CVE-2023-52610

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix skb leak and crash on ooo frags act_ct adds skb->users before defragmentation. If frags arrive in order, the last frag's reference is reset in: inet_frag_reasm_prepare skb_morph which is not straightforward. However when frags arrive out of order, nobody unref the last frag, and all frags are leaked. The situation is even worse, as initiating packet capture can lead to a crash[0] when skb has been cloned and shared at the same time. Fix the issue by removing skb_get() before defragmentation. act_ct returns TC_ACT_CONSUMED when defrag failed or in progress. [0]: [ 843.804823] ------------[ cut here ]------------ [ 843.809659] kernel BUG at net/core/skbuff.c:2091! [ 843.814516] invalid opcode: 0000 [#1] PREEMPT SMP [ 843.819296] CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G S 6.7.0-rc3 #2 [ 843.824107] Hardware name: XFUSION 1288H V6/BC13MBSBD, BIOS 1.29 11/25/2022 [ 843.828953] RIP: 0010:pskb_expand_head+0x2ac/0x300 [ 843.833805] Code: 8b 70 28 48 85 f6 74 82 48 83 c6 08 bf 01 00 00 00 e8 38 bd ff ff 8b 83 c0 00 00 00 48 03 83 c8 00 00 00 e9 62 ff ff ff 0f 0b <0f> 0b e8 8d d0 ff ff e9 b3 fd ff ff 81 7c 24 14 40 01 00 00 4c 89 [ 843.843698] RSP: 0018:ffffc9000cce07c0 EFLAGS: 00010202 [ 843.848524] RAX: 0000000000000002 RBX: ffff88811a211d00 RCX: 0000000000000820 [ 843.853299] RDX: 0000000000000640 RSI: 0000000000000000 RDI: ffff88811a211d00 [ 843.857974] RBP: ffff888127d39518 R08: 00000000bee97314 R09: 0000000000000000 [ 843.862584] R10: 0000000000000000 R11: ffff8881109f0000 R12: 0000000000000880 [ 843.867147] R13: ffff888127d39580 R14: 0000000000000640 R15: ffff888170f7b900 [ 843.871680] FS: 0000000000000000(0000) GS:ffff889ffffc0000(0000) knlGS:0000000000000000 [ 843.876242] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 843.880778] CR2: 00007fa42affcfb8 CR3: 000000011433a002 CR4: 0000000000770ef0 [ 843.885336] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 843.889809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 843.894229] PKRU: 55555554 [ 843.898539] Call Trace: [ 843.902772] <IRQ> [ 843.906922] ? __die_body+0x1e/0x60 [ 843.911032] ? die+0x3c/0x60 [ 843.915037] ? do_trap+0xe2/0x110 [ 843.918911] ? pskb_expand_head+0x2ac/0x300 [ 843.922687] ? do_error_trap+0x65/0x80 [ 843.926342] ? pskb_expand_head+0x2ac/0x300 [ 843.929905] ? exc_invalid_op+0x50/0x60 [ 843.933398] ? pskb_expand_head+0x2ac/0x300 [ 843.936835] ? asm_exc_invalid_op+0x1a/0x20 [ 843.940226] ? pskb_expand_head+0x2ac/0x300 [ 843.943580] inet_frag_reasm_prepare+0xd1/0x240 [ 843.946904] ip_defrag+0x5d4/0x870 [ 843.950132] nf_ct_handle_fragments+0xec/0x130 [nf_conntrack] [ 843.953334] tcf_ct_act+0x252/0xd90 [act_ct] [ 843.956473] ? tcf_mirred_act+0x516/0x5a0 [act_mirred] [ 843.959657] tcf_action_exec+0xa1/0x160 [ 843.962823] fl_classify+0x1db/0x1f0 [cls_flower] [ 843.966010] ? skb_clone+0x53/0xc0 [ 843.969173] tcf_classify+0x24d/0x420 [ 843.972333] tc_run+0x8f/0xf0 [ 843.975465] __netif_receive_skb_core+0x67a/0x1080 [ 843.978634] ? dev_gro_receive+0x249/0x730 [ 843.981759] __netif_receive_skb_list_core+0x12d/0x260 [ 843.984869] netif_receive_skb_list_internal+0x1cb/0x2f0 [ 843.987957] ? mlx5e_handle_rx_cqe_mpwrq_rep+0xfa/0x1a0 [mlx5_core] [ 843.991170] napi_complete_done+0x72/0x1a0 [ 843.994305] mlx5e_napi_poll+0x28c/0x6d0 [mlx5_core] [ 843.997501] __napi_poll+0x25/0x1b0 [ 844.000627] net_rx_action+0x256/0x330 [ 844.003705] __do_softirq+0xb3/0x29b [ 844.006718] irq_exit_rcu+0x9e/0xc0 [ 844.009672] common_interrupt+0x86/0xa0 [ 844.012537] </IRQ> [ 844.015285] <TASK> [ 844.017937] asm_common_interrupt+0x26/0x40 [ 844.020591] RIP: 0010:acpi_safe_halt+0x1b/0x20 [ 844.023247] Code: ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 65 48 8b 04 25 00 18 03 00 48 8b 00 a8 08 75 0c 66 90 0f 00 2d 81 d0 44 00 fb ---truncated---

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Fix scsi_mode_sense() buffer length handling

Several problems exist with scsi_mode_sense() buffer length handling:

1. The allocation length field of the MODE SENSE(10) command is 16-bits, occupying bytes 7 and 8 of the CDB. With this command, access to mode pages larger than 255 bytes is thus possible. However, the CDB allocation length field is set by assigning len to byte 8 only, thus truncating buffer length larger than 255.

2. If scsi_mode_sense() is called with len smaller than 8 with sdev->use_10_for_ms set, or smaller than 4 otherwise, the buffer length is increased to 8 and 4 respectively, and the buffer is zero filled with these increased values, thus corrupting the memory following the buffer.

Fix these 2 problems by using put_unaligned_be16() to set the allocation length field of MODE SENSE(10) CDB and by returning an error when len is too small.

Furthermore, if len is larger than 255B, always try MODE SENSE(10) first, even if the device driver did not set sdev->use_10_for_ms. In case of invalid opcode error for MODE SENSE(10), access to mode pages larger than 255 bytes are not retried using MODE SENSE(6). To avoid buffer length overflows for the MODE_SENSE(10) case, check that len is smaller than 65535 bytes.

While at it, also fix the folowing:

• Use get_unaligned_be16() to retrieve the mode data length and block descriptor length fields of the mode sense reply header instead of using an open coded calculation.

• Fix the kdoc dbd argument explanation: the DBD bit stands for Disable Block Descriptor, which is the opposite of what the dbd argument description was.(CVE-2021-47182)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: CT, Fix multiple allocations and memleak of mod acts

CT clear action offload adds additional mod hdr actions to the flow's original mod actions in order to clear the registers which hold ct_state. When such flow also includes encap action, a neigh update event can cause the driver to unoffload the flow and then reoffload it.

Each time this happens, the ct clear handling adds that same set of mod hdr actions to reset ct_state until the max of mod hdr actions is reached.

Also the driver never releases the allocated mod hdr actions and causing a memleak.

Fix above two issues by moving CT clear mod acts allocation into the parsing actions phase and only use it when offloading the rule. The release of mod acts will be done in the normal flow_put().

backtrace: [<000000007316e2f3>] krealloc+0x83/0xd0 [<00000000ef157de1>] mlx5e_mod_hdr_alloc+0x147/0x300 [mlx5_core] [<00000000970ce4ae>] mlx5e_tc_match_to_reg_set_and_get_id+0xd7/0x240 [mlx5_core] [<0000000067c5fa17>] mlx5e_tc_match_to_reg_set+0xa/0x20 [mlx5_core] [<00000000d032eb98>] mlx5_tc_ct_entry_set_registers.isra.0+0x36/0xc0 [mlx5_core] [<00000000fd23b869>] mlx5_tc_ct_flow_offload+0x272/0x1f10 [mlx5_core] [<000000004fc24acc>] mlx5e_tc_offload_fdb_rules.part.0+0x150/0x620 [mlx5_core] [<00000000dc741c17>] mlx5e_tc_encap_flows_add+0x489/0x690 [mlx5_core] [<00000000e92e49d7>] mlx5e_rep_update_flows+0x6e4/0x9b0 [mlx5_core] [<00000000f60f5602>] mlx5e_rep_neigh_update+0x39a/0x5d0 mlx5_core

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix null pointer dereference on pointer cs_desc

The pointer cs_desc return from snd_usb_find_clock_source could be null, so there is a potential null pointer dereference issue. Fix this by adding a null check before dereference.(CVE-2021-47211)

In the Linux kernel, the following vulnerability has been resolved:

binder: fix race between mmput() and do_exit()

