CVE-2022-49114

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ARM: davinci: da850-evm: Avoid NULL pointer dereference

With newer versions of GCC, there is a panic in da850_evm_config_emac() when booting multi_v5_defconfig in QEMU under the palmetto-bmc machine:

Unable to handle kernel NULL pointer dereference at virtual address 00000020 pgd = (ptrval) [00000020] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT ARM Modules linked in: CPU: 0 PID: 1 Comm: swapper Not tainted 5.15.0 #1 Hardware name: Generic DT based system PC is at da850_evm_config_emac+0x1c/0x120 LR is at do_one_initcall+0x50/0x1e0

The emac_pdata pointer in soc_info is NULL because davinci_soc_info only gets populated on davinci machines but da850_evm_config_emac() is called on all machines via device_initcall().

Move the rmii_en assignment below the machine check so that it is only dereferenced when running on a supported SoC.(CVE-2021-47631)

In the Linux kernel, the following vulnerability has been resolved:

video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow

Coverity complains of a possible buffer overflow. However, given the 'static' scope of nvidia_setup_i2c_bus() it looks like that can't happen after examiniing the call sites.

CID 19036 (#1 of 1): Copy into fixed size buffer (STRING_OVERFLOW)

1. fixed_size_dest: You might overrun the 48-character fixed-size string chan->adapter.name by copying name without checking the length.
2. parameter_as_source: Note: This defect has an elevated risk because the source argument is a parameter of the current function. 89 strcpy(chan->adapter.name, name);

Fix this warning by using strscpy() which will silence the warning and prevent any future buffer overflows should the names used to identify the channel become much longer.(CVE-2021-47642)

In the Linux kernel, the following vulnerability has been resolved:

dm integrity: fix memory corruption when tag_size is less than digest size

It is possible to set up dm-integrity in such a way that the "tag_size" parameter is less than the actual digest size. In this situation, a part of the digest beyond tag_size is ignored.

In this case, dm-integrity would write beyond the end of the ic->recalc_tags array and corrupt memory. The corruption happened in integrity_recalc->integrity_sector_checksum->crypto_shash_final.

Fix this corruption by increasing the tags array so that it has enough padding at the end to accomodate the loop in integrity_recalc() being able to write a full digest size for the last member of the tags array.(CVE-2022-49044)

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Check for potential null return of kmalloc_array()

As the kmalloc_array() may return null, the 'event_waiters[i].wait' would lead to null-pointer dereference. Therefore, it is better to check the return value of kmalloc_array() to avoid this confusion.(CVE-2022-49055)

In the Linux kernel, the following vulnerability has been resolved:

scsi: libfc: Fix use after free in fc_exch_abts_resp()

fc_exch_release(ep) will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in the following code, which will lead to a use after free.

Return after the fc_exch_release() call to avoid use after free.(CVE-2022-49114)

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj

This issue takes place in an error path in amdgpu_cs_fence_to_handle_ioctl(). When info->in.what falls into default case, the function simply returns -EINVAL, forgetting to decrement the reference count of a dma_fence obj, which is bumped earlier by amdgpu_cs_get_fence(). This may result in reference count leaks.

Fix it by decreasing the refcount of specific object before returning the error…

In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use after free in fc_exch_abts_resp() fc_exch_release(ep) will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in the following code, which will lead to a use after free. Return after the fc_exch_release() call to avoid use after free.

• vsock: Keep the binding until socket destruction {CVE-2025-21756}
• mt76: fix use-after-free by removing a non-RCU wcid pointer {CVE-2022-49328}
• bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• net: sched: Fix use after free in red_enqueue() {CVE-2022-49921}
• udf: Fix a slab-out-of-bounds write bug in udf_find_entry() {CVE-2022-49846}
• ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892}
• dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• mac80211: fix potential double free on mesh join {CVE-2022-49290}
• wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416}
• ext4: fix OOB read when checking dotdot dir {CVE-2025-37785}
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
• tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
• wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}
• mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths {CVE-2022-48991}
• cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}
• media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init {CVE-2022-49478}
• HID: elan: Fix potential double free in elan_input_configured {CVE-2022-49508}
• bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers {CVE-2023-52621}
• drm/amd/pm: fix double free in si_parse_power_table() {CVE-2022-49530}
• drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() {CVE-2025-21780}
• crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612}
• sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168}
• net: make sock_inuse_add() available {CVE-2024-53168}

