CVE-2025-38085

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed. If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected. Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: avoid skb access on nf_stolen

When verdict is NF_STOLEN, the skb might have been freed.

When tracing is enabled, this can result in a use-after-free:

1. access to skb->nf_trace
2. access to skb->mark
3. computation of trace id
4. dump of packet payload

To avoid 1, keep a cached copy of skb->nf_trace in the trace state struct. Refresh this copy whenever verdict is != STOLEN.

Avoid 2 by skipping skb->mark access if verdict is STOLEN.

3 is avoided by precomputing the trace id.

Only dump the packet when verdict is not "STOLEN".(CVE-2022-49622)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: release svc_expkey/svc_export with rcu_work

The last reference for cache_head can be reduced to zero in c_show and e_show(using rcu_read_lock and rcu_read_unlock). Consequently, svc_export_put and expkey_put will be invoked, leading to two issues:

1. The svc_export_put will directly free ex_uuid. However, e_show/c_show will access ex_uuid after cache_put, which can trigger a use-after-free issue, shown below.

   ================================================================== BUG: KASAN: slab-use-after-free in svc_export_show+0x362/0x430 [nfsd] Read of size 1 at addr ff11000010fdc120 by task cat/870

   CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_address_description.constprop.0+0x2c/0x3a0 print_report+0xb9/0x280 kasan_report+0xae/0xe0 svc_export_show+0x362/0x430 [nfsd] c_show+0x161/0x390 [sunrpc] seq_read_iter+0x589/0x770 seq_read+0x1e5/0x270 proc_reg_read+0xe1/0x140 vfs_read+0x125/0x530 ksys_read+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e

   Allocated by task 830: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc_node_track_caller_noprof+0x1bc/0x400 kmemdup_noprof+0x22/0x50 svc_export_parse+0x8a9/0xb80 [nfsd] cache_do_downcall+0x71/0xa0 [sunrpc] cache_write_procfs+0x8e/0xd0 [sunrpc] proc_reg_write+0xe1/0x140 vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e

   Freed by task 868: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x37/0x50 kfree+0xf3/0x3e0 svc_export_put+0x87/0xb0 [nfsd] cache_purge+0x17f/0x1f0 [sunrpc] nfsd_destroy_serv+0x226/0x2d0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e

2. We cannot sleep while using rcu_read_lock/rcu_read_unlock. However, svc_export_put/expkey_put will call path_put, which subsequently triggers a sleeping operation due to the following dput.

   ============================= WARNING: suspicious RCU usage 5.10.0-dirty #141 Not tainted

   ... Call Trace: dump_stack+0x9a/0xd0 ___might_sleep+0x231/0x240 dput+0x39/0x600 path_put+0x1b/0x30 svc_export_put+0x17/0x80 e_show+0x1c9/0x200 seq_read_iter+0x63f/0x7c0 seq_read+0x226/0x2d0 vfs_read+0x113/0x2c0 ksys_read+0xc9/0x170 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x67/0xd1

Fix these issues by using rcu_work to help release svc_expkey/svc_export. This approach allows for an asynchronous context to invoke path_put and also facilitates the freeing of uuid/exp/key after an RCU grace…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix memory leak

[why] Resource release is needed on the error handling path to prevent memory leak.

[how] Fix this by adding kfree on the error handling path.(CVE-2022-49135)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: avoid skb access on nf_stolen

When verdict is NF_STOLEN, the skb might have been freed.

When tracing is enabled, this can result in a use-after-free:

1. access to skb->nf_trace
2. access to skb->mark
3. computation of trace id
4. dump of packet payload

To avoid 1, keep a cached copy of skb->nf_trace in the trace state struct. Refresh this copy whenever verdict is != STOLEN.

Avoid 2 by skipping skb->mark access if verdict is STOLEN.

3 is avoided by precomputing the trace id.

Only dump the packet when verdict is not "STOLEN".(CVE-2022-49622)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: release svc_expkey/svc_export with rcu_work

The last reference for cache_head can be reduced to zero in c_show and e_show(using rcu_read_lock and rcu_read_unlock). Consequently, svc_export_put and expkey_put will be invoked, leading to two issues:

1. The svc_export_put will directly free ex_uuid. However, e_show/c_show will access ex_uuid after cache_put, which can trigger a use-after-free issue, shown below.