Task…

Root has patched CVE-2023-52610 in the linux package for Root:Debian:11. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix skb leak and crash on ooo frags act_ct adds skb->users before defragmentation. If frags arrive in order, the last frag's reference is reset in: inet_frag_reasm_prepare skb_morph which is not straightforward. However when frags arrive out of order, nobody unref the last frag, and all frags are leaked. The situation is even worse, as initiating packet capture can lead to a crash[0] when skb has been cloned and shared at the same time. Fix the issue by removing skb_get() before defragmentation. act_ct returns TC_ACT_CONSUMED when defrag failed or in progress. [0]: [ 843.804823] ------------[ cut here ]------------ [ 843.809659] kernel BUG at net/core/skbuff.c:2091! [ 843.814516] invalid opcode: 0000 [#1] PREEMPT SMP [ 843.819296] CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G S 6.7.0-rc3 #2 [ 843.824107] Hardware name: XFUSION 1288H V6/BC13MBSBD, BIOS 1.29 11/25/2022 [ 843.828953] RIP: 0010:pskb_expand_head+0x2ac/0x300 [ 843.833805] Code: 8b 70 28 48 85 f6 74 82 48 83 c6 08 bf 01 00 00 00 e8 38 bd ff ff 8b 83 c0 00 00 00 48 03 83 c8 00 00 00 e9 62 ff ff ff 0f 0b <0f> 0b e8 8d d0 ff ff e9 b3 fd ff ff 81 7c 24 14 40 01 00 00 4c 89 [ 843.843698] RSP: 0018:ffffc9000cce07c0 EFLAGS: 00010202 [ 843.848524] RAX: 0000000000000002 RBX: ffff88811a211d00 RCX: 0000000000000820 [ 843.853299] RDX: 0000000000000640 RSI: 0000000000000000 RDI: ffff88811a211d00 [ 843.857974] RBP: ffff888127d39518 R08: 00000000bee97314 R09: 0000000000000000 [ 843.862584] R10: 0000000000000000 R11: ffff8881109f0000 R12: 0000000000000880 [ 843.867147] R13: ffff888127d39580 R14: 0000000000000640 R15: ffff888170f7b900 [ 843.871680] FS: 0000000000000000(0000) GS:ffff889ffffc0000(0000) knlGS:0000000000000000 [ 843.876242] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 843.880778] CR2: 00007fa42affcfb8 CR3: 000000011433a002 CR4: 0000000000770ef0 [ 843.885336] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 843.889809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 843.894229] PKRU: 55555554 [ 843.898539] Call Trace: [ 843.902772] <IRQ> [ 843.906922] ? __die_body+0x1e/0x60 [ 843.911032] ? die+0x3c/0x60 [ 843.915037] ? do_trap+0xe2/0x110 [ 843.918911] ? pskb_expand_head+0x2ac/0x300 [ 843.922687] ? do_error_trap+0x65/0x80 [ 843.926342] ? pskb_expand_head+0x2ac/0x300 [ 843.929905] ? exc_invalid_op+0x50/0x60 [ 843.933398] ? pskb_expand_head+0x2ac/0x300 [ 843.936835] ? asm_exc_invalid_op+0x1a/0x20 [ 843.940226] ? pskb_expand_head+0x2ac/0x300 [ 843.943580] inet_frag_reasm_prepare+0xd1/0x240 [ 843.946904] ip_defrag+0x5d4/0x870 [ 843.950132] nf_ct_handle_fragments+0xec/0x130 [nf_conntrack] [ 843.953334] tcf_ct_act+0x252/0xd90 [act_ct] [ 843.956473] ? tcf_mirred_act+0x516/0x5a0 [act_mirred] [ 843.959657] tcf_action_exec+0xa1/0x160 [ 843.962823] fl_classify+0x1db/0x1f0 [cls_flower] [ 843.966010] ? skb_clone+0x53/0xc0 [ 843.969173] tcf_classify+0x24d/0x420 [ 843.972333] tc_run+0x8f/0xf0 [ 843.975465] __netif_receive_skb_core+0x67a/0x1080 [ 843.978634] ? dev_gro_receive+0x249/0x730 [ 843.981759] __netif_receive_skb_list_core+0x12d/0x260 [ 843.984869] netif_receive_skb_list_internal+0x1cb/0x2f0 [ 843.987957] ? mlx5e_handle_rx_cqe_mpwrq_rep+0xfa/0x1a0 [mlx5_core] [ 843.991170] napi_complete_done+0x72/0x1a0 [ 843.994305] mlx5e_napi_poll+0x28c/0x6d0 [mlx5_core] [ 843.997501] __napi_poll+0x25/0x1b0 [ 844.000627] net_rx_action+0x256/0x330 [ 844.003705] __do_softirq+0xb3/0x29b [ 844.006718] irq_exit_rcu+0x9e/0xc0 [ 844.009672] common_interrupt+0x86/0xa0 [ 844.012537] </IRQ> [ 844.015285] <TASK> [ 844.017937] asm_common_interrupt+0x26/0x40 [ 844.020591] RIP: 0010:acpi_safe_halt+0x1b/0x20 [ 844.023247] Code: ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 65 48 8b 04 25 00 18 03 00 48 8b 00 a8 08 75 0c 66 90 0f 00 2d 81 d0 44 00 fb ---truncated---

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)
• kernel: multiple use-after-free vulnerabilities (CVE-2024-1086, CVE-2023-3567, CVE-2023-4133, CVE-2023-6932, CVE-2023-39198, CVE-2023-51043, CVE-2023-51779, CVE-2023-51780, CVE-2024-1085, CVE-2024-26582)
• kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)
• kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)
• kernel: multiple NULL pointer dereference vulnerabilities (CVE-2022-38096, CVE-2023-6622, CVE-2023-6915, CVE-2023-42754, CVE-2023-46862, CVE-2023-52574, CVE-2024-0841, CVE-2023-52448)
• kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934)
• kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040)
• kernel: GC's deletion of an SKB races with unix_stream_read_generic() leading to UAF (CVE-2023-6531)
• kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931)
• kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023)
• kernel: irdma: Improper access control (CVE-2023-25775)
• Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464)
• kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c (CVE-2023-28866)
• kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl (CVE-2023-31083)
• kernel: multiple out-of-bounds read vulnerabilities (CVE-2023-37453, CVE-2023-39189, CVE-2023-39193, CVE-2023-6121, CVE-2023-39194)
• kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP (CVE-2023-42756)
• kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write (CVE-2023-45863)
• kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)
• kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489)
• kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522)
• kernel: multiple memory leak vulnerabilities (CVE-2023-52529, CVE-2023-52581)
• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)
• kernel: net/core: kernel crash in ETH_P_1588 flow dissector (CVE-2023-52580)
• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)
• kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (CVE-2024-0565)
• kernel: tls: race between async notify and socket close (CVE-2024-26583)
• kernel: tls: handle backlogging of crypto requests (CVE-2024-26584)
• kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585)
• kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)
• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)
• kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)
• kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-26609)
• kernel: local dos vulnerability in scatterwalk_copychunks (CVE-2023-6176)
• kernel: perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476)
• kernel: netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620)
• kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240)
• kernel: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2024-0340)
• kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)
• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)
• kernel: pvrusb2: fix use after free on context disconnection (CVE-2023-52445)
• kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer that cause loop forever (CVE-2024-26603)
• kernel: use after free in i2c (CVE-2019-25162)
• kernel: i2c: validate user data in compat ioctl (CVE-2021-46934)
• kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() (CVE-2020-36777)
• kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors (CVE-2023-52477)
• kernel: mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)
• kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615)
• kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627)
• kernel: Integer Overflow in raid5_cache_count (CVE-2024-23307)
• kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() (CVE-2023-52565)
• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)
• kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (CVE-2023-52528)
• kernel: platform/x86: think-lmi: Fix reference leak (CVE-2023-52520)
• kernel: RDMA/siw: Fix connection failure handling (CVE-2023-52513)
• kernel: pid: take a reference when initializing cad_pid (CVE-2021-47118)
• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)
• kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643)
• kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642)
• kernel: i2c: i801: Don't generate an interrupt on bus reset (CVE-2021-47153)
• kernel: xhci: handle isoc Babble and Buffer Overrun events properly (CVE-2024-26659)
• kernel: hwmon: (coretemp) Fix out-of-bounds memory access (CVE-2024-26664)
• kernel: wifi: mac80211: fix race condition on enabling fast-xmit (CVE-2024-26779)
• kernel: RDMA/srpt: Support specifying the srpt_service_guid parameter (CVE-2024-26744)
• kernel: RDMA/qedr: Fix qedr_create_user_qp error flow (CVE-2024-26743)
• kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (CVE-2021-47185)
• kernel: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (CVE-2024-26901)
• kernel: RDMA/srpt: Do not register event handler until srpt device is fully setup (CVE-2024-26872)
• kernel: usb: ulpi: Fix debugfs directory leak (CVE-2024-26919)
• kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma (CVE-2024-26964)
• kernel: USB: core: Fix deadlock in usb_deauthorize_interface() (CVE-2024-26934)
• kernel: USB: core: Fix deadlock in port "disable" sysfs attribute (CVE-2024-26933)
• kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993)
• kernel: fat: fix uninitialized field in nostale filehandles (CVE-2024-26973)
• kernel: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (CVE-2024-27059)
• kernel: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (CVE-2021-47013)
• kernel: net: usb: fix memory leak in smsc75xx_bind (CVE-2021-47171)
• kernel: powerpc/pseries: Fix potential memleak in papr_get_attr() (CVE-2022-48669)
• kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439)
• kernel: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (CVE-2023-52594)
• kernel: wifi: rt2x00: restart beacon queue when hardware reset (CVE-2023-52595)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240)
• kernel: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2024-0340)
• kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)
• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)
• kernel: pvrusb2: fix use after free on context disconnection (CVE-2023-52445)
• kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer that cause loop forever (CVE-2024-26603)
• kernel: use after free in i2c (CVE-2019-25162)
• kernel: i2c: validate user data in compat ioctl (CVE-2021-46934)
• kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() (CVE-2020-36777)
• kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors (CVE-2023-52477)
• kernel: mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)
• kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615)
• kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627)
• kernel: Integer Overflow in raid5_cache_count (CVE-2024-23307)
• kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() (CVE-2023-52565)
• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)
• kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (CVE-2023-52528)
• kernel: platform/x86: think-lmi: Fix reference leak (CVE-2023-52520)
• kernel: RDMA/siw: Fix connection failure handling (CVE-2023-52513)
• kernel: pid: take a reference when initializing cad_pid (CVE-2021-47118)
• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)
• kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643)
• kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642)
• kernel: i2c: i801: Don't generate an interrupt on bus reset (CVE-2021-47153)
• kernel: xhci: handle isoc Babble and Buffer Overrun events properly (CVE-2024-26659)
• kernel: hwmon: (coretemp) Fix out-of-bounds memory access (CVE-2024-26664)
• kernel: wifi: mac80211: fix race condition on enabling fast-xmit (CVE-2024-26779)
• kernel: RDMA/srpt: Support specifying the srpt_service_guid parameter (CVE-2024-26744)
• kernel: RDMA/qedr: Fix qedr_create_user_qp error flow (CVE-2024-26743)
• kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (CVE-2021-47185)
• kernel: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (CVE-2024-26901)
• kernel: RDMA/srpt: Do not register event handler until srpt device is fully setup (CVE-2024-26872)
• kernel: usb: ulpi: Fix debugfs directory leak (CVE-2024-26919)
• kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma (CVE-2024-26964)
• kernel: USB: core: Fix deadlock in usb_deauthorize_interface() (CVE-2024-26934)
• kernel: USB: core: Fix deadlock in port "disable" sysfs attribute (CVE-2024-26933)
• kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993)
• kernel: fat: fix uninitialized field in nostale filehandles (CVE-2024-26973)
• kernel: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (CVE-2024-27059)

