CVE-2025-38527

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break() _cifsFileInfo_put(cfile) cifsFileInfo_put_final() cifs_sb_deactive() [last ref, start releasing sb] kill_sb() kill_anon_super() generic_shutdown_super() evict_inodes() dispose_list() evict() destroy_inode() call_rcu(&inode->i_rcu, i_callback) spin_lock(&cinode->open_file_lock) <- OK [later] i_callback() cifs_free_inode() kmem_cache_free(cinode) spin_unlock(&cinode->open_file_lock) <- UAF cifs_done_oplock_break(cinode) <- UAF The issue occurs when umount has already released its reference to the superblock. When _cifsFileInfo_put() calls cifs_sb_deactive(), this releases the last reference, triggering the immediate cleanup of all inodes under RCU. However, cifs_oplock_break() continues to access the cinode after this point, resulting in use-after-free. Fix this by holding an extra reference to the superblock during the entire oplock break operation. This ensures that the superblock and its inodes remain valid until the oplock break completes.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ext4: update s_journal_inum if it changes after journal replay

When mounting a crafted ext4 image, s_journal_inum may change after journal replay, which is obviously unreasonable because we have successfully loaded and replayed the journal through the old s_journal_inum. And the new s_journal_inum bypasses some of the checks in ext4_get_journal(), which may trigger a null pointer dereference problem. So if s_journal_inum changes after the journal replay, we ignore the change, and rewrite the current journal_inum to the superblock.(CVE-2023-53091)

In the Linux kernel, the following vulnerability has been resolved:

vxlan: Fix nexthop hash size

The nexthop code expects a 31 bit hash, such as what is returned by fib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash returned by skb_get_hash() can lead to problems related to the fact that 'int hash' is a negative number when the MSB is set.

In the case of hash threshold nexthop groups, nexthop_select_path_hthr() will disproportionately select the first nexthop group entry. In the case of resilient nexthop groups, nexthop_select_path_res() may do an out of bounds access in nh_buckets[], for example: hash = -912054133 num_nh_buckets = 2 bucket_index = 65535

which leads to the following panic:

BUG: unable to handle page fault for address: ffffc900025910c8 PGD 100000067 P4D 100000067 PUD 10026b067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 4 PID: 856 Comm: kworker/4:3 Not tainted 6.5.0-rc2+ #34 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:nexthop_select_path+0x197/0xbf0 Code: c1 e4 05 be 08 00 00 00 4c 8b 35 a4 14 7e 01 4e 8d 6c 25 00 4a 8d 7c 25 08 48 01 dd e8 c2 25 15 ff 49 8d 7d 08 e8 39 13 15 ff <4d> 89 75 08 48 89 ef e8 7d 12 15 ff 48 8b 5d 00 e8 14 55 2f 00 85 RSP: 0018:ffff88810c36f260 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000002000c0 RCX: ffffffffaf02dd77 RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffc900025910c8 RBP: ffffc900025910c0 R08: 0000000000000001 R09: fffff520004b2219 R10: ffffc900025910cf R11: 31392d2068736168 R12: 00000000002000c0 R13: ffffc900025910c0 R14: 00000000fffef608 R15: ffff88811840e900 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc900025910c8 CR3: 0000000129d00000 CR4: 0000000000750ee0 PKRU: 55555554 Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x1ee/0x5c0 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ? __pfx_page_fault_oops+0x10/0x10 ? search_bpf_extables+0xfe/0x1c0 ? fixup_exception+0x3b/0x470 ? exc_page_fault+0xf6/0x110 ? asm_exc_page_fault+0x26/0x30 ? nexthop_select_path+0x197/0xbf0 ? nexthop_select_path+0x197/0xbf0 ? lock_is_held_type+0xe7/0x140 vxlan_xmit+0x5b2/0x2340 ? __lock_acquire+0x92b/0x3370 ? __pfx_vxlan_xmit+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 ? __pfx_register_lock_class+0x10/0x10 ? skb_network_protocol+0xce/0x2d0 ? dev_hard_start_xmit+0xca/0x350 ? __pfx_vxlan_xmit+0x10/0x10 dev_hard_start_xmit+0xca/0x350 __dev_queue_xmit+0x513/0x1e20 ? __pfx___dev_queue_xmit+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? mark_held_locks+0x44/0x90 ? skb_push+0x4c/0x80 ? eth_header+0x81/0xe0 ? __pfx_eth_header+0x10/0x10 ? neigh_resolve_output+0x215/0x310 ? ip6_finish_output2+0x2ba/0xc90 ip6_finish_output2+0x2ba/0xc90 ? lock_release+0x236/0x3e0 ? ip6_mtu+0xbb/0x240 ? __pfx_ip6_finish_output2+0x10/0x10 ? find_held_lock+0x83/0xa0 ? lock_is_held_type+0xe7/0x140 ip6_finish_output+0x1ee/0x780 ip6_output+0x138/0x460 ? __pfx_ip6_output+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 ? __pfx_ip6_finish_output+0x10/0x10 NF_HOOK.constprop.0+0xc0/0x420 ? __pfx_NF_HOOK.constprop.0+0x10/0x10 ?…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ext4: update s_journal_inum if it changes after journal replay

When mounting a crafted ext4 image, s_journal_inum may change after journal replay, which is obviously unreasonable because we have successfully loaded and replayed the journal through the old s_journal_inum. And the new s_journal_inum bypasses some of the checks in ext4_get_journal(), which may trigger a null pointer dereference problem. So if s_journal_inum changes after the journal replay, we ignore the change, and rewrite the current journal_inum to the superblock.(CVE-2023-53091)

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write

During the sysfs firmware write process, a use-after-free read warning is logged from the lpfc_wr_object() routine:

BUG: KFENCE: use-after-free read in lpfc_wr_object+0x235/0x310 [lpfc] Use-after-free read at 0x0000000000cf164d (in kfence-#111): lpfc_wr_object+0x235/0x310 [lpfc] lpfc_write_firmware.cold+0x206/0x30d [lpfc] lpfc_sli4_request_firmware_update+0xa6/0x100 [lpfc] lpfc_request_firmware_upgrade_store+0x66/0xb0 [lpfc] kernfs_fop_write_iter+0x121/0x1b0 new_sync_write+0x11c/0x1b0 vfs_write+0x1ef/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x59/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The driver accessed wr_object pointer data, which was initialized into mailbox payload memory, after the mailbox object was released back to the mailbox pool.