   ================================================================== BUG: KASAN: slab-use-after-free in svc_export_show+0x362/0x430 [nfsd] Read of size 1 at addr ff11000010fdc120 by task cat/870

   CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_address_description.constprop.0+0x2c/0x3a0 print_report+0xb9/0x280 kasan_report+0xae/0xe0 svc_export_show+0x362/0x430 [nfsd] c_show+0x161/0x390 [sunrpc] seq_read_iter+0x589/0x770 seq_read+0x1e5/0x270 proc_reg_read+0xe1/0x140 vfs_read+0x125/0x530 ksys_read+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e

   Allocated by task 830: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc_node_track_caller_noprof+0x1bc/0x400 kmemdup_noprof+0x22/0x50 svc_export_parse+0x8a9/0xb80 [nfsd] cache_do_downcall+0x71/0xa0 [sunrpc] cache_write_procfs+0x8e/0xd0 [sunrpc] proc_reg_write+0xe1/0x140 vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e

   Freed by task 868: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x37/0x50 kfree+0xf3/0x3e0 svc_export_put+0x87/0xb0 [nfsd] cache_purge+0x17f/0x1f0 [sunrpc] nfsd_destroy_serv+0x226/0x2d0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e

2. We cannot sleep while using rcu_read_lock/rcu_read_unlock. However, svc_export_put/expkey_put will call path_put, which subsequently triggers a sleeping operation due to the following dput.

   ============================= WARNING: suspicious RCU usage 5.10.0-dirty #141 Not tainted

   ... Call Trace: dump_stack+0x9a/0xd0 ___might_sleep+0x231/0x240 dput+0x39/0x600 path_put+0x1b/0x30 svc_export_put+0x17/0x80 e_show+0x1c9/0x200 seq_read_iter+0x63f/0x7c0 seq_read+0x226/0x2d0 vfs_read+0x113/0x2c0 ksys_read+0xc9/0x170 do_syscall_64+0x33/0x40 …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

gtp: Destroy device along with udp socket's netns dismantle.

gtp_newlink() links the device to a list in dev_net(dev) instead of src_net, where a udp tunnel socket is created.

Even when src_net is removed, the device stays alive on dev_net(dev). Then, removing src_net triggers the splat below. [0]

In this example, gtp0 is created in ns2, and the udp socket is created in ns1.

ip netns add ns1 ip netns add ns2 ip -n ns1 link add netns ns2 name gtp0 type gtp role sgsn ip netns del ns1

Let's link the device to the socket's netns instead.

Now, gtp_net_exit_batch_rtnl() needs another netdev iteration to remove all gtp devices in the netns.

[0]: ref_tracker: net notrefcnt@000000003d6e7d05 has 1/2 users at sk_alloc (./include/net/net_namespace.h:345 net/core/sock.c:2236) inet_create (net/ipv4/af_inet.c:326 net/ipv4/af_inet.c:252) __sock_create (net/socket.c:1558) udp_sock_create4 (net/ipv4/udp_tunnel_core.c:18) gtp_create_sock (./include/net/udp_tunnel.h:59 drivers/net/gtp.c:1423) gtp_create_sockets (drivers/net/gtp.c:1447) gtp_newlink (drivers/net/gtp.c:1507) rtnl_newlink (net/core/rtnetlink.c:3786 net/core/rtnetlink.c:3897 net/core/rtnetlink.c:4012) rtnetlink_rcv_msg (net/core/rtnetlink.c:6922) netlink_rcv_skb (net/netlink/af_netlink.c:2542) netlink_unicast (net/netlink/af_netlink.c:1321 net/netlink/af_netlink.c:1347) netlink_sendmsg (net/netlink/af_netlink.c:1891) ____sys_sendmsg (net/socket.c:711 net/socket.c:726 net/socket.c:2583) ___sys_sendmsg (net/socket.c:2639) __sys_sendmsg (net/socket.c:2669) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)