Bug Fix(es):

• kernel-rt: update RT source tree to the latest AlmaLinux-8.10.z kernel (JIRA:AlmaLinux-34640)
• kernel-rt: epoll_wait not reporting catching all events to application (JIRA:AlmaLinux-23022)

• smb: client: reject userspace cifs.spnego descriptions
• mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash {CVE-2024-35854}
• cifs: Fix memory leak when build ntlmssp negotiate blob failed {CVE-2022-50372}
• scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() {CVE-2023-53038}
• drm/amd/display: Do not set DRR on pipe Commit {CVE-2023-53042}
• tcp: fix skb_copy_ubufs() vs BIG TCP {CVE-2023-53669}
• clk: Fix clk_core_get NULL dereference {CVE-2024-27038}
• drm/amd/display: Check null pointers before using dc->clk_mgr {CVE-2024-49907}
• bpf: reject unhashed sockets in bpf_sk_assign {CVE-2023-53585}
• driver core: fix resource leak in device_add() {CVE-2023-53594}
• wifi: ath9k: hif_usb: fix memory leak of remain_skbs {CVE-2023-53641}
• wifi: ath9k: verify the expected usb_endpoints are present {CVE-2022-50297}
• drm/amd/display: Fix potential null-deref in dm_resume {CVE-2022-50535}
• ext4: don't allow journal inode to have encrypt flag {CVE-2022-50277}
• tls: get psock ref after taking rxlock to avoid leak {CVE-2024-35908}
• cpumap: Zero-initialise xdp_rxq_info struct before running XDP program {CVE-2024-27431}
• bpf: Guard stack limits against 32bit overflow {CVE-2023-52676}
• can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible() {CVE-2021-47457}
• serial: core: fix transmit-buffer reset and memleak {CVE-2021-47527}
• cpufreq: exit() callback is optional {CVE-2024-38615}
• ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() {CVE-2024-39276}
• tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets {CVE-2024-36905}
• wifi: nl80211: reject iftype change with mesh ID change {CVE-2024-27410}
• tcp: do not accept ACK of bytes we never sent {CVE-2023-52881}
• crypto: pcrypt - Fix hungtask for PADATA_RESET {CVE-2023-52813}
• net/mlx5: Properly link new fs rules into the tree {CVE-2024-35960}
• usb: ulpi: fix memory leak on ulpi_register() error paths
• usb: ulpi: fix double free in ulpi_register_interface() error path {CVE-2026-31759}
• wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
• net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute {CVE-2025-21653}
• calipso: fix memory leak in netlbl_calipso_add_pass() {CVE-2023-52698}
• wifi: iwlwifi: mvm: avoid NULL pointer dereference {CVE-2024-49929}
• ext4: update orig_path in ext4_find_extent() {CVE-2024-49881}
• drm/vmwgfx: Fix a deadlock in dma buf fence polling {CVE-2024-43863}
• RDMA/restrack: Fix potential invalid address access {CVE-2024-42080}
• net: can: j1939: Initialize unused data in j1939_send_one() {CVE-2024-42076}
• nfsd: clear acl_access/acl_default after releasing them {CVE-2025-21796}
• rtc: pl031: fix rtc features null pointer dereference {CVE-2022-49273}
• net: veth: clear GRO when clearing XDP even when down {CVE-2024-26803}
• coresight: cti: Fix hang in cti_disable_hw() {CVE-2022-50491}
• scsi: qla2xxx: Fix deletion race condition {CVE-2023-53615}
• iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() {CVE-2023-53476}
• scsi: qla2xxx: Fix potential NULL pointer dereference {CVE-2023-53451}
• usb: ucsi_acpi: Increase the command completion timeout {CVE-2023-53168}
• drivers: base: dd: fix memory leak with using debugfs_lookup() {CVE-2023-53390}
• USB: fix memory leak with using debugfs_lookup() {CVE-2023-53359}
• PM: domains: fix memory leak with using debugfs_lookup() {CVE-2023-53202}
• drm/client: Fix memory leak in drm_client_modeset_probe {CVE-2023-53288}
• drivers: base: component: fix memory leak with using debugfs_lookup() {CVE-2023-53409}
• USB: uhci: fix memory leak with using debugfs_lookup() {CVE-2023-53197}
• media: uvcvideo: Handle cameras with invalid descriptors {CVE-2023-53437}
• arm64: csum: Fix OoB access in IP checksum code for negative lengths {CVE-2023-53726}
• bnxt: Do not read past the end of test names {CVE-2023-53010}
• dax: make sure inodes are flushed before destroy cache {CVE-2022-49220}
• cifs: Fix oops due to uncleared server->smbd_conn…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240)

• kernel: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2024-0340)

• kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)

• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)

• kernel: pvrusb2: fix use after free on context disconnection (CVE-2023-52445)

• kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer that cause loop forever (CVE-2024-26603)

• kernel: use after free in i2c (CVE-2019-25162)

• kernel: i2c: validate user data in compat ioctl (CVE-2021-46934)

• kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() (CVE-2020-36777)

• kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors (CVE-2023-52477)

• kernel: mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)

• kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615)

• kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627)

• kernel: Integer Overflow in raid5_cache_count (CVE-2024-23307)

• kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() (CVE-2023-52565)

• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)

• kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (CVE-2023-52528)

• kernel: platform/x86: think-lmi: Fix reference leak (CVE-2023-52520)

• kernel: RDMA/siw: Fix connection failure handling (CVE-2023-52513)

• kernel: pid: take a reference when initializing cad_pid (CVE-2021-47118)

• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)

• kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643)

• kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642)

• kernel: i2c: i801: Don't generate an interrupt on bus reset (CVE-2021-47153)

• kernel: xhci: handle isoc Babble and Buffer Overrun events properly (CVE-2024-26659)

• kernel: hwmon: (coretemp) Fix out-of-bounds memory access (CVE-2024-26664)

• kernel: wifi: mac80211: fix race condition on enabling fast-xmit (CVE-2024-26779)

• kernel: RDMA/srpt: Support specifying the srpt_service_guid parameter (CVE-2024-26744)

• kernel: RDMA/qedr: Fix qedr_create_user_qp error flow (CVE-2024-26743)

• kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (CVE-2021-47185)

• kernel: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (CVE-2024-26901)

• kernel: RDMA/srpt: Do not register event handler until srpt device is fully setup (CVE-2024-26872)

• kernel: usb: ulpi: Fix debugfs directory leak (CVE-2024-26919)

• kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma (CVE-2024-26964)

• kernel: USB: core: Fix deadlock in usb_deauthorize_interface() (CVE-2024-26934)

• kernel: USB: core: Fix deadlock in port "disable" sysfs attribute (CVE-2024-26933)

• kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993)

• kernel: fat: fix uninitialized field in nostale filehandles (CVE-2024-26973)

• kernel: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (CVE-2024-27059)

• kernel: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (CVE-2021-47013)

• kernel: net: usb: fix memory leak in smsc75xx_bind (CVE-2021-47171)

• kernel: powerpc/pseries: Fix potential memleak in papr_get_attr() (CVE-2022-48669)

• kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439)

• kernel: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (CVE-2023-52594)

• kernel: wifi: rt2x00: restart beacon queue when hardware reset (CVE-2023-52595)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240)

• kernel: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2024-0340)

• kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)

• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)

• kernel: pvrusb2: fix use after free on context disconnection (CVE-2023-52445)

• kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer that cause loop forever (CVE-2024-26603)

• kernel: use after free in i2c (CVE-2019-25162)

• kernel: i2c: validate user data in compat ioctl (CVE-2021-46934)

• kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() (CVE-2020-36777)

• kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors (CVE-2023-52477)

• kernel: mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)

• kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615)

• kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627)

• kernel: Integer Overflow in raid5_cache_count (CVE-2024-23307)

• kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() (CVE-2023-52565)

• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)

• kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (CVE-2023-52528)

• kernel: platform/x86: think-lmi: Fix reference leak (CVE-2023-52520)

• kernel: RDMA/siw: Fix connection failure handling (CVE-2023-52513)

• kernel: pid: take a reference when initializing cad_pid (CVE-2021-47118)

• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)

• kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643)

• kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642)

• kernel: i2c: i801: Don't generate an interrupt on bus reset (CVE-2021-47153)

• kernel: xhci: handle isoc Babble and Buffer Overrun events properly (CVE-2024-26659)

• kernel: hwmon: (coretemp) Fix out-of-bounds memory access (CVE-2024-26664)

• kernel: wifi: mac80211: fix race condition on enabling fast-xmit (CVE-2024-26779)

• kernel: RDMA/srpt: Support specifying the srpt_service_guid parameter (CVE-2024-26744)

• kernel: RDMA/qedr: Fix qedr_create_user_qp error flow (CVE-2024-26743)

• kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (CVE-2021-47185)

• kernel: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (CVE-2024-26901)

• kernel: RDMA/srpt: Do not register event handler until srpt device is fully setup (CVE-2024-26872)

• kernel: usb: ulpi: Fix debugfs directory leak (CVE-2024-26919)

• kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma (CVE-2024-26964)

• kernel: USB: core: Fix deadlock in usb_deauthorize_interface() (CVE-2024-26934)

• kernel: USB: core: Fix deadlock in port "disable" sysfs attribute (CVE-2024-26933)

• kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993)

• kernel: fat: fix uninitialized field in nostale filehandles (CVE-2024-26973)

• kernel: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (CVE-2024-27059)

Bug Fix(es):

• kernel-rt: update RT source tree to the latest Rocky Linux-8.10.z kernel (JIRA:Rocky Linux-34640)

• kernel-rt: epoll_wait not reporting catching all events to application (JIRA:Rocky Linux-23022)

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52610: net/sched: act_ct: fix skb leak and crash on ooo frags (bsc#1221610).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52916: media: aspeed: Fix memory overwrite if timing is 1600x900 (bsc#1230269).
• CVE-2024-26640: tcp: add sanity checks to rx zerocopy (bsc#1221650).
• CVE-2024-26759: mm/swap: fix race when skipping swapcache (bsc#1230340).
• CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).
• CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).
• CVE-2024-38596: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (bsc#1226846).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-40973: media: mtk-vcodec: potential null pointer deference in SCP (bsc#1227890).
• CVE-2024-40983: tipc: force a dst refcount before doing decryption (bsc#1227819).
• CVE-2024-42154: tcp_metrics: validate source addr length (bsc#1228507).
• CVE-2024-42243: mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray (bsc#1229001).
• CVE-2024-42252: closures: Change BUG_ON() to WARN_ON() (bsc#1229004).
• CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
• CVE-2024-42294: block: fix deadlock between sd_remove & sd_release (bsc#1229371).
• CVE-2024-42304: ext4: make sure the first directory block is not a hole (bsc#1229364).
• CVE-2024-42305: ext4: check dot and dotdot of dx_root before making dir indexed (bsc#1229363).
• CVE-2024-42306: udf: Avoid using corrupted block bitmap buffer (bsc#1229362).
• CVE-2024-43828: ext4: fix infinite loop when replaying fast_commit (bsc#1229394).
• CVE-2024-43832: s390/uv: Do not call folio_wait_writeback() without a folio reference (bsc#1229380).
• CVE-2024-43845: udf: Fix bogus checksum computation in udf_rename() (bsc#1229389).
• CVE-2024-43890: tracing: Fix overflow in get_free_elt() (bsc#1229764).
• CVE-2024-43898: ext4: sanity check for NULL pointer after ext4_force_shutdown (bsc#1229753).
• CVE-2024-43914: md/raid5: avoid BUG_ON() while continue reshape after reassembling (bsc#1229790).
• CVE-2024-44935: sctp: Fix null-ptr-deref in reuseport_add_sock() (bsc#1229810).
• CVE-2024-44944: netfilter: ctnetlink: use helper function to calculate expect ID (bsc#1229899).
• CVE-2024-44946: kcm: Serialise kcm_sendmsg() for the same socket (bsc#1230015).
• CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set (bsc#1230180).
• CVE-2024-44951: serial: sc16is7xx: fix TX fifo corruption (bsc#1230181).
• CVE-2024-44970: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (bsc#1230209).
• CVE-2024-44971: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() (bsc#1230211).
• CVE-2024-44984: bnxt_en: Fix double DMA unmapping for XDP_REDIRECT (bsc#1230240).
• CVE-2024-44985: ipv6: prevent possible UAF in ip6_xmit() (bsc#1230206).
• CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
• CVE-2024-44988: net: dsa: mv88e6xxx: Fix out-of-bound access (bsc#1230192).
• CVE-2024-44989: bonding: fix xfrm real_dev null pointer dereference (bsc#1230193).
• CVE-2024-44990: bonding: fix null pointer deref in bond_ipsec_offload_ok (bsc#1230194).
• CVE-2024-44991: tcp: prevent concurrent execution of tcp_sk_exit_batch (bsc#1230195).
• CVE-2024-44998: atm: idt77252: prevent use after free in dequeue_rx() (bsc#1230171).
• CVE-2024-44999: gtp: pull network headers in gtp_dev_xmit() (bsc#1230233).
• CVE-2024-45002: rtla/osnoise: Prevent NULL dereference in error handling (bsc#1230169).
• CVE-2024-45003: Don't evict inode under the inode lru traversing context (bsc#1230245).
• CVE-2024-45013: nvme: move stopping keep-alive into nvme_uninit_ctrl() (bsc#1230442).
• CVE-2024-45017: net/mlx5: Fix…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52610: net/sched: act_ct: fix skb leak and crash on ooo frags (bsc#1221610).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52916: media: aspeed: Fix memory overwrite if timing is 1600x900 (bsc#1230269).
• CVE-2024-26640: tcp: add sanity checks to rx zerocopy (bsc#1221650).
• CVE-2024-26759: mm/swap: fix race when skipping swapcache (bsc#1230340).
• CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).
• CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).
• CVE-2024-38596: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (bsc#1226846).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-40973: media: mtk-vcodec: potential null pointer deference in SCP (bsc#1227890).
• CVE-2024-40983: tipc: force a dst refcount before doing decryption (bsc#1227819).
• CVE-2024-42154: tcp_metrics: validate source addr length (bsc#1228507).
• CVE-2024-42243: mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray (bsc#1229001).
• CVE-2024-42252: closures: Change BUG_ON() to WARN_ON() (bsc#1229004).
• CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
• CVE-2024-42294: block: fix deadlock between sd_remove & sd_release (bsc#1229371).
• CVE-2024-42304: ext4: make sure the first directory block is not a hole (bsc#1229364).
• CVE-2024-42305: ext4: check dot and dotdot of dx_root before making dir indexed (bsc#1229363).
• CVE-2024-42306: udf: Avoid using corrupted block bitmap buffer (bsc#1229362).
• CVE-2024-43828: ext4: fix infinite loop when replaying fast_commit (bsc#1229394).
• CVE-2024-43832: s390/uv: Do not call folio_wait_writeback() without a folio reference (bsc#1229380).
• CVE-2024-43845: udf: Fix bogus checksum computation in udf_rename() (bsc#1229389).
• CVE-2024-43890: tracing: Fix overflow in get_free_elt() (bsc#1229764).
• CVE-2024-43898: ext4: sanity check for NULL pointer after ext4_force_shutdown (bsc#1229753).
• CVE-2024-43914: md/raid5: avoid BUG_ON() while continue reshape after reassembling (bsc#1229790).
• CVE-2024-44935: sctp: Fix null-ptr-deref in reuseport_add_sock() (bsc#1229810).
• CVE-2024-44944: netfilter: ctnetlink: use helper function to calculate expect ID (bsc#1229899).
• CVE-2024-44946: kcm: Serialise kcm_sendmsg() for the same socket (bsc#1230015).
• CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set (bsc#1230180).
• CVE-2024-44951: serial: sc16is7xx: fix TX fifo corruption (bsc#1230181).
• CVE-2024-44970: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (bsc#1230209).
• CVE-2024-44971: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() (bsc#1230211).
• CVE-2024-44984: bnxt_en: Fix double DMA unmapping for XDP_REDIRECT (bsc#1230240).
• CVE-2024-44985: ipv6: prevent possible UAF in ip6_xmit() (bsc#1230206).
• CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
• CVE-2024-44988: net: dsa: mv88e6xxx: Fix out-of-bound access (bsc#1230192).
• CVE-2024-44989: bonding: fix xfrm real_dev null pointer dereference (bsc#1230193).
• CVE-2024-44990: bonding: fix null pointer deref in bond_ipsec_offload_ok (bsc#1230194).
• CVE-2024-44991: tcp: prevent concurrent execution of tcp_sk_exit_batch (bsc#1230195).
• CVE-2024-44998: atm: idt77252: prevent use after free in dequeue_rx() (bsc#1230171).
• CVE-2024-44999: gtp: pull network headers in gtp_dev_xmit() (bsc#1230233).
• CVE-2024-45002: rtla/osnoise: Prevent NULL dereference in error handling (bsc#1230169).
• CVE-2024-45003: Don't evict inode under the inode lru traversing context (bsc#1230245).
• CVE-2024-45013: nvme: move stopping keep-alive into nvme_uninit_ctrl() (bsc#1230442).
• CVE-2024-45017: net/mlx5: Fix IPsec…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52610: net/sched: act_ct: fix skb leak and crash on ooo frags (bsc#1221610).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52916: media: aspeed: Fix memory overwrite if timing is 1600x900 (bsc#1230269).
• CVE-2024-26640: tcp: add sanity checks to rx zerocopy (bsc#1221650).
• CVE-2024-26759: mm/swap: fix race when skipping swapcache (bsc#1230340).
• CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).
• CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).
• CVE-2024-38596: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (bsc#1226846).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-40973: media: mtk-vcodec: potential null pointer deference in SCP (bsc#1227890).
• CVE-2024-40983: tipc: force a dst refcount before doing decryption (bsc#1227819).
• CVE-2024-42154: tcp_metrics: validate source addr length (bsc#1228507).
• CVE-2024-42243: mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray (bsc#1229001).
• CVE-2024-42252: closures: Change BUG_ON() to WARN_ON() (bsc#1229004).
• CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
• CVE-2024-42294: block: fix deadlock between sd_remove & sd_release (bsc#1229371).
• CVE-2024-42304: ext4: make sure the first directory block is not a hole (bsc#1229364).
• CVE-2024-42305: ext4: check dot and dotdot of dx_root before making dir indexed (bsc#1229363).
• CVE-2024-42306: udf: Avoid using corrupted block bitmap buffer (bsc#1229362).
• CVE-2024-43828: ext4: fix infinite loop when replaying fast_commit (bsc#1229394).
• CVE-2024-43832: s390/uv: Do not call folio_wait_writeback() without a folio reference (bsc#1229380).
• CVE-2024-43845: udf: Fix bogus checksum computation in udf_rename() (bsc#1229389).
• CVE-2024-43890: tracing: Fix overflow in get_free_elt() (bsc#1229764).
• CVE-2024-43898: ext4: sanity check for NULL pointer after ext4_force_shutdown (bsc#1229753).
• CVE-2024-43914: md/raid5: avoid BUG_ON() while continue reshape after reassembling (bsc#1229790).
• CVE-2024-44935: sctp: Fix null-ptr-deref in reuseport_add_sock() (bsc#1229810).
• CVE-2024-44944: netfilter: ctnetlink: use helper function to calculate expect ID (bsc#1229899).
• CVE-2024-44946: kcm: Serialise kcm_sendmsg() for the same socket (bsc#1230015).
• CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set (bsc#1230180).
• CVE-2024-44951: serial: sc16is7xx: fix TX fifo corruption (bsc#1230181).
• CVE-2024-44970: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (bsc#1230209).
• CVE-2024-44971: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() (bsc#1230211).
• CVE-2024-44984: bnxt_en: Fix double DMA unmapping for XDP_REDIRECT (bsc#1230240).
• CVE-2024-44985: ipv6: prevent possible UAF in ip6_xmit() (bsc#1230206).
• CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
• CVE-2024-44988: net: dsa: mv88e6xxx: Fix out-of-bound access (bsc#1230192).
• CVE-2024-44989: bonding: fix xfrm real_dev null pointer dereference (bsc#1230193).
• CVE-2024-44990: bonding: fix null pointer deref in bond_ipsec_offload_ok (bsc#1230194).
• CVE-2024-44991: tcp: prevent concurrent execution of tcp_sk_exit_batch (bsc#1230195).