Fix by moving the mailbox free calls to the end of the routine ensuring that we don't reference internal mailbox memory after release.(CVE-2023-53282)

In the Linux kernel, the following vulnerability has been resolved:

start_kernel: Add __no_stack_protector function attribute

Back during the discussion of commit a9a3ed1eff36 ("x86: Fix early boot crash on gcc-10, third try") we discussed the need for a function attribute to control the omission of stack protectors on a per-function basis; at the time Clang had support for no_stack_protector but GCC did not. This was fixed in gcc-11. Now that the function attribute is available, let's start using it.

Callers of boot_init_stack_canary need to use this function attribute unless they're compiled with -fno-stack-protector, otherwise the canary stored in the stack slot of the caller will differ upon the call to boot_init_stack_canary. This will lead to a call to __stack_chk_fail() then panic.(CVE-2023-53491)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix hci_suspend_sync crash

If hci_unregister_dev() frees the hci_dev object but hci_suspend_notifier may still be accessing it, it can cause the program to crash. Here's the call trace: <4>[102152.653246] Call Trace: <4>[102152.653254] hci_suspend_sync+0x109/0x301 [bluetooth] <4>[102152.653259] hci_suspend_dev+0x78/0xcd [bluetooth] <4>[102152.653263] hci_suspend_notifier+0x42/0x7a [bluetooth] <4>[102152.653268] notifier_call_chain+0x43/0x6b <4>[102152.653271] __blocking_notifier_call_chain+0x48/0x69 <4>[102152.653273] __pm_notifier_call_chain+0x22/0x39 <4>[102152.653276] pm_suspend+0x287/0x57c <4>[102152.653278] state_store+0xae/0xe5 <4>[102152.653281] kernfs_fop_write+0x109/0x173 <4>[102152.653284] __vfs_write+0x16f/0x1a2 <4>[102152.653287] ? selinux_file_permission+0xca/0x16f <4>[102152.653289] ? security_file_permission+0x36/0x109 <4>[102152.653291] vfs_write+0x114/0x21d <4>[102152.653293] __x64_sys_write+0x7b/0xdb <4>[102152.653296] do_syscall_64+0x59/0x194 <4>[102152.653299] entry_SYSCALL_64_after_hwframe+0x5c/0xc1

This patch holds the reference count of the hci_dev object while processing it in…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: Fix uninit-value in nci_rx_work

syzbot reported the following uninit-value access issue [1]

nci_rx_work() parses received packet from ndev->rx_q. It should be validated header size, payload size and total packet size before processing the packet. If an invalid packet is detected, it should be silently discarded.(CVE-2024-38381)

In the Linux kernel, the following vulnerability has been resolved:net: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe()In the prueth_probe() function, if one of the calls to emac_phy_connect()fails due to of_phy_connect() returning NULL, then the subsequent call tophy_attached_info() will dereference a NULL pointer.Check the return code of emac_phy_connect and fail cleanly if there is anerror.(CVE-2024-38584)

In the Linux kernel, the following vulnerability has been resolved:cpufreq: exit() callback is optionalThe exit() callback is optional and shouldn t be called without checkinga valid pointer first.Also, we must clear freq_table pointer even if the exit() callback isn tpresent.(CVE-2024-38615)

In the Linux kernel, the following vulnerability has been resolved:serial: max3100: Update uart_driver_registered on driver removalThe removal of the last MAX3100 device triggers the removal ofthe driver. However, code doesn t update the respective globalvariable and after insmod — rmmod — insmod cycle the kerneloopses: max3100 spi-PRP0001:01: max3100_probe: adding port 0 BUG: kernel NULL pointer dereference, address: 0000000000000408 ... RIP: 0010:serial_core_register_port+0xa0/0x840 ... max3100_probe+0x1b6/0x280 [max3100] spi_probe+0x8d/0xb0Update the actual state so next time UART driver will be registeredagain.Hugo also noticed, that the error path in the probe also affectedby having the variable set, and not cleared. Instead of clearing itmove the assignment after the successfull uart_register_driver() call.(CVE-2024-38633)

In the Linux kernel, the following vulnerability has been resolved:

enic: Validate length of nl attributes in enic_set_vf_port

enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE is of length PORT_PROFILE_MAX and that the nl attributes IFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID are of length PORT_UUID_MAX. These attributes are validated (in the function do_setlink in rtnetlink.c) using the nla_policy ifla_port_policy. The policy defines IFLA_PORT_PROFILE as NLA_STRING, IFLA_PORT_INSTANCE_UUID as NLA_BINARY and IFLA_PORT_HOST_UUID as NLA_STRING. That means that the length validation using the policy is for the max size of the attributes and not on exact size so the length of these attributes might be less than the sizes that enic_set_vf_port expects. This might cause an out of bands read access in the memcpys of the data of these attributes in enic_set_vf_port.(CVE-2024-38659)

In the Linux kernel, the following vulnerability has been resolved:riscv: prevent pt_regs corruption for secondary idle threadsTop of the kernel thread stack should be reserved for pt_regs. Howeverthis is not the case for the idle threads of the secondary boot harts.Their stacks overlap with their pt_regs, so both may get corrupted.Similar issue has been fixed for the primary hart, see c7cdd96eca28( riscv: prevent stack corruption by reserving task_pt_regs(p) early ).However that fix was not propagated to the secondary harts. The problemhas been noticed in some CPU hotplug tests with V enabled. The functionsmp_callin stored several registers on stack, corrupting top of pt_regsstructure including status field. As a result, kernel attempted to saveor restore inexistent V context.(CVE-2024-38667)

In the Linux kernel, the following vulnerability has been resolved:jfs: xattr: fix buffer overflow for invalid xattrWhen an xattr size is not what is expected, it is printed out to thekernel log in hex format as a…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint

Patch series "nilfs2: fix null-ptr-deref bugs on block tracepoints".