WARNING: CPU: 1 PID: 60 at lib/ref_tracker.c:179 ref_tracker_dir_exit (lib/ref_tracker.c:179) Modules linked in: CPU: 1 UID: 0 PID: 60 Comm: kworker/u16:2 Not tainted 6.13.0-rc5-00147-g4c1224501e9d #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:ref_tracker_dir_exit (lib/ref_tracker.c:179) Code: 00 00 00 fc ff df 4d 8b 26 49 bd 00 01 00 00 00 00 ad de 4c 39 f5 0f 85 df 00 00 00 48 8b 74 24 08 48 89 df e8 a5 cc 12 02 90 <0f> 0b 90 48 8d 6b 44 be 04 00 00 00 48 89 ef e8 80 de 67 ff 48 89 RSP: 0018:ff11000009a07b60 EFLAGS: 00010286 RAX: 0000000000002bd3 RBX: ff1100000f4e1aa0 RCX: 1ffffffff0e40ac6 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8423ee3c RBP: ff1100000f4e1af0 R08: 0000000000000001 R09: fffffbfff0e395ae R10: 0000000000000001 R11: 0000000000036001 R12: ff1100000f4e1af0 R13: dead000000000100 R14: ff1100000f4e1af0 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ff1100006ce80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9b2464bd98 CR3: 0000000005286005 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn (kernel/panic.c:748) ? ref_tracker_dir_exit (lib/ref_tracker.c:179) ? report_bug (lib/bug.c:201 lib/bug.c:219) ? handle_bug (arch/x86/kernel/traps.c:285) ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 ./arch/x86/include/asm/irqflags.h:155 ./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194) ? ref_tracker_dir_exit (lib/ref_tracker.c:179) ? __pfx_ref_tracker_dir_exit (lib/ref_tracker.c:158) ? kfree (mm/slub.c:4613 mm/slub.c:4761) net_free (net/core/net_namespace.c:476 net/core/net_namespace.c:467) cleanup_net (net/core/net_namespace.c:664 (discriminator 3)) process_one_work…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

gtp: Destroy device along with udp socket's netns dismantle.

gtp_newlink() links the device to a list in dev_net(dev) instead of src_net, where a udp tunnel socket is created.

Even when src_net is removed, the device stays alive on dev_net(dev). Then, removing src_net triggers the splat below. [0]

In this example, gtp0 is created in ns2, and the udp socket is created in ns1.

ip netns add ns1 ip netns add ns2 ip -n ns1 link add netns ns2 name gtp0 type gtp role sgsn ip netns del ns1

Let's link the device to the socket's netns instead.

Now, gtp_net_exit_batch_rtnl() needs another netdev iteration to remove all gtp devices in the netns.

[0]: ref_tracker: net notrefcnt@000000003d6e7d05 has 1/2 users at sk_alloc (./include/net/net_namespace.h:345 net/core/sock.c:2236) inet_create (net/ipv4/af_inet.c:326 net/ipv4/af_inet.c:252) __sock_create (net/socket.c:1558) udp_sock_create4 (net/ipv4/udp_tunnel_core.c:18) gtp_create_sock (./include/net/udp_tunnel.h:59 drivers/net/gtp.c:1423) gtp_create_sockets (drivers/net/gtp.c:1447) gtp_newlink (drivers/net/gtp.c:1507) rtnl_newlink (net/core/rtnetlink.c:3786 net/core/rtnetlink.c:3897 net/core/rtnetlink.c:4012) rtnetlink_rcv_msg (net/core/rtnetlink.c:6922) netlink_rcv_skb (net/netlink/af_netlink.c:2542) netlink_unicast (net/netlink/af_netlink.c:1321 net/netlink/af_netlink.c:1347) netlink_sendmsg (net/netlink/af_netlink.c:1891) ____sys_sendmsg (net/socket.c:711 net/socket.c:726 net/socket.c:2583) ___sys_sendmsg (net/socket.c:2639) __sys_sendmsg (net/socket.c:2669) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)