• CVE-2024-44998: atm: idt77252: prevent use after free in dequeue_rx() (bsc#1230171).
• CVE-2024-44999: gtp: pull network headers in gtp_dev_xmit() (bsc#1230233).
• CVE-2024-45002: rtla/osnoise: Prevent NULL dereference in error handling (bsc#1230169).
• CVE-2024-45003: Don't evict inode under the inode lru traversing context (bsc#1230245).
• CVE-2024-45013: nvme: move stopping keep-alive into nvme_uninit_ctrl() (bsc#1230442).
• CVE-2024-45017: net/mlx5: Fix IPsec…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48901: btrfs: do not start relocation until in progress drops are done (bsc#1229607).
• CVE-2022-48911: kabi: add __nf_queue_get_refs() for kabi compliance. (bsc#1229633).
• CVE-2022-48923: btrfs: prevent copying too big compressed lzo segment (bsc#1229662)
• CVE-2022-48935: Fixed an unregister flowtable hooks on netns exit (bsc#1229619)
• CVE-2023-52610: net/sched: act_ct: fix skb leak and crash on ooo frags (bsc#1221610).
• CVE-2023-52916: media: aspeed: Fix memory overwrite if timing is 1600x900 (bsc#1230269).
• CVE-2024-26640: tcp: add sanity checks to rx zerocopy (bsc#1221650).
• CVE-2024-26759: mm/swap: fix race when skipping swapcache (bsc#1230340).
• CVE-2024-26767: drm/amd/display: fixed integer types and null check locations (bsc#1230339).
• CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).
• CVE-2024-26837: net: bridge: switchdev: race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).
• CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).
• CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).
• CVE-2024-38596: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (bsc#1226846).
• CVE-2024-40910: Fix refcount imbalance on inbound connections (bsc#1227832).
• CVE-2024-40973: media: mtk-vcodec: potential null pointer deference in SCP (bsc#1227890).
• CVE-2024-40983: tipc: force a dst refcount before doing decryption (bsc#1227819).
• CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620 CVE-2024-41082).
• CVE-2024-42154: tcp_metrics: validate source addr length (bsc#1228507).
• CVE-2024-42259: Fix Virtual Memory mapping boundaries calculation (bsc#1229156)
• CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
• CVE-2024-42304: ext4: make sure the first directory block is not a hole (bsc#1229364).
• CVE-2024-42305: ext4: check dot and dotdot of dx_root before making dir indexed (bsc#1229363).
• CVE-2024-42306: udf: Avoid using corrupted block bitmap buffer (bsc#1229362).
• CVE-2024-43828: ext4: fix infinite loop when replaying fast_commit (bsc#1229394).
• CVE-2024-43890: tracing: Fix overflow in get_free_elt() (bsc#1229764).
• CVE-2024-43898: ext4: sanity check for NULL pointer after ext4_force_shutdown (bsc#1229753).
• CVE-2024-43912: wifi: nl80211: disallow setting special AP channel widths (bsc#1229830)
• CVE-2024-43914: md/raid5: avoid BUG_ON() while continue reshape after reassembling (bsc#1229790).
• CVE-2024-44935: sctp: Fix null-ptr-deref in reuseport_add_sock() (bsc#1229810).
• CVE-2024-44944: netfilter: ctnetlink: use helper function to calculate expect ID (bsc#1229899).
• CVE-2024-44946: kcm: Serialise kcm_sendmsg() for the same socket (bsc#1230015).
• CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set (bsc#1230180).
• CVE-2024-44952: driver core: Fix uevent_show() vs driver detach race (bsc#1230178).
• CVE-2024-44970: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (bsc#1230209).
• CVE-2024-44971: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() (bsc#1230211).
• CVE-2024-44986: ipv6: fix possible UAF in ip6_finish_output2() (bsc#1230230)
• CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
• CVE-2024-44988: net: dsa: mv88e6xxx: Fix out-of-bound access (bsc#1230192).
• CVE-2024-44989: bonding: fix xfrm real_dev null pointer dereference (bsc#1230193).
• CVE-2024-44990: bonding: fix null pointer deref in bond_ipsec_offload_ok (bsc#1230194).
• CVE-2024-44998: atm: idt77252: prevent use after free in dequeue_rx() (bsc#1230171).
• CVE-2024-44999: gtp: pull network headers in gtp_dev_xmit()…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48901: btrfs: do not start relocation until in progress drops are done (bsc#1229607).
• CVE-2022-48911: kabi: add __nf_queue_get_refs() for kabi compliance. (bsc#1229633).
• CVE-2022-48923: btrfs: prevent copying too big compressed lzo segment (bsc#1229662)
• CVE-2022-48935: Fixed an unregister flowtable hooks on netns exit (bsc#1229619)
• CVE-2023-52610: net/sched: act_ct: fix skb leak and crash on ooo frags (bsc#1221610).
• CVE-2023-52916: media: aspeed: Fix memory overwrite if timing is 1600x900 (bsc#1230269).
• CVE-2024-26640: tcp: add sanity checks to rx zerocopy (bsc#1221650).
• CVE-2024-26759: mm/swap: fix race when skipping swapcache (bsc#1230340).
• CVE-2024-26767: drm/amd/display: fixed integer types and null check locations (bsc#1230339).
• CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).
• CVE-2024-26837: net: bridge: switchdev: race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).
• CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).
• CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).
• CVE-2024-38596: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (bsc#1226846).
• CVE-2024-40910: Fix refcount imbalance on inbound connections (bsc#1227832).
• CVE-2024-40973: media: mtk-vcodec: potential null pointer deference in SCP (bsc#1227890).
• CVE-2024-40983: tipc: force a dst refcount before doing decryption (bsc#1227819).
• CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620 CVE-2024-41082).
• CVE-2024-42154: tcp_metrics: validate source addr length (bsc#1228507).
• CVE-2024-42259: Fix Virtual Memory mapping boundaries calculation (bsc#1229156)
• CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
• CVE-2024-42304: ext4: make sure the first directory block is not a hole (bsc#1229364).
• CVE-2024-42305: ext4: check dot and dotdot of dx_root before making dir indexed (bsc#1229363).
• CVE-2024-42306: udf: Avoid using corrupted block bitmap buffer (bsc#1229362).
• CVE-2024-43828: ext4: fix infinite loop when replaying fast_commit (bsc#1229394).
• CVE-2024-43890: tracing: Fix overflow in get_free_elt() (bsc#1229764).
• CVE-2024-43898: ext4: sanity check for NULL pointer after ext4_force_shutdown (bsc#1229753).
• CVE-2024-43912: wifi: nl80211: disallow setting special AP channel widths (bsc#1229830)
• CVE-2024-43914: md/raid5: avoid BUG_ON() while continue reshape after reassembling (bsc#1229790).
• CVE-2024-44935: sctp: Fix null-ptr-deref in reuseport_add_sock() (bsc#1229810).
• CVE-2024-44944: netfilter: ctnetlink: use helper function to calculate expect ID (bsc#1229899).
• CVE-2024-44946: kcm: Serialise kcm_sendmsg() for the same socket (bsc#1230015).
• CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set (bsc#1230180).
• CVE-2024-44952: driver core: Fix uevent_show() vs driver detach race (bsc#1230178).
• CVE-2024-44970: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (bsc#1230209).
• CVE-2024-44971: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() (bsc#1230211).
• CVE-2024-44986: ipv6: fix possible UAF in ip6_finish_output2() (bsc#1230230)
• CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
• CVE-2024-44988: net: dsa: mv88e6xxx: Fix out-of-bound access (bsc#1230192).
• CVE-2024-44989: bonding: fix xfrm real_dev null pointer dereference (bsc#1230193).
• CVE-2024-44990: bonding: fix null pointer deref in bond_ipsec_offload_ok (bsc#1230194).
• CVE-2024-44998: atm: idt77252: prevent use after free in dequeue_rx() (bsc#1230171).
• CVE-2024-44999: gtp: pull network headers in…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48901: btrfs: do not start relocation until in progress drops are done (bsc#1229607).
• CVE-2022-48911: kabi: add __nf_queue_get_refs() for kabi compliance. (bsc#1229633).
• CVE-2022-48923: btrfs: prevent copying too big compressed lzo segment (bsc#1229662)
• CVE-2022-48935: Fixed an unregister flowtable hooks on netns exit (bsc#1229619)
• CVE-2023-52610: net/sched: act_ct: fix skb leak and crash on ooo frags (bsc#1221610).
• CVE-2023-52916: media: aspeed: Fix memory overwrite if timing is 1600x900 (bsc#1230269).
• CVE-2024-26640: tcp: add sanity checks to rx zerocopy (bsc#1221650).
• CVE-2024-26759: mm/swap: fix race when skipping swapcache (bsc#1230340).
• CVE-2024-26767: drm/amd/display: fixed integer types and null check locations (bsc#1230339).
• CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).
• CVE-2024-26837: net: bridge: switchdev: race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).
• CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).
• CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).
• CVE-2024-38596: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (bsc#1226846).
• CVE-2024-40910: Fix refcount imbalance on inbound connections (bsc#1227832).
• CVE-2024-40973: media: mtk-vcodec: potential null pointer deference in SCP (bsc#1227890).
• CVE-2024-40983: tipc: force a dst refcount before doing decryption (bsc#1227819).
• CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620 CVE-2024-41082).
• CVE-2024-42154: tcp_metrics: validate source addr length (bsc#1228507).
• CVE-2024-42259: Fix Virtual Memory mapping boundaries calculation (bsc#1229156)
• CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
• CVE-2024-42304: ext4: make sure the first directory block is not a hole (bsc#1229364).
• CVE-2024-42305: ext4: check dot and dotdot of dx_root before making dir indexed (bsc#1229363).
• CVE-2024-42306: udf: Avoid using corrupted block bitmap buffer (bsc#1229362).
• CVE-2024-43828: ext4: fix infinite loop when replaying fast_commit (bsc#1229394).
• CVE-2024-43890: tracing: Fix overflow in get_free_elt() (bsc#1229764).
• CVE-2024-43898: ext4: sanity check for NULL pointer after ext4_force_shutdown (bsc#1229753).
• CVE-2024-43912: wifi: nl80211: disallow setting special AP channel widths (bsc#1229830)
• CVE-2024-43914: md/raid5: avoid BUG_ON() while continue reshape after reassembling (bsc#1229790).
• CVE-2024-44935: sctp: Fix null-ptr-deref in reuseport_add_sock() (bsc#1229810).
• CVE-2024-44944: netfilter: ctnetlink: use helper function to calculate expect ID (bsc#1229899).
• CVE-2024-44946: kcm: Serialise kcm_sendmsg() for the same socket (bsc#1230015).
• CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set (bsc#1230180).
• CVE-2024-44952: driver core: Fix uevent_show() vs driver detach race (bsc#1230178).
• CVE-2024-44954: ALSA: line6: Fix racy access to midibuf (bsc#1230176).
• CVE-2024-44970: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (bsc#1230209).
• CVE-2024-44971: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() (bsc#1230211).
• CVE-2024-44986: ipv6: fix possible UAF in ip6_finish_output2() (bsc#1230230)
• CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
• CVE-2024-44988: net: dsa: mv88e6xxx: Fix out-of-bound access (bsc#1230192).
• CVE-2024-44989: bonding: fix xfrm real_dev null pointer dereference (bsc#1230193).
• CVE-2024-44990: bonding: fix null pointer deref in bond_ipsec_offload_ok (bsc#1230194).
• CVE-2024-44998: atm: idt77252: prevent use after free in dequeue_rx()…