This series fixes null pointer dereference bugs that occur when using nilfs2 and two block-related tracepoints.

This patch (of 2):

It has been reported that when using "block:block_touch_buffer" tracepoint, touch_buffer() called from __nilfs_get_folio_block() causes a NULL pointer dereference, or a general protection fault when KASAN is enabled.

This happens because since the tracepoint was added in touch_buffer(), it references the dev_t member bh->b_bdev->bd_dev regardless of whether the buffer head has a pointer to a block_device structure. In the current implementation, the block_device structure is set after the function returns to the caller.

Here, touch_buffer() is used to mark the folio/page that owns the buffer head as accessed, but the common search helper for folio/page used by the caller function was optimized to mark the folio/page as accessed when it was reimplemented a long time ago, eliminating the need to call touch_buffer() here in the first place.

So this solves the issue by eliminating the touch_buffer() call itself.(CVE-2024-53131)

In the Linux kernel, the following vulnerability has been resolved:drm: adv7511: Fix use-after-free in adv7533_attach_dsi()The host_node pointer was assigned and freed in adv7533_parse_dt(), andlater, adv7533_attach_dsi() uses the same. Fix this use-after-free issueby dropping of_node_put() in adv7533_parse_dt() and calling of_node_put()in error path of probe() and also in the remove().(CVE-2024-57887)

In the Linux kernel, the following vulnerability has been resolved:ila: serialize calls to nf_register_net_hooks()syzbot found a race in ila_add_mapping() [1]commit 031ae72825ce ( ila: call nf_unregister_net_hooks() sooner )attempted to fix a similar issue.Looking at the syzbot repro, we have concurrent ILA_CMD_ADD commands.Add a mutex to make sure at most one thread is calling nf_register_net_hooks().[1] BUG: KASAN: slab-use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] BUG: KASAN: slab-use-after-free in __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604Read of size 4 at addr ffff888028f40008 by task dhcpcd/5501CPU: 1 UID: 0 PID: 5501 Comm: dhcpcd Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024Call Trace: <IRQ> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xc3/0x620 mm/kasan/report.c:489 kasan_report+0xd9/0x110 mm/kasan/report.c:602 rht_key_hashfn include/linux/rhashtable.h:159 [inline] __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604 rhashtable_lookup include/linux/rhashtable.h:646 [inline] rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline] ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:127 [inline] ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline] ila_nf_input+0x1ee/0x620 net/ipv6/ila/ila_xlat.c:185 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xbb/0x200 net/netfilter/core.c:626 nf_hook.constprop.0+0x42e/0x750 include/linux/netfilter.h:269 NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0xa4/0x680 net/ipv6/ip6_input.c:309 __netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5672 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5785 process_backlog+0x443/0x15f0 net/core/dev.c:6117 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6883 napi_poll net/core/dev.c:6952 [inline] net_rx_action+0xa94/0x1010 net/core/dev.c:7074 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix slab-use-after-free on hdcp_work

[Why] A slab-use-after-free is reported when HDCP is destroyed but the property_validate_dwork queue is still running.

[How] Cancel the delayed work when destroying workqueue.

(cherry picked from commit 725a04ba5a95e89c89633d4322430cfbca7ce128)(CVE-2025-21968)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: put dl_stid if fail to queue dl_recall

Before calling nfsd4_run_cb to queue dl_recall to the callback_wq, we increment the reference count of dl_stid. We expect that after the corresponding work_struct is processed, the reference count of dl_stid will be decremented through the callback function nfsd4_cb_recall_release. However, if the call to nfsd4_run_cb fails, the incremented reference count of dl_stid will not be decremented correspondingly, leading to the following nfs4_stid leak: unreferenced object 0xffff88812067b578 (size 344): comm "nfsd", pid 2761, jiffies 4295044002 (age 5541.241s) hex dump (first 32 bytes): 01 00 00 00 6b 6b 6b 6b b8 02 c0 e2 81 88 ff ff ....kkkk........ 00 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 ad 4e ad de .kkkkkkk.....N.. backtrace: kmem_cache_alloc+0x4b9/0x700 nfsd4_process_open1+0x34/0x300 nfsd4_open+0x2d1/0x9d0 nfsd4_proc_compound+0x7a2/0xe30 nfsd_dispatch+0x241/0x3e0 svc_process_common+0x5d3/0xcc0 svc_process+0x2a3/0x320 nfsd+0x180/0x2e0 kthread+0x199/0x1d0 ret_from_fork+0x30/0x50 ret_from_fork_asm+0x1b/0x30 unreferenced object 0xffff8881499f4d28 (size 368): comm "nfsd", pid 2761, jiffies 4295044005 (age 5541.239s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 30 4d 9f 49 81 88 ff ff ........0M.I.... 30 4d 9f 49 81 88 ff ff 20 00 00 00 01 00 00 00 0M.I.... ....... backtrace: kmem_cache_alloc+0x4b9/0x700 nfs4_alloc_stid+0x29/0x210 alloc_init_deleg+0x92/0x2e0 nfs4_set_delegation+0x284/0xc00 nfs4_open_delegation+0x216/0x3f0 nfsd4_process_open2+0x2b3/0xee0 nfsd4_open+0x770/0x9d0 nfsd4_proc_compound+0x7a2/0xe30 nfsd_dispatch+0x241/0x3e0 svc_process_common+0x5d3/0xcc0 svc_process+0x2a3/0x320 nfsd+0x180/0x2e0 kthread+0x199/0x1d0 ret_from_fork+0x30/0x50 ret_from_fork_asm+0x1b/0x30 Fix it by checking the result of nfsd4_run_cb and call nfs4_put_stid if fail to queue dl_recall.(CVE-2025-22025)

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: add bounds check for create lease context

Add missing bounds check for create lease context.(CVE-2025-22042)

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: add bounds check for durable handle context

Add missing bounds check for durable handle context.(CVE-2025-22043)

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation

Currently during the multi-link element defragmentation process, the multi-link element length added to the total IEs length when calculating the length of remaining IEs after the multi-link element in cfg80211_defrag_mle(). This could lead to out-of-bounds access if the multi-link element or its corresponding fragment elements are the last elements in the IEs buffer.

