets on error (bsc#1198778).
• net: ena: Improve error logging in driver (bsc#1198778).
• net: ena: Move reset completion print to the reset function (bsc#1198778).
• net: ena: Remove ena_calc_queue_size_ctx struct (bsc#1198778).
• net: ena: Remove module param and change message severity (bsc#1198778).
• net: ena: Remove redundant return code check (bsc#1198778).
• net: ena: Remove unused code (bsc#1198778).
• net: ena: Set tx_info->xdpf value to NULL (bsc#1198778).
• net: ena: Update XDP verdict upon failure (bsc#1198778).
• net: ena: Use bitmask to indicate packet redirection (bsc#1198778).
• net: ena: Use dev_alloc() in RX buffer allocation (bsc#1198778).
• net: ena: add device distinct log prefix to files (bsc#1198778).
• net: ena: add jiffies of last napi call to stats (bsc#1198778).
• net: ena: aggregate doorbell common operations into a function (bsc#1198778).
• net: ena: aggregate stats increase into a function (bsc#1198778).
• net: ena: fix DMA mapping function issues in XDP (bsc#1198778).
• net: ena: fix coding style nits (bsc#1198778).
• net: ena: fix inaccurate print type (bsc#1198778).
• net: ena: introduce XDP redirect…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-47703: bpf, lsm: add check for BPF LSM return value (bsc#1231946).
• CVE-2024-49852: scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del() (bsc#1232819).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49881: ext4: update orig_path in ext4_find_extent() (bsc#1232201).
• CVE-2024-49883: ext4: aovid use-after-free in ext4_ext_insert_extent() (bsc#1232199).
• CVE-2024-49894: drm/amd/display: Fix index out of bounds in degamma hardware format translation (bsc#1232354).
• CVE-2024-49895: drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation (bsc#1232352).
• CVE-2024-49897: drm/amd/display: Check phantom_stream before it is used (bsc#1232355).
• CVE-2024-49899: drm/amd/display: Initialize denominators' default to 1 (bsc#1232358).
• CVE-2024-49901: drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs (bsc#1232305).
• CVE-2024-49909: drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func (bsc#1232337).
• CVE-2024-49911: drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func (bsc#1232366).
• CVE-2024-49912: drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream' (bsc#1232367).
• CVE-2024-49913: drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream (bsc#1232307).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49922:…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
• CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
• CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-47745: mm: call the security_mmap_file() LSM hook in remap_file_pages() (bsc#1232135).
• CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49934: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (bsc#1232387).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
• CVE-2024-49968: ext4: filesystems without casefold feature cannot be mounted with siphash (bsc#1232264).
• CVE-2024-49983: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (bsc#1232096).
• CVE-2024-49989: drm/amd/display: fix double free issue during amdgpu module unload (bsc#1232483).
• CVE-2024-50009: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (bsc#1232318).
• CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
• CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50093: thermal: intel: int340x: processor: Fix warning during module unload (bsc#1232877).
• CVE-2024-50098: scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down (bsc#1232881).
• CVE-2024-50108: drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too (bsc#1232884).
• CVE-2024-50110: xfrm: fix one more kernel-infoleak in algo dumping (bsc#1232885).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-47703: bpf, lsm: add check for BPF LSM return value (bsc#1231946).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49888: bpf: Fix a sdiv overflow issue (bsc#1232208).
• CVE-2024-49899: drm/amd/display: Initialize denominators' default to 1 (bsc#1232358).
• CVE-2024-49911: drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func (bsc#1232366).
• CVE-2024-49912: drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream' (bsc#1232367).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49922: drm/amd/display: Check null pointers before using them (bsc#1232374).
• CVE-2024-49923: drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags (bsc#1232361).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49933: blk_iocost: fix more out of bound shifts (bsc#1232368).
• CVE-2024-49934: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (bsc#1232387).
• CVE-2024-49944: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start (bsc#1232166).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
• CVE-2024-49968: ext4: filesystems without casefold feature cannot be mounted with siphash (bsc#1232264).
• CVE-2024-49983:…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52524: net: nfc: llcp: Add lock when modifying device list (bsc#1220927).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50205: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (bsc#1233293).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233453).
• CVE-2024-50267: usb: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).
• CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).
• CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).