The SUSE Linux Enterprise Micro 6.0 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52610: net/sched: act_ct: fix skb leak and crash on ooo frags (bsc#1221610).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52916: media: aspeed: Fix memory overwrite if timing is 1600x900 (bsc#1230269).
• CVE-2024-26640: tcp: add sanity checks to rx zerocopy (bsc#1221650).
• CVE-2024-26759: mm/swap: fix race when skipping swapcache (bsc#1230340).
• CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).
• CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).
• CVE-2024-38596: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (bsc#1226846).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-40973: media: mtk-vcodec: potential null pointer deference in SCP (bsc#1227890).
• CVE-2024-40983: tipc: force a dst refcount before doing decryption (bsc#1227819).
• CVE-2024-42154: tcp_metrics: validate source addr length (bsc#1228507).
• CVE-2024-42243: mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray (bsc#1229001).
• CVE-2024-42252: closures: Change BUG_ON() to WARN_ON() (bsc#1229004).
• CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
• CVE-2024-42294: block: fix deadlock between sd_remove & sd_release (bsc#1229371).
• CVE-2024-42304: ext4: make sure the first directory block is not a hole (bsc#1229364).
• CVE-2024-42305: ext4: check dot and dotdot of dx_root before making dir indexed (bsc#1229363).
• CVE-2024-42306: udf: Avoid using corrupted block bitmap buffer (bsc#1229362).
• CVE-2024-43828: ext4: fix infinite loop when replaying fast_commit (bsc#1229394).
• CVE-2024-43832: s390/uv: Do not call folio_wait_writeback() without a folio reference (bsc#1229380).
• CVE-2024-43845: udf: Fix bogus checksum computation in udf_rename() (bsc#1229389).
• CVE-2024-43890: tracing: Fix overflow in get_free_elt() (bsc#1229764).
• CVE-2024-43898: ext4: sanity check for NULL pointer after ext4_force_shutdown (bsc#1229753).
• CVE-2024-43914: md/raid5: avoid BUG_ON() while continue reshape after reassembling (bsc#1229790).
• CVE-2024-44935: sctp: Fix null-ptr-deref in reuseport_add_sock() (bsc#1229810).
• CVE-2024-44944: netfilter: ctnetlink: use helper function to calculate expect ID (bsc#1229899).
• CVE-2024-44946: kcm: Serialise kcm_sendmsg() for the same socket (bsc#1230015).
• CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set (bsc#1230180).
• CVE-2024-44951: serial: sc16is7xx: fix TX fifo corruption (bsc#1230181).
• CVE-2024-44970: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (bsc#1230209).
• CVE-2024-44971: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() (bsc#1230211).
• CVE-2024-44984: bnxt_en: Fix double DMA unmapping for XDP_REDIRECT (bsc#1230240).
• CVE-2024-44985: ipv6: prevent possible UAF in ip6_xmit() (bsc#1230206).
• CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
• CVE-2024-44988: net: dsa: mv88e6xxx: Fix out-of-bound access (bsc#1230192).
• CVE-2024-44989: bonding: fix xfrm real_dev null pointer dereference (bsc#1230193).
• CVE-2024-44990: bonding: fix null pointer deref in bond_ipsec_offload_ok (bsc#1230194).
• CVE-2024-44991: tcp: prevent concurrent execution of tcp_sk_exit_batch (bsc#1230195).
• CVE-2024-44998: atm: idt77252: prevent use after free in dequeue_rx() (bsc#1230171).
• CVE-2024-44999: gtp: pull network headers in gtp_dev_xmit() (bsc#1230233).
• CVE-2024-45002: rtla/osnoise: Prevent NULL dereference in error handling (bsc#1230169).
• CVE-2024-45003: Don't evict inode under the inode lru traversing context (bsc#1230245).
• CVE-2024-45013: nvme: move stopping keep-alive into nvme_uninit_ctrl() (bsc#1230442).
• CVE-2024-45017: net/mlx5: Fix IPsec…

The SUSE Linux Enterprise Micro 6.0 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52610: net/sched: act_ct: fix skb leak and crash on ooo frags (bsc#1221610).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52916: media: aspeed: Fix memory overwrite if timing is 1600x900 (bsc#1230269).
• CVE-2024-26640: tcp: add sanity checks to rx zerocopy (bsc#1221650).
• CVE-2024-26759: mm/swap: fix race when skipping swapcache (bsc#1230340).
• CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).
• CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).
• CVE-2024-38596: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (bsc#1226846).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-40973: media: mtk-vcodec: potential null pointer deference in SCP (bsc#1227890).
• CVE-2024-40983: tipc: force a dst refcount before doing decryption (bsc#1227819).
• CVE-2024-42154: tcp_metrics: validate source addr length (bsc#1228507).
• CVE-2024-42243: mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray (bsc#1229001).
• CVE-2024-42252: closures: Change BUG_ON() to WARN_ON() (bsc#1229004).
• CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
• CVE-2024-42294: block: fix deadlock between sd_remove & sd_release (bsc#1229371).
• CVE-2024-42304: ext4: make sure the first directory block is not a hole (bsc#1229364).
• CVE-2024-42305: ext4: check dot and dotdot of dx_root before making dir indexed (bsc#1229363).
• CVE-2024-42306: udf: Avoid using corrupted block bitmap buffer (bsc#1229362).
• CVE-2024-43828: ext4: fix infinite loop when replaying fast_commit (bsc#1229394).
• CVE-2024-43832: s390/uv: Do not call folio_wait_writeback() without a folio reference (bsc#1229380).
• CVE-2024-43845: udf: Fix bogus checksum computation in udf_rename() (bsc#1229389).
• CVE-2024-43890: tracing: Fix overflow in get_free_elt() (bsc#1229764).
• CVE-2024-43898: ext4: sanity check for NULL pointer after ext4_force_shutdown (bsc#1229753).
• CVE-2024-43914: md/raid5: avoid BUG_ON() while continue reshape after reassembling (bsc#1229790).
• CVE-2024-44935: sctp: Fix null-ptr-deref in reuseport_add_sock() (bsc#1229810).
• CVE-2024-44944: netfilter: ctnetlink: use helper function to calculate expect ID (bsc#1229899).
• CVE-2024-44946: kcm: Serialise kcm_sendmsg() for the same socket (bsc#1230015).
• CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set (bsc#1230180).
• CVE-2024-44951: serial: sc16is7xx: fix TX fifo corruption (bsc#1230181).
• CVE-2024-44970: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (bsc#1230209).
• CVE-2024-44971: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() (bsc#1230211).
• CVE-2024-44984: bnxt_en: Fix double DMA unmapping for XDP_REDIRECT (bsc#1230240).
• CVE-2024-44985: ipv6: prevent possible UAF in ip6_xmit() (bsc#1230206).
• CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
• CVE-2024-44988: net: dsa: mv88e6xxx: Fix out-of-bound access (bsc#1230192).
• CVE-2024-44989: bonding: fix xfrm real_dev null pointer dereference (bsc#1230193).
• CVE-2024-44990: bonding: fix null pointer deref in bond_ipsec_offload_ok (bsc#1230194).
• CVE-2024-44991: tcp: prevent concurrent execution of tcp_sk_exit_batch (bsc#1230195).
• CVE-2024-44998: atm: idt77252: prevent use after free in dequeue_rx() (bsc#1230171).
• CVE-2024-44999: gtp: pull network headers in gtp_dev_xmit() (bsc#1230233).
• CVE-2024-45002: rtla/osnoise: Prevent NULL dereference in error handling (bsc#1230169).
• CVE-2024-45003: Don't evict inode under the inode lru traversing context (bsc#1230245).
• CVE-2024-45013: nvme: move stopping keep-alive into nvme_uninit_ctrl() (bsc#1230442).
• CVE-2024-45017: net/mlx5: Fix…