To address this issue, correctly calculate the remaining IEs length by deducting the multi-link element end offset from total IEs end offset.(CVE-2025-37973)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: Always pass notifications when child class becomes empty

Certain classful qdiscs may invoke their classes' dequeue handler on an enqueue operation. This may unexpectedly empty the child qdisc and thus make an in-flight class passive via qlen_notify(). Most qdiscs do not expect such behaviour at this point…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472)

• kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)

• kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

• kernel: tls: fix handling of zero-length records on the rx_list (CVE-2025-39682)

• kernel: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396)

• kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)

• kernel: cifs: Fix the smbd_response slab to allow usercopy (CVE-2025-38523)

• kernel: tls: fix handling of zero-length records on the rx_list (CVE-2025-39682)

• kernel: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698)

• kernel: s390/sclp: Fix SCCB present check (CVE-2025-39694)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2025-38527 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2025-38527 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-38527 in the linux package for Root:Debian:13. Multiple fixed versions available.

Root has patched CVE-2025-38527 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2025-38527 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break() _cifsFileInfo_put(cfile) cifsFileInfo_put_final() cifs_sb_deactive() [last ref, start releasing sb] kill_sb() kill_anon_super() generic_shutdown_super() evict_inodes() dispose_list() evict() destroy_inode() call_rcu(&inode->i_rcu, i_callback) spin_lock(&cinode->open_file_lock) <- OK [later] i_callback() cifs_free_inode() kmem_cache_free(cinode) spin_unlock(&cinode->open_file_lock) <- UAF cifs_done_oplock_break(cinode) <- UAF The issue occurs when umount has already released its reference to the superblock. When _cifsFileInfo_put() calls cifs_sb_deactive(), this releases the last reference, triggering the immediate cleanup of all inodes under RCU. However, cifs_oplock_break() continues to access the cinode after this point, resulting in use-after-free. Fix this by holding an extra reference to the superblock during the entire oplock break operation. This ensures that the superblock and its inodes remain valid until the oplock break completes.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472)
• kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)
• kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)
• kernel: tls: fix handling of zero-length records on the rx_list (CVE-2025-39682)
• kernel: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396)
• kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)
• kernel: cifs: Fix the smbd_response slab to allow usercopy (CVE-2025-38523)
• kernel: tls: fix handling of zero-length records on the rx_list (CVE-2025-39682)
• kernel: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698)
• kernel: s390/sclp: Fix SCCB present check (CVE-2025-39694)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)
• kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)
• kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix use-after-free in cifs_oplock_break

A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting:

cifs_oplock_break() _cifsFileInfo_put(cfile) cifsFileInfo_put_final() cifs_sb_deactive() [last ref, start releasing sb] kill_sb() kill_anon_super() generic_shutdown_super() evict_inodes() dispose_list() evict() destroy_inode() call_rcu(&inode->i_rcu, i_callback) spin_lock(&cinode->open_file_lock) <- OK [later] i_callback() cifs_free_inode() kmem_cache_free(cinode) spin_unlock(&cinode->open_file_lock) <- UAF cifs_done_oplock_break(cinode) <- UAF

The issue occurs when umount has already released its reference to the superblock. When _cifsFileInfo_put() calls cifs_sb_deactive(), this releases the last reference, triggering the immediate cleanup of all inodes under RCU. However, cifs_oplock_break() continues to access the cinode after this point, resulting in use-after-free.

Fix this by holding an extra reference to the superblock during the entire oplock break operation. This ensures that the superblock and its inodes remain valid until the oplock break completes.

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix use-after-free in cifs_oplock_break

A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting:

cifs_oplock_break() _cifsFileInfo_put(cfile) cifsFileInfo_put_final() cifs_sb_deactive() [last ref, start releasing sb] kill_sb() kill_anon_super() generic_shutdown_super() evict_inodes() dispose_list() evict() destroy_inode() call_rcu(&inode->i_rcu, i_callback) spin_lock(&cinode->open_file_lock) <- OK [later] i_callback() cifs_free_inode() kmem_cache_free(cinode) spin_unlock(&cinode->open_file_lock) <- UAF cifs_done_oplock_break(cinode) <- UAF

The issue occurs when umount has already released its reference to the superblock. When _cifsFileInfo_put() calls cifs_sb_deactive(), this releases the last reference, triggering the immediate cleanup of all inodes under RCU. However, cifs_oplock_break() continues to access the cinode after this point, resulting in use-after-free.

Fix this by holding an extra reference to the superblock during the entire oplock break operation. This ensures that the superblock and its inodes remain valid until the oplock break completes.

• locking/ww_mutex/test: Fix potential workqueue corruption {CVE-2023-52836}
• netfilter: ipset: Fix suspicious rcu_dereference_protected() {CVE-2024-40993}
• netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type {CVE-2024-39503}
• netfilter: ipset: Missing gc cancellations fixed {CVE-2024-39503}
• netfilter: ipset: Add list flush to cancel_gc {CVE-2024-39503}
• netfilter: ipset: fix performance regression in swap operation {CVE-2024-26910}
• netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test {CVE-2024-26910}
• scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521}
• scsi: mpt3sas: Fix a memory leak {CVE-2023-53512}
• scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() {CVE-2023-53464}
• wifi: ath11k: fix deinitialization of firmware resources {CVE-2023-53532}
• mt76: mt7915: Fix PCI device refcount leak in mt7915_pci_init_hif2() {CVE-2022-50464}
• ionic: catch failure from devlink_alloc {CVE-2023-53470}
• enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659}
• gpiolib: cdev: fix uninitialised kfifo {CVE-2024-36898}
• Bluetooth: hci_conn: Fix crash on hci_create_cis_sync {CVE-2022-50447}
• net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP {CVE-2024-36974}
• ext4: Fix function prototype mismatch for ext4_feat_ktype {CVE-2023-53224}
• ipv6: Add lwtunnel encap size of all siblings in nexthop calculation {CVE-2023-53477}
• netfilter: nf_tables: prefer nft_chain_validate {CVE-2024-41042}
• netfilter: nf_conntrack: fix crash due to removal of uninitialised entry {CVE-2025-38472}
• Bluetooth: qca: add missing firmware sanity checks {CVE-2024-36880}
• Bluetooth: qca: fix info leak when fetching fw build id {CVE-2024-36032}
• Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297}
• drm/amd/display: Skip finding free audio for unknown engine_id {CVE-2024-42119}
• drm/dp_mst: Fix resetting msg rx state after topology removal {CVE-2024-57876}
• drm/vc4: don't check if plane->state->fb == state->fb {CVE-2024-35932}
• drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create {CVE-2023-53263}
• cifs: fix oops during encryption {CVE-2022-50341}
• smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527}
• smb: client: fix race with concurrent opens in rename(2) {CVE-2025-39825}
• ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx->headset_codec_dev = NULL {CVE-2023-52697}
• blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none {CVE-2023-53292}
• mlx5: fix possible ptp queue fifo use-after-free {CVE-2023-53398}
• sctp: check send stream number after wait_for_sndbuf {CVE-2023-53296}
• sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• scsi: mpi3mr: Use number of bits to manage bitmap sizes {CVE-2023-53376}
• scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue {CVE-2023-53280}
• mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data {CVE-2023-53232}
• wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes {CVE-2023-53185}
• fbdev: Fix invalid page access after closing deferred I/O devices {CVE-2023-52731}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value {CVE-2022-50327}
• media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() {CVE-2023-53220}
• media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() {CVE-2022-50272}