WARNING: CPU: 1 PID: 60 at lib/ref_tracker.c:179 ref_tracker_dir_exit (lib/ref_tracker.c:179) Modules linked in: CPU: 1 UID: 0 PID: 60 Comm: kworker/u16:2 Not tainted 6.13.0-rc5-00147-g4c1224501e9d #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:ref_tracker_dir_exit (lib/ref_tracker.c:179) Code: 00 00 00 fc ff df 4d 8b 26 49 bd 00 01 00 00 00 00 ad de 4c 39 f5 0f 85 df 00 00 00 48 8b 74 24 08 48 89 df e8 a5 cc 12 02 90 <0f> 0b 90 48 8d 6b 44 be 04 00 00 00 48 89 ef e8 80 de 67 ff 48 89 RSP: 0018:ff11000009a07b60 EFLAGS: 00010286 RAX: 0000000000002bd3 RBX: ff1100000f4e1aa0 RCX: 1ffffffff0e40ac6 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8423ee3c RBP: ff1100000f4e1af0 R08: 0000000000000001 R09: fffffbfff0e395ae R10: 0000000000000001 R11: 0000000000036001 R12: ff1100000f4e1af0 R13: dead000000000100 R14: ff1100000f4e1af0 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ff1100006ce80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9b2464bd98 CR3: 0000000005286005 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn (kernel/panic.c:748) ? ref_tracker_dir_exit (lib/ref_tracker.c:179) ? report_bug (lib/bug.c:201 lib/bug.c:219) ? handle_bug (arch/x86/kernel/traps.c:285) ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 ./arch/x86/include/asm/irqflags.h:155 ./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194) ? ref_tracker_dir_exit (lib/ref_tracker.c:179) ? __pfx_ref_tracker_dir_exit (lib/ref_tracker.c:158) ? kfree (mm/slub.c:4613 mm/slub.c:4761) net_free (net/core/net_namespace.c:476 net/core/net_namespace.c:467) cleanup_net (net/core/net_namespace.c:664 (discriminator 3)) process_one_work…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

gtp: Destroy device along with udp socket's netns dismantle.

gtp_newlink() links the device to a list in dev_net(dev) instead of src_net, where a udp tunnel socket is created.

Even when src_net is removed, the device stays alive on dev_net(dev). Then, removing src_net triggers the splat below. [0]

In this example, gtp0 is created in ns2, and the udp socket is created in ns1.

ip netns add ns1 ip netns add ns2 ip -n ns1 link add netns ns2 name gtp0 type gtp role sgsn ip netns del ns1

Let's link the device to the socket's netns instead.

Now, gtp_net_exit_batch_rtnl() needs another netdev iteration to remove all gtp devices in the netns.

[0]: ref_tracker: net notrefcnt@000000003d6e7d05 has 1/2 users at sk_alloc (./include/net/net_namespace.h:345 net/core/sock.c:2236) inet_create (net/ipv4/af_inet.c:326 net/ipv4/af_inet.c:252) __sock_create (net/socket.c:1558) udp_sock_create4 (net/ipv4/udp_tunnel_core.c:18) gtp_create_sock (./include/net/udp_tunnel.h:59 drivers/net/gtp.c:1423) gtp_create_sockets (drivers/net/gtp.c:1447) gtp_newlink (drivers/net/gtp.c:1507) rtnl_newlink (net/core/rtnetlink.c:3786 net/core/rtnetlink.c:3897 net/core/rtnetlink.c:4012) rtnetlink_rcv_msg (net/core/rtnetlink.c:6922) netlink_rcv_skb (net/netlink/af_netlink.c:2542) netlink_unicast (net/netlink/af_netlink.c:1321 net/netlink/af_netlink.c:1347) netlink_sendmsg (net/netlink/af_netlink.c:1891) ____sys_sendmsg (net/socket.c:711 net/socket.c:726 net/socket.c:2583) ___sys_sendmsg (net/socket.c:2639) __sys_sendmsg (net/socket.c:2669) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)

WARNING: CPU: 1 PID: 60 at lib/ref_tracker.c:179 ref_tracker_dir_exit (lib/ref_tracker.c:179) Modules linked in: CPU: 1 UID: 0 PID: 60 Comm: kworker/u16:2 Not tainted 6.13.0-rc5-00147-g4c1224501e9d #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:ref_tracker_dir_exit (lib/ref_tracker.c:179) Code: 00 00 00 fc ff df 4d 8b 26 49 bd 00 01 00 00 00 00 ad de 4c 39 f5 0f 85 df 00 00 00 48 8b 74 24 08 48 89 df e8 a5 cc 12 02 90 <0f> 0b 90 48 8d 6b 44 be 04 00 00 00 48 89 ef e8 80 de 67 ff 48 89 RSP: 0018:ff11000009a07b60 EFLAGS: 00010286 RAX: 0000000000002bd3 RBX: ff1100000f4e1aa0 RCX: 1ffffffff0e40ac6 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8423ee3c RBP: ff1100000f4e1af0 R08: 0000000000000001 R09: fffffbfff0e395ae R10: 0000000000000001 R11: 0000000000036001 R12: ff1100000f4e1af0 R13: dead000000000100 R14: ff1100000f4e1af0 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ff1100006ce80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9b2464bd98 CR3: 0000000005286005 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn (kernel/panic.c:748) ? ref_tracker_dir_exit (lib/ref_tracker.c:179) ? report_bug (lib/bug.c:201 lib/bug.c:219) ? handle_bug (arch/x86/kernel/traps.c:285) ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 ./arch/x86/include/asm/irqflags.h:155 ./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194) ? ref_tracker_dir_exit (lib/ref_tracker.c:179) ? __pfx_ref_tracker_dir_exit (lib/ref_tracker.c:158) ? kfree (mm/slub.c:4613 mm/slub.c:4761) net_free (net/core/net_namespace.c:476 net/core/net_namespace.c:467) cleanup_net (net/core/net_namespace.c:664 (discriminator 3)) process_one_work…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

• kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

• kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)

• kernel: can: peak_usb: fix use after free bugs (CVE-2021-47670)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

• kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

• kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)

• kernel: can: peak_usb: fix use…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

• kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

• kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)

• kernel: can: peak_usb: fix use after free bugs (CVE-2021-47670)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: x86/CPU/AMD: Terminate the erratum_1386_microcode array (CVE-2024-56721)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: x86/CPU/AMD: Terminate the erratum_1386_microcode array (CVE-2024-56721)

• kernel: crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: x86/CPU/AMD: Terminate the erratum_1386_microcode array (CVE-2024-56721)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: x86/CPU/AMD: Terminate the erratum_1386_microcode array (CVE-2024-56721)

• kernel: crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079)

• kernel: mm/hugetlb: unshare page tables during VMA split, not before (CVE-2025-38084)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: x86/CPU/AMD: Terminate the erratum_1386_microcode array (CVE-2024-56721)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: x86/CPU/AMD: Terminate the erratum_1386_microcode array (CVE-2024-56721)

• kernel: crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: x86/CPU/AMD: Terminate the erratum_1386_microcode array (CVE-2024-56721)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security…

Root has patched CVE-2025-38085 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2025-38085 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-38085 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2025-38085 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed. If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected. Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)
• kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)
• kernel: can: peak_usb: fix use after free bugs (CVE-2021-47670)
• kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085)
• kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CVE-2025-38159)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)
• kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)
• kernel: can: peak_usb: fix use after free bugs (CVE-2021-47670)
• kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085)
• kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CVE-2025-38159)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (CVE-2025-21867)
• microcode_ctl: From CVEorg collector (CVE-2024-28956)
• kernel: mm/hugetlb: unshare page tables during VMA split, not before (CVE-2025-38084)
• kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085)
• kernel: net: fix udp gso skb_segment after pull from frag_list (CVE-2025-38124)
• kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CVE-2025-38159)
• kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush() (CVE-2025-38250)
• kernel: i2c/designware: Fix an initialization issue (CVE-2025-38380)
• kernel: tls: always refresh the queue when reading sock (CVE-2025-38471)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race

huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed.

If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected.

Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse.

• x86/kvm: Disable kvmclock on all CPUs on shutdown {CVE-2021-47110}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}
• aio: mark AIO pseudo-fs noexec {CVE-2016-10044}
• cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}
• NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}
• nfsd: register pernet ops last, unregister first {CVE-2025-38232}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• net: atm: add lec_mutex {CVE-2025-38180}
• SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
• scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() {CVE-2025-38399}
• scsi: target: Fix crash during SPEC_I_PT handling {CVE-2025-38399}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• drivers:md:fix a potential use-after-free bug {CVE-2022-50022}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
• net/sched: Abort __tc_modify_qdisc if parent class does not exist {CVE-2025-38457}
• misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() {CVE-2022-49788}
• dlm: fix plock invalid read {CVE-2022-49407}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
• ext4: Fix possible corruption when moving a directory {CVE-2023-53137}
• ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
• vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
• HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• ext4: check dot and dotdot of dx_root before making dir indexed {CVE-2024-42305}
• ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50229}
• dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
• md-raid10: fix KASAN warning {CVE-2022-50211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}
• media: cxusb: no longer judge rbuf when the write fails {CVE-2025-38229}
• ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}
• ext4: fix off-by-one error in do_split {CVE-2025-23150}
• perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init {CVE-2025-37878}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}