The following non-security bugs were fixed:

• e1000e: Correct NVM checksum verification flow (jsc#SLE-8100).
• e1000e: Do not take care about recovery NVM checksum (jsc#SLE-8100).
• ena: Remove rcu_read_lock() around XDP program invocation (bsc#1198778).
• ethernet: amazon: ena: A typo fix in the file ena_com.h (bsc#1198778).
• initramfs: avoid filename buffer overrun (bsc#1232436).
• kernel-binary: Enable livepatch package only when livepatch is enabled (bsc#1218644).
• net: ena: Add capabilities field with support for ENI stats capability (bsc#1198778).
• net: ena: Add debug prints for invalid req_id resets (bsc#1198778).
• net: ena: Change ENI stats support check to use capabilities field (bsc#1198778).
• net: ena: Change return value of ena_calc_io_queue_size() to void (bsc#1198778).
• net: ena: Change the name of bad_csum variable (bsc#1198778).
• net: ena: Extract recurring driver reset code into a function (bsc#1198778).
• net: ena: Flush XDP packets on error (bsc#1198778).
• net: ena: Improve error logging in driver (bsc#1198778).
• net: ena: Move reset completion print to the reset function (bsc#1198778).
• net: ena: Remove ena_calc_queue_size_ctx struct (bsc#1198778).
• net: ena: Remove module param and change message severity (bsc#1198778).
• net: ena: Remove redundant return code check (bsc#1198778).
• net: ena: Remove unused code (bsc#1198778).
• net: ena: Set tx_info->xdpf value to NULL (bsc#1198778).
• net: ena: Update XDP verdict upon failure (bsc#1198778).
• net: ena: Use bitmask to indicate packet redirection (bsc#1198778).
• net: ena: Use dev_alloc() in RX buffer allocation (bsc#1198778).
• net: ena: add device distinct log prefix to files (bsc#1198778).
• net: ena: add jiffies of last napi call to stats (bsc#1198778).
• net: ena: aggregate doorbell common operations into a function (bsc#1198778).
• net: ena: aggregate stats increase into a function (bsc#1198778).
• net: ena: fix DMA mapping function issues in XDP (bsc#1198778).
• net: ena: fix coding style nits (bsc#1198778).
• net: ena: fix inaccurate print type (bsc#1198778).
• net: ena: introduce XDP redirect implementation (bsc#1198778).
• net: ena: introduce ndo_xdp_xmit() function for XDP_REDIRECT (bsc#1198778).
• net: ena: make symbol 'ena_alloc_map_page' static (bsc#1198778).
• net: ena: re-organize code to improve…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-53095: smb: client: Fix use-after-free of network namespace (bsc#1233642).
• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2023-6270: aoe: fix the potential use-after-free problem in more places (bsc#1218562).
• CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46828: sched: sch_cake: fix bulk flow accounting logic for host fairness (bsc#1231114).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50205: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (bsc#1233293).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
• CVE-2024-50259: netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() (bsc#1233214).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233453).
• CVE-2024-50267: usb: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).
• CVE-2024-50274: idpf: avoid vport access in idpf_get_link_ksettings (bsc#1233463).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).
• CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).
• CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).
• CVE-2024-53068: firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() (bsc#1233561).

The following non-security bugs were fixed:

• Update config files (bsc#1218644).
• Update config files. Enabled IDPF for ARM64 (bsc#1221309)
• initramfs: avoid filename buffer overrun (bsc#1232436).
• kernel-binary: Enable livepatch package only when livepatch is enabled Otherwise the filelist may be empty failing the build (bsc#1218644).
• mm/memory: add non-anonymous page check in the copy_present_page() (bsc#1231646).
• rpm/scripts: Remove obsolete Symbols.list Symbols.list is not longer needed by the new klp-convert implementation. (bsc#1218644)
• x86/kexec: Add EFI config table identity mapping for kexec kernel (bsc#1220382).
• x86/mm/ident_map: Use gbpages only where full GB page should be mapped (bsc#1220382).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
• CVE-2024-50154: tcp: Fix use-after-free of nreq in reqsk_timer_handler() (bsc#1233070).
• CVE-2024-50205: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (bsc#1233293).
• CVE-2024-50259: netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() (bsc#1233214).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233453).
• CVE-2024-50267: USB: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).
• CVE-2024-50274: idpf: avoid vport access in idpf_get_link_ksettings (bsc#1233463).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).
• CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).
• CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).
• CVE-2024-53068: firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() (bsc#1233561).

The following non-security bugs were fixed:

• Update config files (bsc#1218644).
• Update config files. Enabled IDPF for ARM64 (bsc#1221309)
• kernel-binary: Enable livepatch package only when livepatch is enabled Otherwise the filelist may be empty failing the build (bsc#1218644).
• mm/memory: add non-anonymous page check in the copy_present_page() (bsc#1231646).
• rpm/scripts: Remove obsolete Symbols.list Symbols.list is not longer needed by the new klp-convert implementation. (bsc#1218644)

