CVE-2022-50255

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix reading strings from synthetic events

The follow commands caused a crash:

cd /sys/kernel/tracing

echo 's:open char file[]' > dynamic_events

echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' > events/syscalls/sys_enter_openat/trigger'

echo 1 > events/synthetic/open/enable

BOOM!

The problem is that the synthetic event field "char file[]" will read the value given to it as a string without any memory checks to make sure the address is valid. The above example will pass in the user space address and the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an oops when accessing user space addresses.

Use the helper functions from trace_kprobe and trace_eprobe that can read strings safely (and actually succeed when the address is from user space and the memory is mapped in).

Now the above can show:

 packagekitd-1721    [000] ...2.   104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr
in:imjournal-978     [006] ...2.   104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp
 packagekitd-1721    [000] ...2.   104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr(CVE-2022-50255)

In the Linux kernel, the following vulnerability has been resolved:

kprobes: Fix check for probe enabled in kill_kprobe()

In kill_kprobe(), the check whether disarm_kprobe_ftrace() needs to be called always fails. This is because before that we set the KPROBE_FLAG_GONE flag for kprobe so that "!kprobe_disabled(p)" is always false.

The disarm_kprobe_ftrace() call introduced by commit:

0cb2f1372baa ("kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler")

to fix the NULL pointer reference problem. When the probe is enabled, if we do not disarm it, this problem still exists.

Fix it by putting the probe enabled check before setting the KPROBE_FLAG_GONE flag.(CVE-2022-50266)

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix order >= MAX_ORDER warning due to crafted negative i_size

As syzbot reported [1], the root cause is that i_size field is a signed type, and negative i_size is also less than EROFS_BLKSIZ. As a consequence, it's handled as fast symlink unexpectedly.

Let's fall back to the generic path to deal with such unusual i_size.

[1] https://lore.kernel.org/r/(CVE-2022-50313)

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid deadlock in fs reclaim with page writeback

Ext4 has a filesystem wide lock protecting ext4_writepages() calls to avoid races with switching of journalled data flag or inode format. This lock can however cause a deadlock like:

CPU0 CPU1

ext4_writepages() percpu_down_read(sbi->s_writepages_rwsem); ext4_change_inode_journal_flag() percpu_down_write(sbi->s_writepages_rwsem); - blocks, all readers block from now on ext4_do_writepages() ext4_init_io_end() kmem_cache_zalloc(io_end_cachep, GFP_KERNEL) fs_reclaim frees dentry... dentry_unlink_inode() iput() - last ref => iput_final() - inode dirty => write_inode_now()... ext4_writepages() tries to acquire sbi->s_writepages_rwsem and blocks forever

Make sure we cannot recurse into filesystem reclaim from writeback code to avoid the deadlock.(CVE-2023-53149)

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: prevent soft lockup while flush writes

Currently, there is no limit for raid1/raid10 plugged bio. While flushing writes, raid1 has cond_resched() while raid10 doesn't,…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix reading strings from synthetic events

The follow commands caused a crash:

cd /sys/kernel/tracing

echo 's:open char file[]' > dynamic_events

echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' > events/syscalls/sys_enter_openat/trigger'

echo 1 > events/synthetic/open/enable

BOOM!

The problem is that the synthetic event field "char file[]" will read the value given to it as a string without any memory checks to make sure the address is valid. The above example will pass in the user space address and the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an oops when accessing user space addresses.

Use the helper functions from trace_kprobe and trace_eprobe that can read strings safely (and actually succeed when the address is from user space and the memory is mapped in).

Now the above can show:

 packagekitd-1721    [000] ...2.   104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr
in:imjournal-978     [006] ...2.   104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp
 packagekitd-1721    [000] ...2.   104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr(CVE-2022-50255)

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix order >= MAX_ORDER warning due to crafted negative i_size

As syzbot reported [1], the root cause is that i_size field is a signed type, and negative i_size is also less than EROFS_BLKSIZ. As a consequence, it's handled as fast symlink unexpectedly.

Let's fall back to the generic path to deal with such unusual i_size.

[1] https://lore.kernel.org/r/(CVE-2022-50313)

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid deadlock in fs reclaim with page writeback

Ext4 has a filesystem wide lock protecting ext4_writepages() calls to avoid races with switching of journalled data flag or inode format. This lock can however cause a deadlock like:

CPU0 CPU1

ext4_writepages() percpu_down_read(sbi->s_writepages_rwsem); ext4_change_inode_journal_flag() percpu_down_write(sbi->s_writepages_rwsem); - blocks, all readers block from now on ext4_do_writepages() ext4_init_io_end() kmem_cache_zalloc(io_end_cachep, GFP_KERNEL) fs_reclaim frees dentry... dentry_unlink_inode() iput() - last ref => iput_final() - inode dirty => write_inode_now()... ext4_writepages() tries to acquire sbi->s_writepages_rwsem and blocks forever

Make sure we cannot recurse into filesystem reclaim from writeback code to avoid the deadlock.(CVE-2023-53149)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix memleak due to fentry attach failure

If it fails to attach fentry, the allocated bpf trampoline image will be left in the system. That can be verified by checking /proc/kallsyms.