• vsock: Keep the binding until socket destruction {CVE-2025-21756}
• mt76: fix use-after-free by removing a non-RCU wcid pointer {CVE-2022-49328}
• bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• net: sched: Fix use after free in red_enqueue() {CVE-2022-49921}
• udf: Fix a slab-out-of-bounds write bug in udf_find_entry() {CVE-2022-49846}
• ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892}
• dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• mac80211: fix potential double free on mesh join {CVE-2022-49290}
• wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416}
• ext4: fix OOB read when checking dotdot dir {CVE-2025-37785}
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
• tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
• wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}
• mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths {CVE-2022-48991}
• cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}
• media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init {CVE-2022-49478}
• HID: elan: Fix potential double free in elan_input_configured {CVE-2022-49508}
• bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers {CVE-2023-52621}
• drm/amd/pm: fix double free in si_parse_power_table() {CVE-2022-49530}
• drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() {CVE-2025-21780}
• crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612}
• sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168}
• net: make sock_inuse_add() available {CVE-2024-53168}

• x86/kvm: Disable kvmclock on all CPUs on shutdown {CVE-2021-47110}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}
• aio: mark AIO pseudo-fs noexec {CVE-2016-10044}
• cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}
• NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}
• nfsd: register pernet ops last, unregister first {CVE-2025-38232}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• net: atm: add lec_mutex {CVE-2025-38180}
• SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
• scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() {CVE-2025-38399}
• scsi: target: Fix crash during SPEC_I_PT handling {CVE-2025-38399}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• drivers:md:fix a potential use-after-free bug {CVE-2022-50022}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
• net/sched: Abort __tc_modify_qdisc if parent class does not exist {CVE-2025-38457}
• misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() {CVE-2022-49788}
• dlm: fix plock invalid read {CVE-2022-49407}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
• ext4: Fix possible corruption when moving a directory {CVE-2023-53137}
• ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
• vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
• HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• ext4: check dot and dotdot of dx_root before making dir indexed {CVE-2024-42305}
• ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50229}
• dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
• md-raid10: fix KASAN warning {CVE-2022-50211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}
• media: cxusb: no longer judge rbuf when the write fails {CVE-2025-38229}
• ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}
• ext4: fix off-by-one error in do_split {CVE-2025-23150}
• perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init {CVE-2025-37878}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}

• x86/kvm: Disable kvmclock on all CPUs on shutdown {CVE-2021-47110}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}
• aio: mark AIO pseudo-fs noexec {CVE-2016-10044}
• cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}
• NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}
• nfsd: register pernet ops last, unregister first {CVE-2025-38232}
• net: atm: fix use after free in lec_send() {CVE-2025-22004}
• net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• net: atm: add lec_mutex {CVE-2025-38180}
• SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
• scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() {CVE-2025-38399}
• scsi: target: Fix crash during SPEC_I_PT handling {CVE-2025-38399}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• drivers:md:fix a potential use-after-free bug {CVE-2022-50022}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
• net/sched: Abort __tc_modify_qdisc if parent class does not exist {CVE-2025-38457}
• misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() {CVE-2022-49788}
• dlm: fix plock invalid read {CVE-2022-49407}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
• ext4: Fix possible corruption when moving a directory {CVE-2023-53137}
• ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
• vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
• HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• ext4: check dot and dotdot of dx_root before making dir indexed {CVE-2024-42305}
• ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50229}
• dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
• md-raid10: fix KASAN warning {CVE-2022-50211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}
• media: cxusb: no longer judge rbuf when the write fails {CVE-2025-38229}
• ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}
• ext4: fix off-by-one error in do_split {CVE-2025-23150}
• perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init {CVE-2025-37878}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}