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate certain data structure fields when parsing lease contexts, leading to an out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-1194)

Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel, leading to a use-after-free vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32254)

It was discovered that a race condition existed in the KSMBD implementation in the Linux kernel when handling session connections, leading to a use- after-free vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32258)

It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer sizes in certain operations, leading to an integer underflow and out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-38427)

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate SMB request protocol IDs, leading to a out-of- bounds read vulnerability. A remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-38430)

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate packet header sizes in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-38431)

It was discovered that the KSMBD implementation in the Linux kernel did not properly handle session setup requests, leading to an out-of-bounds read vulnerability. A remote attacker could use this to expose sensitive information. (CVE-2023-3867)

Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2023-46838)

It was discovered that the IPv6 implementation of the Linux kernel did not properly manage route cache memory usage. A remote attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-52340)

It was discovered that the device mapper driver in the Linux kernel did not properly validate target size during certain memory allocations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-52429, CVE-2024-23851)

Yang Chaoming discovered that the KSMBD implementation in the Linux kernel did not properly validate request buffer sizes, leading to an out-of-bounds read vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-22705)

Chenyuan Yang discovered that the btrfs file system in the Linux kernel did not properly handle read operations on newly created subvolumes in certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-23850)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Architecture specifics;
• Block layer;
• Cryptographic API;
• Android drivers;…

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate certain data structure fields when parsing lease contexts, leading to an out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-1194)

Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel, leading to a use-after-free vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32254)

It was discovered that a race condition existed in the KSMBD implementation in the Linux kernel when handling session connections, leading to a use- after-free vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32258)

It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer sizes in certain operations, leading to an integer underflow and out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-38427)

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate SMB request protocol IDs, leading to a out-of- bounds read vulnerability. A remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-38430)

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate packet header sizes in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-38431)

It was discovered that the KSMBD implementation in the Linux kernel did not properly handle session setup requests, leading to an out-of-bounds read vulnerability. A remote attacker could use this to expose sensitive information. (CVE-2023-3867)

Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2023-46838)

It was discovered that the IPv6 implementation of the Linux kernel did not properly manage route cache memory usage. A remote attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-52340)

It was discovered that the device mapper driver in the Linux kernel did not properly validate target size during certain memory allocations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-52429, CVE-2024-23851)

Yang Chaoming discovered that the KSMBD implementation in the Linux kernel did not properly validate request buffer sizes, leading to an out-of-bounds read vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-22705)

Chenyuan Yang discovered that the btrfs file system in the Linux kernel did not properly handle read operations on newly created subvolumes in certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-23850)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Architecture specifics;
• Block layer;
• Cryptographic API;
• Android drivers;…

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-6356, CVE-2023-6535, CVE-2023-6536)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Power management core;
• Bus devices;
• Device frequency scaling framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• GPU drivers;
• IIO ADC drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Media drivers;
• Multifunction device drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI driver for MicroSemi Switchtec;
• Power supply drivers;
• RPMSG subsystem;
• SCSI drivers;
• QCOM SoC drivers;
• SPMI drivers;
• Thermal drivers;
• TTY drivers;
• VFIO drivers;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file systems library;
• Network file system server daemon;
• File systems infrastructure;
• Pstore file system;
• ReiserFS file system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• TLS protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NetLabel subsystem;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• AppArmor security module;
• Intel ASoC drivers;
• MediaTek ASoC drivers;
• USB sound devices; (CVE-2023-52598, CVE-2023-52676, CVE-2023-52609, CVE-2024-26620, CVE-2023-52487, CVE-2023-52465, CVE-2023-52473, CVE-2023-52467, CVE-2024-26583, CVE-2023-52669, CVE-2023-52664, CVE-2023-52449, CVE-2023-52614, CVE-2024-26595, CVE-2023-52611, CVE-2023-52696, CVE-2023-52591, CVE-2023-52491, CVE-2024-35839, CVE-2023-52679, CVE-2024-26607, CVE-2023-52587, CVE-2023-52469, CVE-2023-52608, CVE-2023-52617, CVE-2023-52698, CVE-2024-26673, CVE-2024-35835, CVE-2024-26808, CVE-2024-26668, CVE-2023-52626, CVE-2023-52621, CVE-2024-35837, CVE-2023-52489, CVE-2023-52597, CVE-2024-26649, CVE-2024-26615, CVE-2024-35838, CVE-2023-52693, CVE-2023-52497, CVE-2024-35842, CVE-2024-26618, CVE-2024-26610, CVE-2024-26631, CVE-2024-26644, CVE-2024-26627, CVE-2023-52677, CVE-2023-52472, CVE-2023-52627, CVE-2023-52486, CVE-2023-52632, CVE-2023-52494, CVE-2023-52468, CVE-2024-26634, CVE-2023-52588, CVE-2024-26646, CVE-2024-26584, CVE-2023-52443, CVE-2023-52691, CVE-2024-26612, CVE-2023-52595, CVE-2024-26592, CVE-2024-26623, CVE-2023-52492, CVE-2024-26670, CVE-2023-52583, CVE-2023-52681, CVE-2023-52635, CVE-2023-52457,…

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-6356, CVE-2023-6535, CVE-2023-6536)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Power management core;
• Bus devices;
• Device frequency scaling framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• GPU drivers;
• IIO ADC drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Media drivers;
• Multifunction device drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI driver for MicroSemi Switchtec;
• Power supply drivers;
• RPMSG subsystem;
• SCSI drivers;
• QCOM SoC drivers;
• SPMI drivers;
• Thermal drivers;
• TTY drivers;
• VFIO drivers;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file systems library;
• Network file system server daemon;
• File systems infrastructure;
• Pstore file system;
• ReiserFS file system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• TLS protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NetLabel subsystem;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• AppArmor security module;
• Intel ASoC drivers;
• MediaTek ASoC drivers;
• USB sound devices; (CVE-2023-52598, CVE-2023-52676, CVE-2023-52609, CVE-2024-26620, CVE-2023-52487, CVE-2023-52465, CVE-2023-52473, CVE-2023-52467, CVE-2024-26583, CVE-2023-52669, CVE-2023-52664, CVE-2023-52449, CVE-2023-52614, CVE-2024-26595, CVE-2023-52611, CVE-2023-52696, CVE-2023-52591, CVE-2023-52491, CVE-2024-35839, CVE-2023-52679, CVE-2024-26607, CVE-2023-52587, CVE-2023-52469, CVE-2023-52608, CVE-2023-52617, CVE-2023-52698, CVE-2024-26673, CVE-2024-35835, CVE-2024-26808, CVE-2024-26668, CVE-2023-52626, CVE-2023-52621, CVE-2024-35837, CVE-2023-52489, CVE-2023-52597, CVE-2024-26649, CVE-2024-26615, CVE-2024-35838, CVE-2023-52693, CVE-2023-52497, CVE-2024-35842, CVE-2024-26618, CVE-2024-26610, CVE-2024-26631, CVE-2024-26644, CVE-2024-26627, CVE-2023-52677, CVE-2023-52472, CVE-2023-52627, CVE-2023-52486, CVE-2023-52632, CVE-2023-52494, CVE-2023-52468, CVE-2024-26634, CVE-2023-52588, CVE-2024-26646, CVE-2024-26584, CVE-2023-52443, CVE-2023-52691, CVE-2024-26612, CVE-2023-52595, CVE-2024-26592, CVE-2024-26623, CVE-2023-52492, CVE-2024-26670, CVE-2023-52583, CVE-2023-52681, CVE-2023-52635, CVE-2023-52457,…