• x86/kvm: Disable kvmclock on all CPUs on shutdown {CVE-2021-47110}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}
• aio: mark AIO pseudo-fs noexec {CVE-2016-10044}
• cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}
• NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}
• nfsd: register pernet ops last, unregister first {CVE-2025-38232}
• net: atm: fix use after free in lec_send() {CVE-2025-22004}
• net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• net: atm: add lec_mutex {CVE-2025-38180}
• SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
• scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() {CVE-2025-38399}
• scsi: target: Fix crash during SPEC_I_PT handling {CVE-2025-38399}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• drivers:md:fix a potential use-after-free bug {CVE-2022-50022}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
• net/sched: Abort __tc_modify_qdisc if parent class does not exist {CVE-2025-38457}
• misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() {CVE-2022-49788}
• dlm: fix plock invalid read {CVE-2022-49407}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
• ext4: Fix possible corruption when moving a directory {CVE-2023-53137}
• ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
• vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
• HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• ext4: check dot and dotdot of dx_root before making dir indexed {CVE-2024-42305}
• ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50229}
• dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
• md-raid10: fix KASAN warning {CVE-2022-50211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}
• media: cxusb: no longer judge rbuf when the write fails {CVE-2025-38229}
• ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}
• ext4: fix off-by-one error in do_split {CVE-2025-23150}
• perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init {CVE-2025-37878}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}

• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982}
• nfsd: fix race between laundromat and free_stateid {CVE-2024-50106}
• nfsd: split sc_status out of sc_type {CVE-2024-50106}
• nfsd: avoid race after unhash_delegation_locked() {CVE-2024-50106}
• nfsd: don't call functions with side-effecting inside WARN_ON() {CVE-2024-50106}
• can: peak_usb: fix use after free bugs {CVE-2021-47670}
• wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}
• i2c/designware: Fix an initialization issue {CVE-2025-38380}
• RDMA/rxe: Fix error unwind in rxe_create_qp() {CVE-2022-50127}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
• udp: Fix memory accounting leak. {CVE-2025-22058}
• Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
• net_sched: ets: Fix double list add in class with netem as child qdisc {CVE-2025-38085}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• mm/khugepaged: fix GUP-fast interaction by sending IPI {CVE-2025-38085}
• padata: fix UAF in padata_reorder {CVE-2025-21727}
• net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
• codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-38177}
• sch_ets: make est_qlen_notify() idempotent {CVE-2025-38177}
• sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38177}
• sch_htb: make htb_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
• tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
• RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• netfilter: xtables: avoid NFPROTO_UNSPEC where needed {CVE-2024-50038}
• netfilter: xtables: Add snapshot of hardidletimer target {CVE-2024-50038}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890}
• net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273}
• net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052}
• memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove {CVE-2025-22020}

• inet: fully convert sk->sk_rx_dst to RCU rules {CVE-2021-47103}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• can: peak_usb: fix use after free bugs {CVE-2021-47670}
• wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}
• RDMA/rxe: Fix error unwind in rxe_create_qp() {CVE-2022-50127}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
• udp: Fix memory accounting leak. {CVE-2025-22058}
• ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50083}
• ext4: correct the misjudgment in ext4_iget_extra_inode {CVE-2022-50083}
• ext4: correct max_inline_xattr_value_size computing {CVE-2022-50083}
• ext4: fix use-after-free in ext4_xattr_set_entry {CVE-2022-50083}
• ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h {CVE-2022-50083}
• Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
• net_sched: ets: Fix double list add in class with netem as child qdisc {CVE-2025-38085}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• padata: fix UAF in padata_reorder {CVE-2025-21727}
• net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
• codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-38177}
• sch_ets: make est_qlen_notify() idempotent {CVE-2025-38177}
• sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38177}
• sch_htb: make htb_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• mptcp: do not queue data on closed subflows {CVE-2022-50070}
• mptcp: export mptcp_subflow_active {CVE-2022-50070}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
• tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
• RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273}
• ice: xsk: prohibit usage of non-balanced queue id {CVE-2022-50003}
• net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052}
• virtio-gpu: fix a missing check to avoid NULL dereference {CVE-2022-50181}
• usb: xhci_plat_remove: avoid NULL dereference {CVE-2022-50133}
• ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot {CVE-2022-50015}
• netfilter: nft_tproxy: restrict to prerouting hook {CVE-2022-50001}
• scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq {CVE-2022-49986}
• ath11k: fix netdev open race {CVE-2022-50187}