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
• CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48957: dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() (bsc#1231973).
• CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
• CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
• CVE-2022-48980: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() (bsc#1232233).
• CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
• CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2022-49017: tipc: re-fetch skb cb after tipc_msg_validate (bsc#1232004).
• CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
• CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB (bsc#1228709).
• CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005).
• CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837).
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46716: dmaengine: altera-msgdma:…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48853: swiotlb: fix info leak with DMA_FROM_DEVICE (bsc#1228015).
• CVE-2024-26801: Bluetooth: Avoid potential use-after-free in hci_error_reset (bsc#1222413).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2024-26886: Bluetooth: af_bluetooth: Fix deadlock (bsc#1223044).
• CVE-2024-27051: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value (bsc#1223769).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-46771: can: bcm: Remove proc entry when dev is unregistered (bsc#1230766).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47660: fsnotify: clear PARENT_WATCHED flags lazily (bsc#1231439).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-49858: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption (bsc#1232251).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49938: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit (bsc#1232552).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
• CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
• CVE-2024-50044: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (bsc#1231904).
• CVE-2024-50055: driver core: bus: Fix double free in driver API bus_register() (bsc#1232329).
• CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
• CVE-2024-50074: parport: Proper fix for array out-of-bounds access (bsc#1232507).
• CVE-2024-50095: RDMA/mad: Improve handling of timed out WRs of mad agent (bsc#1232873).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50117: drm/amd: Guard against bad data for ATIF ACPI method (bsc#1232897).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50135: nvme-pci: fix race condition between reset and nvme_dev_disable() (bsc#1232888).
• CVE-2024-50148: Bluetooth: bnep: fix wild-memory-access in proto_unregister (bsc#1233063).
• CVE-2024-50150: usb: typec: altmode should keep reference to parent (bsc#1233051).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50167: be2net: fix potential memory leak in be_xmit() (bsc#1233049).
• CVE-2024-50171: net: systemport: fix potential memory leak in bcm_sysport_xmit() (bsc#1233057).
• CVE-2024-50183: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (bsc#1233130).
• CVE-2024-50187: drm/vc4: Stop the active perfmon before being destroyed (bsc#1233108).
• CVE-2024-50195: posix-clock: Fix missing timespec64 check in pc_clock_settime() (bsc#1233103).
• CVE-2024-50218: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
• CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
• CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: explicitly exit when ext4_find_inline_entry returns an error (bsc#1231920).
• CVE-2024-47745: mm: split critical region in remap_file_pages() and invoke LSMs in between (bsc#1232135).
• CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49934: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (bsc#1232387).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
• CVE-2024-49968: ext4: fix error message when rejecting the default hash (bsc#1232264).
• CVE-2024-49983: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (bsc#1232096).
• CVE-2024-49989: drm/amd/display: fix double free issue during amdgpu module unload (bsc#1232483).
• CVE-2024-50009: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (bsc#1232318).
• CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
• CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50093: thermal: intel: int340x: processor: Fix warning during module unload (bsc#1232877).
• CVE-2024-50098: scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down (bsc#1232881).
• CVE-2024-50108: drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too (bsc#1232884).
• CVE-2024-50110: xfrm: fix one more kernel-infoleak in algo dumping (bsc#1232885).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix…

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
• CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking (bsc#1232823).
• CVE-2023-6270: aoe: fix the potential use-after-free problem in more places (bsc#1218562).
• CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished() (bsc#1222587).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-41031: mm/filemap: skip to create PMD-sized page cache if needed (bsc#1228454).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (bsc#1233132).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46766: ice: move netif_queue_set_napi to rtnl-protected sections (bsc#1230762).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46828: sched: sch_cake: fix bulk flow accounting logic for host fairness (bsc#1231114).
• CVE-2024-46831: net: microchip: vcap: Fix use-after-free error in kunit test (bsc#1231117).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs: do not BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() (bsc#1231094).
• CVE-2024-46843: scsi: ufs: core: Remove SCSI host only if added…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50205: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (bsc#1233293).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233453).
• CVE-2024-50267: usb: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).
• CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).
• CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).

The following non-security bugs were fixed:

• Update config files (bsc#1218644).
• initramfs: avoid filename buffer overrun (bsc#1232436).
• kernel-binary: Enable livepatch package only when livepatch is enabled Otherwise the filelist may be empty failing the build (bsc#1218644).
• rpm/scripts: Remove obsolete Symbols.list Symbols.list is not longer needed by the new klp-convert implementation. (bsc#1218644)