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-6356, CVE-2023-6535, CVE-2023-6536)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Power management core;
• Bus devices;
• Device frequency scaling framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• GPU drivers;
• IIO ADC drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Media drivers;
• Multifunction device drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI driver for MicroSemi Switchtec;
• Power supply drivers;
• RPMSG subsystem;
• SCSI drivers;
• QCOM SoC drivers;
• SPMI drivers;
• Thermal drivers;
• TTY drivers;
• VFIO drivers;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file systems library;
• Network file system server daemon;
• File systems infrastructure;
• Pstore file system;
• ReiserFS file system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• TLS protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NetLabel subsystem;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• AppArmor security module;
• Intel ASoC drivers;
• MediaTek ASoC drivers;
• USB sound devices; (CVE-2023-52598, CVE-2023-52676, CVE-2023-52609, CVE-2024-26620, CVE-2023-52487, CVE-2023-52465, CVE-2023-52473, CVE-2023-52467, CVE-2024-26583, CVE-2023-52669, CVE-2023-52664, CVE-2023-52449, CVE-2023-52614, CVE-2024-26595, CVE-2023-52611, CVE-2023-52696, CVE-2023-52591, CVE-2023-52491, CVE-2024-35839, CVE-2023-52679, CVE-2024-26607, CVE-2023-52587, CVE-2023-52469, CVE-2023-52608, CVE-2023-52617, CVE-2023-52698, CVE-2024-26673, CVE-2024-35835, CVE-2024-26808, CVE-2024-26668, CVE-2023-52626, CVE-2023-52621, CVE-2024-35837, CVE-2023-52489, CVE-2023-52597, CVE-2024-26649, CVE-2024-26615, CVE-2024-35838, CVE-2023-52693, CVE-2023-52497, CVE-2024-35842, CVE-2024-26618, CVE-2024-26610, CVE-2024-26631, CVE-2024-26644, CVE-2024-26627, CVE-2023-52677, CVE-2023-52472, CVE-2023-52627, CVE-2023-52486, CVE-2023-52632, CVE-2023-52494, CVE-2023-52468, CVE-2024-26634, CVE-2023-52588, CVE-2024-26646, CVE-2024-26584, CVE-2023-52443, CVE-2023-52691, CVE-2024-26612, CVE-2023-52595, CVE-2024-26592, CVE-2024-26623, CVE-2023-52492, CVE-2024-26670, CVE-2023-52583, CVE-2023-52681, CVE-2023-52635, CVE-2023-52457,…

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-6356, CVE-2023-6535, CVE-2023-6536)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Power management core;
• Bus devices;
• Device frequency scaling framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• GPU drivers;
• IIO ADC drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Media drivers;
• Multifunction device drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI driver for MicroSemi Switchtec;
• Power supply drivers;
• RPMSG subsystem;
• SCSI drivers;
• QCOM SoC drivers;
• SPMI drivers;
• Thermal drivers;
• TTY drivers;
• VFIO drivers;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file systems library;
• Network file system server daemon;
• File systems infrastructure;
• Pstore file system;
• ReiserFS file system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• TLS protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NetLabel subsystem;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• AppArmor security module;
• Intel ASoC drivers;
• MediaTek ASoC drivers;
• USB sound devices; (CVE-2023-52612, CVE-2024-26808, CVE-2023-52691, CVE-2023-52618, CVE-2023-52463, CVE-2023-52447, CVE-2024-26668, CVE-2023-52454, CVE-2024-26670, CVE-2024-26646, CVE-2023-52472, CVE-2024-26586, CVE-2023-52681, CVE-2023-52453, CVE-2023-52611, CVE-2023-52622, CVE-2024-26641, CVE-2023-52616, CVE-2024-26592, CVE-2023-52606, CVE-2024-26620, CVE-2023-52692, CVE-2024-26669, CVE-2023-52623, CVE-2023-52588, CVE-2024-26616, CVE-2024-26610, CVE-2024-35839, CVE-2023-52490, CVE-2023-52672, CVE-2024-26612, CVE-2023-52617, CVE-2023-52697, CVE-2024-26644, CVE-2023-52458, CVE-2023-52598, CVE-2024-35841, CVE-2023-52664, CVE-2023-52635, CVE-2023-52676, CVE-2023-52669, CVE-2024-26632, CVE-2023-52486, CVE-2024-26625, CVE-2023-52608, CVE-2024-26634, CVE-2023-52599, CVE-2024-26618, CVE-2024-26640, CVE-2023-52489, CVE-2023-52675, CVE-2023-52678, CVE-2024-26583, CVE-2023-52693, CVE-2023-52498, CVE-2024-26649, CVE-2023-52670, CVE-2023-52473, CVE-2023-52449, CVE-2023-52667, CVE-2023-52467, CVE-2023-52686, CVE-2024-26633, CVE-2023-52666, CVE-2024-35840, CVE-2024-26629, CVE-2024-26595, CVE-2023-52593, CVE-2023-52687, CVE-2023-52465, CVE-2024-26627, CVE-2023-52493, CVE-2023-52491, CVE-2024-26636, CVE-2024-26584, CVE-2023-52587, CVE-2023-52597, CVE-2023-52462, CVE-2023-52633, CVE-2023-52696, CVE-2024-26585, CVE-2023-52589, CVE-2023-52456, CVE-2023-52470, CVE-2024-35838, CVE-2024-26645,…

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-6356, CVE-2023-6535, CVE-2023-6536)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Power management core;
• Bus devices;
• Device frequency scaling framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• GPU drivers;
• IIO ADC drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Media drivers;
• Multifunction device drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI driver for MicroSemi Switchtec;
• Power supply drivers;
• RPMSG subsystem;
• SCSI drivers;
• QCOM SoC drivers;
• SPMI drivers;
• Thermal drivers;
• TTY drivers;
• VFIO drivers;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file systems library;
• Network file system server daemon;
• File systems infrastructure;
• Pstore file system;
• ReiserFS file system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• TLS protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NetLabel subsystem;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• AppArmor security module;
• Intel ASoC drivers;
• MediaTek ASoC drivers;
• USB sound devices; (CVE-2023-52612, CVE-2024-26808, CVE-2023-52691, CVE-2023-52618, CVE-2023-52463, CVE-2023-52447, CVE-2024-26668, CVE-2023-52454, CVE-2024-26670, CVE-2024-26646, CVE-2023-52472, CVE-2024-26586, CVE-2023-52681, CVE-2023-52453, CVE-2023-52611, CVE-2023-52622, CVE-2024-26641, CVE-2023-52616, CVE-2024-26592, CVE-2023-52606, CVE-2024-26620, CVE-2023-52692, CVE-2024-26669, CVE-2023-52623, CVE-2023-52588, CVE-2024-26616, CVE-2024-26610, CVE-2024-35839, CVE-2023-52490, CVE-2023-52672, CVE-2024-26612, CVE-2023-52617, CVE-2023-52697, CVE-2024-26644, CVE-2023-52458, CVE-2023-52598, CVE-2024-35841, CVE-2023-52664, CVE-2023-52635, CVE-2023-52676, CVE-2023-52669, CVE-2024-26632, CVE-2023-52486, CVE-2024-26625, CVE-2023-52608, CVE-2024-26634, CVE-2023-52599, CVE-2024-26618, CVE-2024-26640, CVE-2023-52489, CVE-2023-52675, CVE-2023-52678, CVE-2024-26583, CVE-2023-52693, CVE-2023-52498, CVE-2024-26649, CVE-2023-52670, CVE-2023-52473, CVE-2023-52449, CVE-2023-52667, CVE-2023-52467, CVE-2023-52686, CVE-2024-26633, CVE-2023-52666, CVE-2024-35840, CVE-2024-26629, CVE-2024-26595, CVE-2023-52593, CVE-2023-52687, CVE-2023-52465, CVE-2024-26627, CVE-2023-52493, CVE-2023-52491, CVE-2024-26636, CVE-2024-26584, CVE-2023-52587, CVE-2023-52597, CVE-2023-52462, CVE-2023-52633, CVE-2023-52696, CVE-2024-26585, CVE-2023-52589, CVE-2023-52456, CVE-2023-52470, CVE-2024-35838, CVE-2024-26645,…

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-6356, CVE-2023-6535, CVE-2023-6536)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Power management core;
• Bus devices;
• Device frequency scaling framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• GPU drivers;
• IIO ADC drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Media drivers;
• Multifunction device drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI driver for MicroSemi Switchtec;
• Power supply drivers;
• RPMSG subsystem;
• SCSI drivers;
• QCOM SoC drivers;
• SPMI drivers;
• Thermal drivers;
• TTY drivers;
• VFIO drivers;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file systems library;
• Network file system server daemon;
• File systems infrastructure;
• Pstore file system;
• ReiserFS file system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• TLS protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NetLabel subsystem;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• AppArmor security module;
• Intel ASoC drivers;
• MediaTek ASoC drivers;
• USB sound devices; (CVE-2023-52612, CVE-2024-26808, CVE-2023-52691, CVE-2023-52618, CVE-2023-52463, CVE-2023-52447, CVE-2024-26668, CVE-2023-52454, CVE-2024-26670, CVE-2024-26646, CVE-2023-52472, CVE-2024-26586, CVE-2023-52681, CVE-2023-52453, CVE-2023-52611, CVE-2023-52622, CVE-2024-26641, CVE-2023-52616, CVE-2024-26592, CVE-2023-52606, CVE-2024-26620, CVE-2023-52692, CVE-2024-26669, CVE-2023-52623, CVE-2023-52588, CVE-2024-26616, CVE-2024-26610, CVE-2024-35839, CVE-2023-52490, CVE-2023-52672, CVE-2024-26612, CVE-2023-52617, CVE-2023-52697, CVE-2024-26644, CVE-2023-52458, CVE-2023-52598, CVE-2024-35841, CVE-2023-52664, CVE-2023-52635, CVE-2023-52676, CVE-2023-52669, CVE-2024-26632, CVE-2023-52486, CVE-2024-26625, CVE-2023-52608, CVE-2024-26634, CVE-2023-52599, CVE-2024-26618, CVE-2024-26640, CVE-2023-52489, CVE-2023-52675, CVE-2023-52678, CVE-2024-26583, CVE-2023-52693, CVE-2023-52498, CVE-2024-26649, CVE-2023-52670, CVE-2023-52473, CVE-2023-52449, CVE-2023-52667, CVE-2023-52467, CVE-2023-52686, CVE-2024-26633, CVE-2023-52666, CVE-2024-35840, CVE-2024-26629, CVE-2024-26595, CVE-2023-52593, CVE-2023-52687, CVE-2023-52465, CVE-2024-26627, CVE-2023-52493, CVE-2023-52491, CVE-2024-26636, CVE-2024-26584, CVE-2023-52587, CVE-2023-52597, CVE-2023-52462, CVE-2023-52633, CVE-2023-52696, CVE-2024-26585, CVE-2023-52589, CVE-2023-52456, CVE-2023-52470, CVE-2024-35838, CVE-2024-26645,…