• inet: fully convert sk->sk_rx_dst to RCU rules {CVE-2021-47103}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• can: peak_usb: fix use after free bugs {CVE-2021-47670}
• wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}
• RDMA/rxe: Fix error unwind in rxe_create_qp() {CVE-2022-50127}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
• udp: Fix memory accounting leak. {CVE-2025-22058}
• ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50083}
• ext4: correct the misjudgment in ext4_iget_extra_inode {CVE-2022-50083}
• ext4: correct max_inline_xattr_value_size computing {CVE-2022-50083}
• ext4: fix use-after-free in ext4_xattr_set_entry {CVE-2022-50083}
• ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h {CVE-2022-50083}
• Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
• net_sched: ets: Fix double list add in class with netem as child qdisc {CVE-2025-38085}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• padata: fix UAF in padata_reorder {CVE-2025-21727}
• net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
• codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-38177}
• sch_ets: make est_qlen_notify() idempotent {CVE-2025-38177}
• sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38177}
• sch_htb: make htb_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• mptcp: do not queue data on closed subflows {CVE-2022-50070}
• mptcp: export mptcp_subflow_active {CVE-2022-50070}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
• tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
• RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890}
• net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273}
• ice: xsk: prohibit usage of non-balanced queue id {CVE-2022-50003}
• net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052}
• virtio-gpu: fix a missing check to avoid NULL dereference {CVE-2022-50181}
• usb: xhci_plat_remove: avoid NULL dereference {CVE-2022-50133}
• ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot {CVE-2022-50015}
• netfilter: nft_tproxy: restrict to prerouting hook {CVE-2022-50001}
• scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq {CVE-2022-49986}
• ath11k: fix netdev open race {CVE-2022-50187}

• x86/kvm: Disable kvmclock on all CPUs on shutdown {CVE-2021-47110}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}
• aio: mark AIO pseudo-fs noexec {CVE-2016-10044}
• cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}
• NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}
• nfsd: register pernet ops last, unregister first {CVE-2025-38232}
• net: atm: fix use after free in lec_send() {CVE-2025-22004}
• net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• net: atm: add lec_mutex {CVE-2025-38180}
• SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
• scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() {CVE-2025-38399}
• scsi: target: Fix crash during SPEC_I_PT handling {CVE-2025-38399}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• drivers:md:fix a potential use-after-free bug {CVE-2022-50022}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
• net/sched: Abort __tc_modify_qdisc if parent class does not exist {CVE-2025-38457}
• misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() {CVE-2022-49788}
• dlm: fix plock invalid read {CVE-2022-49407}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
• ext4: Fix possible corruption when moving a directory {CVE-2023-53137}
• ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
• vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
• HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• ext4: check dot and dotdot of dx_root before making dir indexed {CVE-2024-42305}
• ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50229}
• dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
• md-raid10: fix KASAN warning {CVE-2022-50211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}
• media: cxusb: no longer judge rbuf when the write fails {CVE-2025-38229}
• ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}
• ext4: fix off-by-one error in do_split {CVE-2025-23150}
• perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init {CVE-2025-37878}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}

• tls: always refresh the queue when reading sock {CVE-2025-38471}
• Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
• i2c/designware: Fix an initialization issue {CVE-2025-38380}
• wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• mm/khugepaged: fix GUP-fast interaction by sending IPI
• bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() {CVE-2025-21867}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• ext4: avoid journaling sb update on error if journal is destroying {CVE-2025-22113}
• ext4: define ext4_journal_destroy wrapper
• Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013}
• Bluetooth: Remove BT_HS {CVE-2024-38620}
• block, bfq: fix bfqq uaf in bfq_limit_depth() {CVE-2024-53166}
• dm-crypt: don't modify the data when using authenticated encryption {CVE-2024-26763}
• bpf: Fix helper writes to read-only maps (alt version) {CVE-2024-49861}
• bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers {CVE-2023-52621}
• netfilter: xtables: avoid NFPROTO_UNSPEC where needed {CVE-2024-50038}
• xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
• scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
• net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556}
• net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273}
• net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890}
• net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052}
• misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() {CVE-2022-49788}
• padata: fix UAF in padata_reorder {CVE-2025-21727}
• RDMA/mlx5: Fix page_size variable overflow {CVE-2025-22091}