• wifi: mwifiex: Fix OOB and integer underflow when rx packets {CVE-2023-53226} {CVE-2023-53226}
• wifi: mac80211: check S1G action frame size {CVE-2023-53257} {CVE-2023-53257}
• wifi: cfg80211: fix use-after-free in cmp_bss() {CVE-2025-39864} {CVE-2025-39864}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772} {CVE-2025-21772}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014} {CVE-2024-58014}
• wifi: at76c50x: fix use after free access in at76_disconnect {CVE-2025-37796} {CVE-2025-37796}
• dma-direct: Leak pages on dma_set_decrypted() failure {CVE-2024-35939} {CVE-2024-35939}
• Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386} {CVE-2022-50386}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817} {CVE-2025-39817}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937} {CVE-2024-35937}
• nfs: fix UAF in direct writes {CVE-2024-26958} {CVE-2024-26958}
• wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921} {CVE-2024-36921}
• net/smc: avoid data corruption caused by decline {CVE-2023-52775} {CVE-2023-52775}
• bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() {CVE-2024-39487} {CVE-2024-39487}
• scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978} {CVE-2024-40978}
• mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961} {CVE-2024-26961}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864} {CVE-2023-52864}
• net/sched: act_mirred: don't override retval if we already lost the skb {CVE-2024-26739} {CVE-2024-26739}
• drm/dp_mst: Fix resetting msg rx state after topology removal {CVE-2024-57876} {CVE-2024-57876}
• net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556} {CVE-2024-38556}
• of: Fix double free in of_parse_phandle_with_args_map {CVE-2023-52679} {CVE-2023-52679}
• xhci: Handle TD clearing for multiple streams case {CVE-2024-40927} {CVE-2024-40927}
• wifi: mac80211: fix potential key use-after-free {CVE-2023-52530} {CVE-2023-52530}
• net: openvswitch: Fix Use-After-Free in ovs_ct_exit {CVE-2024-27395} {CVE-2024-27395}
• r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586} {CVE-2024-38586}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764} {CVE-2023-52764}
• media: bttv: fix use after free error due to btv->timeout timer {CVE-2023-52847} {CVE-2023-52847}
• vsock: Fix transport_* TOCTOU {CVE-2025-38461} {CVE-2025-38461}
• ppdev: Add an error check in register_device {CVE-2024-36015} {CVE-2024-36015}
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556} {CVE-2025-38556}
• iio: adc: at91: call input_free_device() on allocated iio_dev {CVE-2024-57904} {CVE-2024-57904}
• perf/aux: Fix AUX buffer serialization {CVE-2024-46713} {CVE-2024-46713}
• net_sched: hfsc: Fix a UAF vulnerability in class handling {CVE-2025-37797} {CVE-2025-37797}
• wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072} {CVE-2024-58072}
• wifi: rtlwifi: remove unused dualmac control leftovers {CVE-2024-58072} {CVE-2024-58072}
• wifi: rtlwifi: remove unused timer and related code {CVE-2024-58072} {CVE-2024-58072}
• ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() {CVE-2025-22121} {CVE-2025-22121}
• ext4: move where set the MAY_INLINE_DATA flag is set {CVE-2025-22121} {CVE-2025-22121}
• ext4: introduce ITAIL helper {CVE-2025-22121} {CVE-2025-22121}
• ext4: improve xattr consistency checking and error reporting {CVE-2025-22121} {CVE-2025-22121}
• mm: fix zswap writeback race condition {CVE-2023-53178} {CVE-2023-53178}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-50367} {CVE-2022-50367}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757} {CVE-2025-39757}
• smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527} {CVE-2025-38527} -…