This meamleak can be verified by a simple bpf program as follows:

SEC("fentry/trap_init") int fentry_run() { return 0; }

It will fail to attach trap_init because this function is freed after kernel init, and then we can find the trampoline image is left in the system by checking /proc/kallsyms.

$ tail /proc/kallsyms ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf] ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf]

$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'" [2522] FUNC 'trap_init' type_id=119 linkage=static

$ echo $((6442453466 & 0x7fffffff)) 2522

Note that there are two left bpf trampoline…

Root has patched CVE-2022-50255 in the linux package for Root:Debian:11. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix reading strings from synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]' > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' > events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is that the synthetic event field "char file[]" will read the value given to it as a string without any memory checks to make sure the address is valid. The above example will pass in the user space address and the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that can read strings safely (and actually succeed when the address is from user space and the memory is mapped in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr

• drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() {CVE-2026-68251}
• amd/amdkfd: sync all devices to wait all processes being evicted {CVE-2024-36949}
• Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted {CVE-2024-36909}
• Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl {CVE-2024-36912}
• xfs: save ailp before dropping the AIL lock in push callbacks {CVE-2026-31454}
• net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak {CVE-2026-43041}
• netfilter: nf_conntrack: destroy stale expectfn expectations on unregister {CVE-2026-53349}
• cifs: avoid NULL pointer dereference in dbg call {CVE-2025-37844}
• fs/notify: call exportfs_encode_fid with s_umount {CVE-2025-40237}
• cifs: fix potential oops in cifs_oplock_break {CVE-2023-54258}
• pstore/ram: fix buffer overflow in persistent_ram_save_old() {CVE-2026-46253}
• Bluetooth: ISO: fix iso_conn related locking and validity issues {CVE-2023-54164}
• netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets {CVE-2026-45873}
• ext4: always drain queued discard work in ext4_mb_release() {CVE-2026-43065}
• ipvs: Defer ip_vs_ftp unregister during netns cleanup {CVE-2025-40018}
• Bluetooth: MGMT: Fix memory leak in set_ssp_complete {CVE-2026-23151}
• sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto {CVE-2025-40281}
• fscache: Use wait_on_bit() to wait for the freeing of relinquished volume {CVE-2023-52982}
• libceph: prevent potential out-of-bounds reads in process_message_header() {CVE-2026-43406}
• netfilter: nf_tables: reject immediate NF_QUEUE verdict {CVE-2026-43024}
• ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() {CVE-2025-68261}
• bpf, sockmap: Fix af_unix iter deadlock {CVE-2026-53035}
• sctp: stream: fully roll back denied add-stream state {CVE-2026-52929}
• netfilter: xt_CT: drop pending enqueued packets on template removal {CVE-2026-23391}
• netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() {CVE-2026-23457}
• libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() {CVE-2026-43407}
• af_unix: read UNIX_DIAG_VFS data under unix_state_lock {CVE-2026-31673}
• jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted {CVE-2025-68337}
• Bluetooth: Fix NULL pointer deference on eir_get_service_data {CVE-2025-38304}
• net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption {CVE-2026-31533}
• fsnotify: do not generate ACCESS/MODIFY events on child for special files {CVE-2025-68788}
• isofs: validate Rock Ridge CE continuation extent against volume size {CVE-2026-46303}
• net: strparser: fix skb_head leak in strp_abort_strp() {CVE-2026-46102}
• sctp: fix uninit-value in __sctp_rcv_asconf_lookup() {CVE-2026-53225}
• xfs: don't swallow dquot recovery verification errors {CVE-2026-80529}
• xfs: dquot recovery does not validate the recovered dquot {CVE-2026-80529}
• bpf: tcp: fix double sock release on batch realloc {CVE-2026-64575}
• bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() {CVE-2026-74714}
• bpf: tcp: Avoid socket skips and repeats during iteration {CVE-2026-74714}
• bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items {CVE-2026-74714}
• bpf: tcp: Get rid of st_bucket_done {CVE-2026-74714}
• bpf: tcp: Make sure iter->batch always contains a full bucket snapshot {CVE-2026-64575}
• bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch {CVE-2026-74714}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• net: Make copy_safe_from_sockptr() match documentation {CVE-2026-74689}
• net: add copy_safe_from_sockptr() helper {CVE-2026-74689}
• xfs: close crash window in attr dabtree…

• dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125}
• mm/damon/core: validate ranges in damon_set_regions() {CVE-2026-68165}
• netpoll: Fix deadlock in memory allocation under spinlock {CVE-2025-68169}
• drm/amdkfd: Check bounds on CRIU restore queue type and mqd size {CVE-2026-68258}
• gve: fix Rx queue stall on alloc failure {CVE-2026-68129}
• drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved {CVE-2026-68234}
• libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE {CVE-2026-68159}
• media: v4l2-ctrls: validate HEVC active reference counts {CVE-2026-68206}
• drm/i915/hdcp: check streams[] bounds before overflow {CVE-2026-68253}
• drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() {CVE-2026-68245}
• drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() {CVE-2026-68115}
• drm/i915: Return NULL on error in active_instance {CVE-2026-68248}
• smb: client: validate DFS referral PathConsumed {CVE-2026-68343}
• ext4: fix use-after-free in update_super_work when racing with umount {CVE-2026-31446}
• debugobjects: Plug race against a concurrent OOM disable {CVE-2026-68090}
• HID: wacom: stop hardware after post-start probe failures {CVE-2026-68091}
• drm/xe/pt: Reset current_op in xe_pt_update_ops_init() {CVE-2026-68264}
• net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD {CVE-2026-68288}
• drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() {CVE-2026-68113}
• openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123}
• drm/amd/display: use kvzalloc to allocate struct dc {CVE-2026-68436}
• drm/i915/gem: Add missing nospec on parallel submit slot {CVE-2026-68269}
• Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update {CVE-2026-68394}
• sctp: avoid auth_enable sysctl UAF during netns teardown {CVE-2026-68162}
• wifi: mt76: mt7925: fix crash in reset link replay {CVE-2026-68307}
• Bluetooth: hci_sync: extend conn_hash lookup critical sections {CVE-2026-68393}
• drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU {CVE-2026-68243}
• block: fix memory leak in __blkdev_issue_zero_pages {CVE-2026-68348}
• drm/amdgpu/gfx: fix cleaner shader IB buffer overflow {CVE-2026-68276}
• tracing: Do not call map->ops->elt_free() if elt_alloc() fails {CVE-2026-64173}
• wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin {CVE-2026-68362}
• ovl: check access to copy_file_range source with src mounter creds {CVE-2026-68448}
• drm/nouveau: fix reversed error cleanup order in ucopy functions {CVE-2026-68271}
• vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432}
• drm/vmwgfx: Validate vmw_surface_metadata::array_size {CVE-2026-68446}
• net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM {CVE-2026-68296}
• Input: elan_i2c - prevent division by zero and arithmetic underflow {CVE-2026-64275}
• iomap: fix out-of-bounds bitmap_set() with zero-length range {CVE-2026-68145}
• vsock: fix lock inversion in vsock_assign_transport() {CVE-2025-40231}
• ASoC: nau8821: Cancel delayed work on component remove {CVE-2026-45963}
• ext4: validate p_idx bounds in ext4_ext_correct_indexes {CVE-2026-31449}
• ipc: fix memleak if msg_init_ns failed in create_ipc_ns {CVE-2024-53175}
• tls: make sure to abort the stream if headers are bogus {CVE-2025-39946}
• ipv6: prevent infinite loop in rt6_nlmsg_size() {CVE-2025-38588}
• gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL {CVE-2026-23386}
• xsk: validate MTU against usable frame size on bind {CVE-2026-43092}
• RDMA/irdma: Harden depth calculation functions {CVE-2026-31491}
• iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() {CVE-2026-31505}
• net/ip6_tunnel: Prevent perpetual tunnel growth {CVE-2025-40173}
• net/mlx5: Fix deadlock between devlink lock and esw->wq {CVE-2026-43468}
• mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] {CVE-2026-31458}
• fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling {CVE-2026-52946}
• nvmet: move async event…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• !CONFIG & reference -> this is bug, immediate fail
• CONFIG & no reference -> OK temporarily, must be resolved eventually
• Do not self obsolete older kernel variants
• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Update config files. (bsc#1249186) Enable where we define KABI refs + rely on Kconfig deps.
• build_bug.h: Add KABI assert (bsc#1249186).
• hv_netvsc: Fix panic during namespace deletion with VF (bsc#1248111).
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
• kernel-syms.spec: Drop…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (bsc#1247288).
• CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (bsc#1247288).
• CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Revert backported patches for bsc#1238160.
• btrfs: avoid NULL pointer dereference if…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Revert selinux patches that caused regressions (bsc#1249353).
• btrfs: avoid NULL pointer dereference if no valid extent tree (bsc#1249158).
• build_bug.h: Add KABI assert (bsc#1249186).
• hv_netvsc: Fix panic during namespace deletion with VF (bsc#1248111).
• kabi/severities: ignore kABI for atheros helper modules The symbols are used only internally by atheros drivers.
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
• kernel-syms.spec: Drop…