Vanilla upstream kernel version 6.6.101 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

Upstream kernel version 6.6.101 fixes bugs and vulnerabilities. The kmod-virtualbox, kmod-xtables-addons & wireless-regdb packages have been updated to work with this new kernel. For information about the vulnerabilities see the links.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
• CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
• CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
• CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
• CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
• CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
• CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
• CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
• CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
• CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
• CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
• CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
• CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
• CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
• CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
• CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
• CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
• CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
• CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
• CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
• CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
• CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
• CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
• CVE-2025-40134: dm: fix NULL pointer dereference in…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
• CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
• CVE-2024-42134: virtio-pci: Check if is_avq is NULL (bsc#1228664 bsc#1247831).
• CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
• CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
• CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
• CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
• CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
• CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
• CVE-2025-38047: x86/fred: Fix system hang during S4 resume with FRED enabled (bsc#1245084).
• CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
• CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
• CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
• CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
• CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
• CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
• CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
• CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
• CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
• CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
• CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
• CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
• CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
• CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
• CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).
• CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).
• CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).
• CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
• CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
• CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in…

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-11135: TSX Asynchronous Abort condition (bsc#1139073).
• CVE-2023-52888: media: mediatek: vcodec: Only free buffer VA that is not NULL (bsc#1228557).
• CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
• CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
• CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
• CVE-2024-49568: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg (bsc#1235728).
• CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
• CVE-2024-57982: xfrm: state: fix out-of-bounds read during lookup (bsc#1237913).
• CVE-2024-58053: rxrpc: Fix handling of received connection abort (bsc#1238982).
• CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
• CVE-2025-38244: smb: client: fix potential deadlock when reconnecting channels (bsc#1246183).
• CVE-2025-38352: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (bsc#1246911).
• CVE-2025-38371: drm/v3d: Disable interrupts before resetting the GPU (bsc#1247178).
• CVE-2025-38392: idpf: convert control queue mutex to a spinlock (bsc#1247169).
• CVE-2025-38399: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (bsc#1247097).
• CVE-2025-38426: drm/amdgpu: Add basic validation for RAS header (bsc#1247252).
• CVE-2025-38457: net/sched: Abort __tc_modify_qdisc if parent class does not exist (bsc#1247098).
• CVE-2025-38460: atm: clip: Fix potential null-ptr-deref in to_atmarpd() (bsc#1247143).
• CVE-2025-38465: netlink: make sure we allow at least one dump skb (bsc#1247118).
• CVE-2025-38470: kABI fix for net: vlan: fix VLAN 0 refcount imbalance of toggling (bsc#1247288).
• CVE-2025-38471: tls: always refresh the queue when reading sock (bsc#1247450).
• CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
• CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247374).
• CVE-2025-21720: xfrm: delete intermediate secpath entry in packet offload mode (bsc#1238859).
• CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21868: kABI workaround for adding an header (bsc#1240180).
• CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
• CVE-2025-21898: ftrace: Avoid potential division by zero in function_stat_show() (bsc#1240610).
• CVE-2025-21899: tracing: Fix bad hist from corrupting named_triggers list (bsc#1240577).
• CVE-2025-21920: vlan: enforce underlying device type (bsc#1240686).
• CVE-2025-21938: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr (bsc#1240723).
• CVE-2025-21959: netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() (bsc#1240814).
• CVE-2025-21997: xsk: fix an integer overflow in xp_create_and_assign_umem() (bsc#1240823).
• CVE-2025-22035: tracing: Fix use-after-free in print_graph_function_flags during tracer switching (bsc#1241544).
• CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
• CVE-2025-22111: kABI fix for net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF (bsc#1241572).
• CVE-2025-22113: ext4: define ext4_journal_destroy wrapper (bsc#1241617).
• CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
• CVE-2025-23163: net:…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
• CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
• CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
• CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
• CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
• CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
• CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
• CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
• CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
• CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
• CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
• CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
• CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
• CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
• CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
• CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
• CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
• CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
• CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
• CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
• CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
• CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
• CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).
• CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).
• CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).
• CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
• CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
• CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
• CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
• CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (1230216).
• CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
• CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
• CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
• CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
• CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
• CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
• CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
• CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
• CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
• CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
• CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
• CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
• CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
• CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
• CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
• CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
• CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
• CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
• CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
• CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).
• CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).
• CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).
• CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
• CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
• CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in…