• media: bttv: fix use after free error due to btv->timeout timer {CVE-2023-52847} {CVE-2023-52847}
• firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails {CVE-2022-50087} {CVE-2022-50087}
• wifi: mwifiex: Fix OOB and integer underflow when rx packets {CVE-2023-53226} {CVE-2023-53226}
• vsock: Fix transport_* TOCTOU {CVE-2025-38461} {CVE-2025-38461}
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757} {CVE-2025-39757}
• locking/ww_mutex/test: Fix potential workqueue corruption {CVE-2023-52836} {CVE-2023-52836}
• media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621} {CVE-2024-38621}
• ath10k: skip ath10k_halt during suspend for driver state RESTARTING {CVE-2022-49519} {CVE-2022-49519}
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() {CVE-2022-48738} {CVE-2022-48738}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772} {CVE-2025-21772}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292} {CVE-2022-49292}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704} {CVE-2025-21704}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214} {CVE-2024-53214}
• ppdev: Add an error check in register_device {CVE-2024-36015} {CVE-2024-36015}
• scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675} {CVE-2023-53675}
• enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659} {CVE-2024-38659}
• dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929} {CVE-2024-57929}
• dlm: fix plock invalid read {CVE-2022-49407} {CVE-2022-49407}
• rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev {CVE-2022-48759} {CVE-2022-48759}
• bpf: Don't use tnum_range on array range checking for poke descriptors {CVE-2022-49985} {CVE-2022-49985}
• net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001} {CVE-2025-38001}
• wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes {CVE-2023-53185} {CVE-2023-53185}
• dm integrity: fix memory corruption when tag_size is less than digest size {CVE-2022-49044} {CVE-2022-49044}
• drm/radeon: possible buffer overflow {CVE-2023-52867} {CVE-2023-52867}
• ata: sata_dwc_460ex: Fix crash due to OOB write {CVE-2022-49073} {CVE-2022-49073}
• fs/jfs: Add validity check for db_maxag and db_agpref {CVE-2023-52804} {CVE-2023-52804}
• net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581} {CVE-2023-53581}
• thermal: core: prevent potential string overflow {CVE-2023-52868} {CVE-2023-52868}
• ACPI: CPPC: Avoid out of bounds access when parsing _CPC data {CVE-2022-49145} {CVE-2022-49145}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817} {CVE-2025-39817}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332} {CVE-2024-52332}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498} {CVE-2025-38498}
• drm/amd/display: Skip finding free audio for unknown engine_id {CVE-2024-42119} {CVE-2024-42119}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408} {CVE-2022-50408}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014} {CVE-2024-58014}
• wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229} {CVE-2023-53229}
• ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570} {CVE-2024-56570}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125} {CVE-2023-53125}
• net: stmmac: fix dma queue left shift overflow issue {CVE-2022-49592} {CVE-2022-49592}
• iio: adc: at91: call input_free_device() on allocated iio_dev {CVE-2024-57904} {CVE-2024-57904}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373} {CVE-2023-53373}
• sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718} {CVE-2025-38718}
• KVM: SVM: Don't BUG if userspace…

• media: bttv: fix use after free error due to btv->timeout timer {CVE-2023-52847}
• firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails {CVE-2022-50087}
• wifi: mwifiex: Fix OOB and integer underflow when rx packets {CVE-2023-53226}
• vsock: Fix transport_* TOCTOU {CVE-2025-38461}
• ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
• perf/aux: Fix AUX buffer serialization {CVE-2024-46713}
• locking/ww_mutex/test: Fix potential workqueue corruption {CVE-2023-52836}
• media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621}
• ath10k: skip ath10k_halt during suspend for driver state RESTARTING {CVE-2022-49519}
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() {CVE-2022-48738}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
• ppdev: Add an error check in register_device {CVE-2024-36015}
• scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
• enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659}
• dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929}
• dlm: fix plock invalid read {CVE-2022-49407}
• rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev {CVE-2022-48759}
• bpf: Don't use tnum_range on array range checking for poke descriptors {CVE-2022-49985}
• net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001}
• wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes {CVE-2023-53185}
• dm integrity: fix memory corruption when tag_size is less than digest size {CVE-2022-49044}
• drm/radeon: possible buffer overflow {CVE-2023-52867}
• ata: sata_dwc_460ex: Fix crash due to OOB write {CVE-2022-49073}
• fs/jfs: Add validity check for db_maxag and db_agpref {CVE-2023-52804}
• net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581}
• thermal: core: prevent potential string overflow {CVE-2023-52868}
• ACPI: CPPC: Avoid out of bounds access when parsing _CPC data {CVE-2022-49145}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
• drm/amd/display: Skip finding free audio for unknown engine_id {CVE-2024-42119}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229}
• ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
• net: stmmac: fix dma queue left shift overflow issue {CVE-2022-49592}
• iio: adc: at91: call input_free_device() on allocated iio_dev {CVE-2024-57904}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
• sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
• KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 {CVE-2022-50228}
• soundwire: cadence: fix invalid PDI offset {CVE-2024-38635}
• wifi: at76c50x: fix use after free access in at76_disconnect {CVE-2025-37796}
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans {CVE-2023-53034}
• Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297}
• scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695}
• smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527}
• NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730}
• scsi:…

• CVE-2025-38699
  • scsi: bfa: Double-free fix {CVE-2025-38699}
• CVE-2025-38697
  • jfs: upper bound check of tree index in dbAllocAG {CVE-2025-38697}
• CVE-2025-39823
  • KVM: x86: use array_index_nospec with indices that come from guest {CVE-2025-39823}
• CVE-2025-39689
  • ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
• CVE-2025-39749
  • rcu: Protect ->defer_qs_iw_pending from data race {CVE-2025-39749}
• CVE-2025-38728
  • smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
• CVE-2025-38676
  • iommu/amd: Avoid stack buffer overflow from kernel cmdline {CVE-2025-38676}
• CVE-2025-38574
  • pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
• CVE-2025-38572
  • ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
• CVE-2025-38685
  • fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
• CVE-2025-38563
  • vm_ops: rename .split() callback to .may_split() {CVE-2025-38563}
  • perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563}
• CVE-2025-38702
  • fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• CVE-2025-39911
  • i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• CVE-2025-39971
  • i40e: fix idx validation in config queues msg {CVE-2025-39971}
• CVE-2025-40154
  • ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping {CVE-2025-40154}
• CVE-2025-39973
  • i40e: increase max descriptors for XL710 {CVE-2025-39973}
  • i40e: add validation for ring_len param {CVE-2025-39973}
• CVE-2022-49026
  • e100: Fix possible use after free in e100_xmit_prepare {CVE-2022-49026}
• CVE-2025-38724
  • nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• CVE-2025-39853
  • i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• CVE-2025-39860
  • Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
• CVE-2025-39891
  • wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
• CVE-2025-38530
  • comedi: pcl812: Fix bit shift out of bounds {CVE-2025-38530}
• CVE-2025-38529
  • comedi: aio_iiro_16: Fix bit shift out of bounds {CVE-2025-38529}
• CVE-2025-38497
  • usb: gadget: configfs: Fix OOB read on empty string write {CVE-2025-38497}
• CVE-2025-38483
  • comedi: das16m1: Fix bit shift out of bounds {CVE-2025-38483}
• CVE-2025-38482
  • comedi: das6402: Fix bit shift out of bounds {CVE-2025-38482}
• CVE-2025-39702
  • ipv6: sr: Fix MAC comparison to be constant-time {CVE-2025-39702}
• CVE-2025-39730
  • NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730}
• CVE-2025-39841
  • scsi: lpfc: Fix buffer free/clear order in deferred receive path {CVE-2025-39841}
• CVE-2025-39817
  • efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
• CVE-2025-38494
  • HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38494}
  • HID: core: ensure __hid_request reserves the report ID as the first byte {CVE-2025-38494}
  • HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• CVE-2025-39757
  • ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
• CVE-2025-38527
  • smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527}
• CVE-2023-52854
  • padata: Fix refcnt handling in padata_free_shell() {CVE-2023-52854}
• CVE-2024-35867
  • smb: client: fix potential UAF in cifs_stats_proc_show() {CVE-2024-35867}
• CVE-2024-50061
  • i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition {CVE-2024-50061}
• CVE-2025-39965 -…