• x86/kvm: Disable kvmclock on all CPUs on shutdown {CVE-2021-47110}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}
• aio: mark AIO pseudo-fs noexec {CVE-2016-10044}
• cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}
• NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}
• nfsd: register pernet ops last, unregister first {CVE-2025-38232}
• net: atm: fix use after free in lec_send() {CVE-2025-22004}
• net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• net: atm: add lec_mutex {CVE-2025-38180}
• SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
• scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() {CVE-2025-38399}
• scsi: target: Fix crash during SPEC_I_PT handling {CVE-2025-38399}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• drivers:md:fix a potential use-after-free bug {CVE-2022-50022}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
• net/sched: Abort __tc_modify_qdisc if parent class does not exist {CVE-2025-38457}
• misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() {CVE-2022-49788}
• dlm: fix plock invalid read {CVE-2022-49407}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
• ext4: Fix possible corruption when moving a directory {CVE-2023-53137}
• ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
• vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
• HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• ext4: check dot and dotdot of dx_root before making dir indexed {CVE-2024-42305}
• ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50229}
• dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
• md-raid10: fix KASAN warning {CVE-2022-50211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}
• media: cxusb: no longer judge rbuf when the write fails {CVE-2025-38229}
• ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}
• ext4: fix off-by-one error in do_split {CVE-2025-23150}
• perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init {CVE-2025-37878}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}

• usb: free iso schedules on failed submit {CVE-2026-64348}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342}
• can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
• can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
• dm-log: fix a bitset_size overflow on 32bit machines {CVE-2026-72105}
• scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• IB/mad: Drop unmatched RMPP responses before reassembly {CVE-2026-68425}
• wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() {CVE-2026-68413}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-53254}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986}
• tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198}
• netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
• scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() {CVE-2026-31408}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• RDMA/srp: bound SRP_RSP sense copy by the received length {CVE-2026-53186}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• RDMA/umad: Reject negative data_len in ib_umad_write() {CVE-2026-23243}
• can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• netfilter: xt_tcpmss: check remaining length before reading option length {CVE-2026-43190}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: nf_conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() {CVE-2022-50185}
• wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281}
• ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit {CVE-2019-15117}
• vfs: introduce FMODE_UNSIGNED_OFFSET for allowing negative f_pos {CVE-2019-18675}
• infiniband: fix a possible use-after-free bug {CVE-2018-14734}
• phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116}
• netfilter: require Ethernet MAC header before using eth_hdr()…

• usb: free iso schedules on failed submit {CVE-2026-64348}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342}
• can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
• can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
• dm-log: fix a bitset_size overflow on 32bit machines {CVE-2026-72105}
• scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• IB/mad: Drop unmatched RMPP responses before reassembly {CVE-2026-68425}
• wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() {CVE-2026-68413}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-53254}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986}
• tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198}
• netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
• scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() {CVE-2026-31408}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• RDMA/srp: bound SRP_RSP sense copy by the received length {CVE-2026-53186}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• RDMA/umad: Reject negative data_len in ib_umad_write() {CVE-2026-23243}
• can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• netfilter: xt_tcpmss: check remaining length before reading option length {CVE-2026-43190}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: nf_conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() {CVE-2022-50185}
• wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281}
• ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit {CVE-2019-15117}
• vfs: introduce FMODE_UNSIGNED_OFFSET for allowing negative f_pos {CVE-2019-18675}
• infiniband: fix a possible use-after-free bug {CVE-2018-14734}
• phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116}
• netfilter: require Ethernet MAC header before using eth_hdr()…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• initcall_blacklist: Does not allow kernel_lockdown be blacklisted (bsc#1237521).
• x86/bhi: Avoid warning in #DB handler due to BHI mitigation (git-fixes).
• x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (git-fixes).
• x86/bugs: Fix BHI documentation (git-fixes).
• x86/bugs: Fix BHI handling of RRSBA (git-fixes).
• x86/bugs: Fix BHI retpoline check (git-fixes).
• x86/bugs: Fix return type of spectre_bhi_state() (git-fixes).
• x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (git-fixes).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239095).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• Revert 'gfs2: Fix inode height consistency check (git-fixes).
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• cifs: Add a laundromat thread for cached directories (git-fixes).
• cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path (git-fixes).
• gfs2: Fix inode height consistency check (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• sched/membarrier: Fix redundant load of membarrier_state (bsc#1232743).
• smb3: allow controlling length of time directory entries are cached with dir leases (git-fixes).
• smb3: do not start laundromat thread when dir leases disabled (git-fixes).
• smb3: retrying on failed server close (git-fixes).
• smb: client: destroy cfid_put_wq on module exit (git-fixes).
• smb: client: disable directory caching when dir_cache_timeout is zero (git-fixes).
• smb: client: do not start laundromat thread on nohandlecache (git-fixes).
• smb: client: make laundromat a delayed worker (git-fixes).
• smb: client: properly close cfids on umount (bsc#1231432, bsc#1232299, bsc#1235599, bsc#1234896).
• tpm: send_data: Wait longer for the TPM to become ready (bsc#1235870).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
• CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
• CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
• CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21714: RDMA/mlx5: Fix implicit ODP use after free (bsc#1237890).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21732: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (bsc#1237877).
• CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).
• CVE-2025-21839: kABI: Fix kABI after backport od CVE-2025-21839 (bsc#1239061).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• RDMA/mlx5: Fix implicit ODP hang on parent deregistration (git-fixes)
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• gfs2: Fix inode height consistency check (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup (bsc#1240195).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• x86/bhi: Avoid warning in #DB handler due to BHI mitigation (git-fixes).
• x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (git-fixes).
• x86/bugs: Fix BHI documentation (git-fixes).
• x86/bugs: Fix BHI handling of RRSBA (git-fixes).
• x86/bugs: Fix BHI retpoline check (git-fixes).
• x86/bugs: Fix return type of spectre_bhi_state() (git-fixes).
• x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (git-fixes).