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48853: swiotlb: fix info leak with DMA_FROM_DEVICE (bsc#1228015).
• CVE-2024-26801: Bluetooth: Avoid potential use-after-free in hci_error_reset (bsc#1222413).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2024-26886: Bluetooth: af_bluetooth: Fix deadlock (bsc#1223044).
• CVE-2024-27051: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value (bsc#1223769).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-46771: can: bcm: Remove proc entry when dev is unregistered (bsc#1230766).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
• CVE-2024-47660: fsnotify: clear PARENT_WATCHED flags lazily (bsc#1231439).
• CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
• CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
• CVE-2024-49858: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption (bsc#1232251).
• CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).
• CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49938: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit (bsc#1232552).
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).
• CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
• CVE-2024-50044: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (bsc#1231904).
• CVE-2024-50055: driver core: bus: Fix double free in driver API bus_register() (bsc#1232329).
• CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).
• CVE-2024-50074: parport: Proper fix for array out-of-bounds access (bsc#1232507).
• CVE-2024-50095: RDMA/mad: Improve handling of timed out WRs of mad agent (bsc#1232873).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50117: drm/amd: Guard against bad data for ATIF ACPI method (bsc#1232897).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50135: nvme-pci: fix race condition between reset and nvme_dev_disable() (bsc#1232888).
• CVE-2024-50148: Bluetooth: bnep: fix wild-memory-access in proto_unregister (bsc#1233063).
• CVE-2024-50150: usb: typec: altmode should keep reference to parent (bsc#1233051).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50167: be2net: fix potential memory leak in be_xmit() (bsc#1233049).
• CVE-2024-50171: net: systemport: fix potential memory leak in bcm_sysport_xmit() (bsc#1233057).
• CVE-2024-50183: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (bsc#1233130).
• CVE-2024-50187: drm/vc4: Stop the active perfmon before being destroyed (bsc#1233108).
• CVE-2024-50195: posix-clock: Fix missing timespec64 check in pc_clock_settime() (bsc#1233103).
• CVE-2024-50218: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).
• CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).
• CVE-2024-36915: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies (bsc#1225758).
• CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
• CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).
• CVE-2024-44996: vsock: fix recursive ->recvmsg calls (bsc#1230205).
• CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).
• CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).
• CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).
• CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).
• CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).
• CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).
• CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467).
• CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).
• CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558).
• CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).
• CVE-2024-53099: bpf: Check validity of link->type in bpf_link_show_fdinfo() (bsc#1233772).
• CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).
• CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).
• CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).
• CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).
• CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).
• CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).
• CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).
• CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).
• CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)
• CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).
• CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
• CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).
• CVE-2024-53161: EDAC/bluefield: Fix potential integer overflow (bsc#1234856).
• CVE-2024-53179: smb: client: fix use-after-free of signing key (bsc#1234921).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235004).
• CVE-2024-53216: nfsd: fix UAF when access ex_uuid or ex_stats (bsc#1235003).
• CVE-2024-53222: zram: fix NULL pointer in comp_algorithm_show() (bsc#1234974).
• CVE-2024-53234: erofs: handle NONHEAD !delta[1] lclusters gracefully (bsc#1235045).
• CVE-2024-53240: xen/netfront: fix crash when removing device (bsc#1234281).
• CVE-2024-53241: x86/xen: use new hypercall functions instead of hypercall page (bsc#1234282).
• CVE-2024-56549: cachefiles: Fix NULL pointer dereference in object->file (bsc#1234912).
• CVE-2024-56566: mm/slub: Avoid list corruption when removing a slab from the full list (bsc#1235033).
• CVE-2024-56582: btrfs: fix use-after-free in…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
• CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).
• CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).
• CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
• CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).
• CVE-2024-44996: vsock: fix recursive ->recvmsg calls (bsc#1230205).
• CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).
• CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).
• CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).
• CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).
• CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).
• CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).
• CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).
• CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).
• CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).
• CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
• CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).
• CVE-2024-53099: bpf: Check validity of link->type in bpf_link_show_fdinfo() (bsc#1233772).
• CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).
• CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).
• CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).
• CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).
• CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).
• CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).
• CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).
• CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).
• CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)
• CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).
• CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
• CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).
• CVE-2024-53161: EDAC/bluefield: Fix potential integer overflow (bsc#1234856).
• CVE-2024-53179: smb: client: fix use-after-free of signing key (bsc#1234921).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235004).
• CVE-2024-53216: nfsd: fix UAF when access ex_uuid or ex_stats (bsc#1235003).
• CVE-2024-53222: zram: fix NULL pointer in comp_algorithm_show() (bsc#1234974).
• CVE-2024-53234: erofs: handle NONHEAD !delta[1] lclusters gracefully (bsc#1235045).
• CVE-2024-53240: xen/netfront: fix crash when removing device (bsc#1234281).
• CVE-2024-53241: x86/xen: use new hypercall functions instead of hypercall page (XSA-466 bsc#1234282).
• CVE-2024-56549: cachefiles: Fix NULL pointer dereference in object->file (bsc#1234912).
• CVE-2024-56566: mm/slub: Avoid list corruption when removing a slab from the full list (bsc#1235033).
• CVE-2024-56582: btrfs: fix…