• CVE-2023-53515
  • virtio-mmio: don't break lifecycle of vm_dev {CVE-2023-53515}
• CVE-2025-39967
  • fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
  • fbcon: Fix OOB access in font allocation {CVE-2025-39967}
• CVE-2025-38702
  • fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• CVE-2025-38563
  • perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563}
• CVE-2025-39869
  • dmaengine: ti: edma: Fix memory allocation size for queue_priority_map {CVE-2025-39869}
• CVE-2023-53577
  • bpf, cpumap: Make sure kthread is running before map update returns {CVE-2023-53577}
• CVE-2023-53608
  • nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() {CVE-2023-53608}
• CVE-2023-53604
  • dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path {CVE-2023-53604}
• CVE-2023-53619
  • netfilter: Replace printk() with pr_*() and define pr_fmt() {CVE-2023-53619}
  • netfilter: use kvmalloc_array to allocate memory for hashtable {CVE-2023-53619}
  • netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• CVE-2025-38680
  • media: uvcvideo: Fix 1-byte out-of-bounds read in {CVE-2025-38680}
• CVE-2023-53454
  • HID: multitouch: Correct devm device reference for hidinput {CVE-2023-53454}
• CVE-2025-38699
  • scsi: bfa: Double-free fix {CVE-2025-38699}
  • ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265}
  • scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
  • fs: jfs: Fix UBSAN: array-index-out-of-bounds in {CVE-2025-38699}
• CVE-2023-53596
  • drivers: base: Free devm resources when unregistering a {CVE-2023-53596}
• CVE-2023-53622
  • gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
  • HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition {CVE-2023-53622}
• CVE-2023-53090
  • drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
• CVE-2023-53116
  • nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
• CVE-2023-53138
  • net: caif: Fix use-after-free in cfusbl_device_notify() {CVE-2023-53138}
• CVE-2023-53035
  • nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() {CVE-2023-53035}
• CVE-2023-53668
  • ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• CVE-2023-53616
  • jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount {CVE-2023-53616}
• CVE-2023-53554
  • staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() {CVE-2023-53554}
• CVE-2023-53587
  • ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• CVE-2023-53541
  • mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write {CVE-2023-53541}
• CVE-2023-53559
  • ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559}
• CVE-2023-53484
  • lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
  • lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() {CVE-2023-53484}
• CVE-2025-39824
  • HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
• CVE-2025-38715
  • hfs: fix slab-out-of-bounds in hfs_bnode_read() {CVE-2025-38715}
• CVE-2023-53153
  • wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• CVE-2025-38555
  • usb: gadget : fix use-after-free in composite_dev_cleanup() {CVE-2025-38555}
• CVE-2025-39743
  • jfs: truncate good inode pages when hard link is 0 {CVE-2025-39743}
• CVE-2025-39945
  • cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945}
• CVE-2023-53506
  • udf: Do not bother merging very…

• Miscellaneous Ubuntu changes
  • update-from-bionic-master repo has been updated
• Miscellaneous upstream changes
  • debian: add control and changeg files [ Ubuntu: 4.15.0-254.265 ]
• CVE-2023-53515
  • virtio-mmio: don't break lifecycle of vm_dev {CVE-2023-53515}
• CVE-2025-39967
  • fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
  • fbcon: Fix OOB access in font allocation {CVE-2025-39967}
• CVE-2025-38702
  • fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• CVE-2025-38563
  • perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563}
• CVE-2025-39869
  • dmaengine: ti: edma: Fix memory allocation size for queue_priority_map {CVE-2025-39869}
• CVE-2023-53577
  • bpf, cpumap: Make sure kthread is running before map update returns {CVE-2023-53577}
• CVE-2023-53608
  • nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() {CVE-2023-53608}
• CVE-2023-53604
  • dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path {CVE-2023-53604}
• CVE-2023-53619
  • netfilter: Replace printk() with pr_*() and define pr_fmt() {CVE-2023-53619}
  • netfilter: use kvmalloc_array to allocate memory for hashtable {CVE-2023-53619}
  • netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• CVE-2025-38680
  • media: uvcvideo: Fix 1-byte out-of-bounds read in {CVE-2025-38680}
• CVE-2023-53454
  • HID: multitouch: Correct devm device reference for hidinput {CVE-2023-53454}
• CVE-2025-38699
  • scsi: bfa: Double-free fix {CVE-2025-38699}
  • ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265}
  • scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
  • fs: jfs: Fix UBSAN: array-index-out-of-bounds in {CVE-2025-38699}
• CVE-2023-53596
  • drivers: base: Free devm resources when unregistering a {CVE-2023-53596}
• CVE-2023-53622
  • gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
  • HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition {CVE-2023-53622}
• CVE-2023-53090
  • drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
• CVE-2023-53116
  • nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
• CVE-2023-53138
  • net: caif: Fix use-after-free in cfusbl_device_notify() {CVE-2023-53138}
• CVE-2023-53035
  • nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() {CVE-2023-53035}
• CVE-2023-53668
  • ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• CVE-2023-53616
  • jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount {CVE-2023-53616}
• CVE-2023-53554
  • staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() {CVE-2023-53554}
• CVE-2023-53587
  • ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• CVE-2023-53541
  • mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write {CVE-2023-53541}
• CVE-2023-53559
  • ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559}
• CVE-2023-53484
  • lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
  • lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() {CVE-2023-53484}
• CVE-2025-39824
  • HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
• CVE-2025-38715
  • hfs: fix slab-out-of-bounds in hfs_bnode_read() {CVE-2025-38715}
• CVE-2023-53153
  • wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• CVE-2025-38555
  • usb: gadget : fix use-after-free in composite_dev_cleanup() {CVE-2025-38555}
• CVE-2025-39743
  • jfs: truncate good inode…

The SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2024-57891: sched_ext: Fix invalid irq restore in scx_ops_bypass() (bsc#1235953).
• CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug (bsc#1237108).
• CVE-2024-57952: Revert "libfs: fix infinite directory reads for offset dir" (bsc#1237131).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22034: mm/rmap: avoid -EBUSY from make_device_exclusive() (bsc#1241435).
• CVE-2025-22077: Revert "smb: client: fix TCP timers deadlock after rmmod" (bsc#1241403).
• CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
• CVE-2025-37821: sched/eevdf: Fix se->slice being set to U64_MAX and resulting (bsc#1242864).
• CVE-2025-37849: KVM: arm64: Tear down vGIC on failed vCPU creation (bsc#1243000).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38019: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (bsc#1245000).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38038: cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (bsc#1244812).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
• CVE-2025-38101: ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (bsc#1245659).
• CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
• CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
• CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
• CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
• CVE-2025-38168: perf: arm-ni: Unregister PMUs on probe failure (bsc#1245763).
• CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
• CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
• CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
• CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
• CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
• CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
• CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
• CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
• CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).
• CVE-2025-38242: mm: userfaultfd: fix race of userfaultfd_move and swap…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4: do not BUG…

The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38628: vdpa/mlx5: Fix release of uninitialized resources on error path (bsc#1248616).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media:…

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
• CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39718: vsock/virtio: Validate length in packet header before skb_put() (bsc#1249305).
• CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
• CVE-2025-39678: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (bsc#1249290).
• CVE-2025-38732: netfilter: nf_reject: do not leak dst refcount for loopback packets (bsc#1249262).
• CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
• CVE-2025-38722: habanalabs: fix UAF in export_dmabuf() (bsc#1249163).
• CVE-2025-38721: netfilter: ctnetlink: fix refcount leak on table dump (bsc#1249176).
• CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
• CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
• CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
• CVE-2025-38544: rxrpc:…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50242: drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() (bsc#1249696).
• CVE-2022-50244: cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() (bsc#1249647).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947).
• CVE-2022-50265: kcm: annotate data-races around kcm->rx_wait (bsc#1249744).
• CVE-2022-50278: PNP: fix name memory leak in pnp_alloc_dev() (bsc#1249715).
• CVE-2022-50285: mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages (bsc#1249803).
• CVE-2022-50288: qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure (bsc#1249802).
• CVE-2022-50291: kcm: annotate data-races around kcm->rx_psock (bsc#1249798).
• CVE-2022-50294: wifi: libertas: fix memory leak in lbs_init_adapter() (bsc#1249799).
• CVE-2022-50297: wifi: ath9k: verify the expected usb_endpoints are present (bsc#1250250).
• CVE-2022-50304: mm: export bdi_unregister (bsc#1249725).
• CVE-2022-50311: cxl: Fix refcount leak in cxl_calc_capp_routing (bsc#1249720).
• CVE-2022-50312: drivers: serial: jsm: fix some leaks in probe (bsc#1249716).
• CVE-2022-50321: wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (bsc#1249706).
• CVE-2022-50330: crypto: cavium - prevent integer overflow loading firmware (bsc#1249700).
• CVE-2022-50349: misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (bsc#1249920).
• CVE-2022-50352: net: hns: fix possible memory leak in hnae_ae_register() (bsc#1249922).
• CVE-2022-50359: media: cx88: Fix a null-ptr-deref bug in buffer_prepare() (bsc#1250269).
• CVE-2022-50365: skbuff: Account for tail adjustment during pull operations (bsc#1250084).
• CVE-2022-50375: tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown (bsc#1250132).
• CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
• CVE-2022-50396: net: sched: fix memory leak in tcindex_set_parms (bsc#1250104).
• CVE-2022-50402: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() (bsc#1250363).
• CVE-2022-50405: net/tunnel: wait until all sk_user_data reader finish before releasing the sock (bsc#1250155).
• CVE-2022-50406: iomap: iomap: fix memory corruption when recording errors during writeback (bsc#1250165).
• CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2022-50419: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times (bsc#1250394).
• CVE-2023-53148: igb: Do not bring the device up after non-fatal error (bsc#1249842).
• CVE-2023-53153: wifi: cfg80211: Partial revert 'wifi: cfg80211: Fix use after free for wext' (bsc#1249877).
• CVE-2023-53176: serial: 8250: Fix oops for port->pm on uart_change_pm() (bsc#1249991).
• CVE-2023-53178: mm: zswap: fix missing folio cleanup in writeback race path (bsc#1249827 git-fix).
• CVE-2023-53199: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails (bsc#1249683).
• CVE-2023-53201: RDMA/bnxt_re: wraparound mbox producer index (bsc#1249687).
• CVE-2023-53226: wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (bsc#1249658).
• CVE-2023-53248: drm/amdgpu: install stub fence into potential unused fence pointers (bsc#1249779).
• CVE-2023-53254: drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug (bsc#1249871).
• CVE-2023-53272: net: ena: fix shift-out-of-bounds in exponential backoff (bsc#1249917).
• CVE-2023-53277: wifi: iwl3945: Add missing check for create_singlethread_workqueue…

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
• CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
• CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
• CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
• CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
• CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
• CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
• CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
• CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
• CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
• CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
• CVE-2025-38440: net/mlx5e: Fix race between DIM disable and net_dim() (bsc#1247290).
• CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (bsc#1247167).
• CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
• CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
• CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
• CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38490: net: libwx: remove duplicate…