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47248: udp: fix race between close() and udp_abort() (bsc#1224867).
• CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (bsc#1237903).
• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49275: can: m_can: m_can_tx_handler(): fix use after free of skb (bsc#1238719).
• CVE-2022-49413: bfq: Update cgroup information before merging bio (bsc#1238710).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238729).
• CVE-2022-49563: crypto: qat - add param check for RSA (bsc#1238787).
• CVE-2022-49564: crypto: qat - add param check for DH (bsc#1238789).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-56642: tipc: Fix use-after-free of kernel socket in cleanup_bearer() (bsc#1235433).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• btrfs: send: use btrfs_file_extent_end() in send_write_or_clone() (bsc#1239969).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (bsc#1239095).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
• CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• btrfs: defrag: do not use merged extent map for their generation check (bsc#1239968).
• btrfs: fix defrag not merging contiguous extents due to merged extent maps (bsc#1239968).
• btrfs: fix extent map merging not happening for adjacent extents (bsc#1239968).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• cifs: Add a laundromat thread for cached directories (git-fixes).
• cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path (git-fixes).
• gfs2: Fix inode height consistency check (git-fixes).
• mm: zswap: move allocations during CPU init outside the lock (git-fixes).
• mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() (bsc#1239126).
• net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 (bsc#1239016).
• net: mana: Allow variable size indirection table (bsc#1239016).
• net: mana: Avoid open coded arithmetic (bsc#1239016).
• net: mana: Support holes in device list reply msg (bsc#1240133).
• RDMA/mana_ib: Prefer struct_size over open coded arithmetic (bsc#1239016).
• RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (bsc#1239016).
• sched/membarrier: Fix redundant load of membarrier_state (bsc#1232743).
• smb: client: destroy cfid_put_wq on module exit (git-fixes).
• smb: client: disable directory caching when dir_cache_timeout is zero (git-fixes).
• smb: client: do not start laundromat thread on nohandlecache (git-fixes).
• smb: client: make laundromat a delayed worker (git-fixes).
• smb: client: properly close cfids on umount (bsc#1231432, bsc#1232299, bsc#1235599, bsc#1234896).
• smb3: allow controlling length of time directory entries are cached with dir leases (git-fixes).
• smb3: do not start laundromat thread when dir leases disabled (git-fixes).
• smb3: retrying on failed server close (git-fixes).
• tpm: send_data: Wait longer for the TPM to become ready (bsc#1235870).

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47248: udp: fix race between close() and udp_abort() (bsc#1224867).
• CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (bsc#1237903).
• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49275: can: m_can: m_can_tx_handler(): fix use after free of skb (bsc#1238719).
• CVE-2022-49413: bfq: Update cgroup information before merging bio (bsc#1238710).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238729).
• CVE-2022-49563: crypto: qat - add param check for RSA (bsc#1238787).
• CVE-2022-49564: crypto: qat - add param check for DH (bsc#1238789).
• CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
• CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
• CVE-2024-56642: tipc: Fix use-after-free of kernel socket in cleanup_bearer() (bsc#1235433).
• CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
• CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
• CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
• CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).

The following non-security bugs were fixed:

• ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (bsc#1237530).
• btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
• btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
• btrfs: send: use btrfs_file_extent_end() in send_write_or_clone() (bsc#1239969).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-47645: media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com (bsc#1237767).
• CVE-2021-47648: gpu: host1x: Fix a memory leak in 'host1x_remove()' (bsc#1237725).
• CVE-2022-49046: i2c: dev: check return value when calling dev_set_name() (bsc#1237842).
• CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (bsc#1237903).
• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
• CVE-2022-49059: nfc: nci: add flush_workqueue to prevent uaf (bsc#1238007).
• CVE-2022-49074: irqchip/gic-v3: Fix GICR_CTLR.RWP polling (bsc#1237728).
• CVE-2022-49075: btrfs: fix qgroup reserve overflow the qgroup limit (bsc#1237733).
• CVE-2022-49084: qede: confirm skb is allocated before using (bsc#1237751).
• CVE-2022-49107: ceph: fix memory leak in ceph_readdir when note_last_dentry returns error (bsc#1237973).
• CVE-2022-49109: ceph: fix inode reference leakage in ceph_get_snapdir() (bsc#1237836).
• CVE-2022-49119: scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() (bsc#1237925).
• CVE-2022-49120: scsi: pm8001: Fix task leak in pm8001_send_abort_all() (bsc#1237969).
• CVE-2022-49209: bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full (bsc#1238252).
• CVE-2022-49220: dax: make sure inodes are flushed before destroy cache (bsc#1237936).
• CVE-2022-49275: can: m_can: m_can_tx_handler(): fix use after free of skb (bsc#1238719).
• CVE-2022-49286: tpm: use try_get_ops() in tpm-space.c (bsc#1238647).
• CVE-2022-49292: ALSA: oss: Fix PCM OSS buffer allocation overflow (bsc#1238625).
• CVE-2022-49308: extcon: Modify extcon device to be created after driver data is set (bsc#1238654).
• CVE-2022-49331: nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling (bsc#1237813).
• CVE-2022-49344: af_unix: Fix a data-race in unix_dgram_peer_wake_me() (bsc#1237988).
• CVE-2022-49367: net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register (bsc#1238447).
• CVE-2022-49370: firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (bsc#1238467).
• CVE-2022-49372: tcp: tcp_rtx_synack() can be called from process context (bsc#1238251).
• CVE-2022-49388: ubi: ubi_create_volume: Fix use-after-free when volume creation failed (bsc#1237934).
• CVE-2022-49395: um: Fix out-of-bounds read in LDT setup (bsc#1237953).
• CVE-2022-49397: phy: qcom-qmp: fix struct clk leak on probe errors (bsc#1237823).
• CVE-2022-49404: RDMA/hfi1: Fix potential integer multiplication overflow errors (bsc#1238430).
• CVE-2022-49416: wifi: mac80211: fix use-after-free in chanctx code (bsc#1238293).
• CVE-2022-49433: RDMA/hfi1: Prevent use of lock before it is initialized (bsc#1238268).
• CVE-2022-49472: net: phy: micrel: Allow probing without .driver_data (bsc#1238951).
• CVE-2022-49488: drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock (bsc#1238600).
• CVE-2022-49495: drm/msm/hdmi: check return value after calling platform_get_resource_byname() (bsc#1237932).
• CVE-2022-49497: net: remove two BUG() from skb_checksum_help() (bsc#1238946).
• CVE-2022-49505: NFC: NULL out the dev->rfkill to prevent UAF (bsc#1238615).
• CVE-2022-49516: ice: always check VF VSI pointer values (bsc#1238953).
• CVE-2022-49519: ath10k: skip ath10k_halt during suspend for driver state RESTARTING (bsc#1238943).
• CVE-2022-49524: media: pci: cx23885: Fix the error handling in cx23885_initdev() (bsc#1238949).
• CVE-2022-49530: drm/amd/pm: fix double free in si_parse_power_table() (bsc#1238944).
• CVE-2022-49538: ALSA: jack: Fix mutex call in snd_jack_report() (bsc#1238843).
• CVE-2022-49544: ipw2x00: Fix potential NULL dereference in libipw_xmit() (bsc#1238721).
• CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238729). -…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• SCSI subsystem;
• Bluetooth subsystem; (CVE-2022-49111, CVE-2022-49114)