CVE-2022-50356

In the Linux kernel, the following vulnerability has been resolved: net: sched: sfb: fix null pointer access issue when sfb_init() fails When the default qdisc is sfb, if the qdisc of dev_queue fails to be inited during mqprio_init(), sfb_reset() is invoked to clear resources. In this case, the q->qdisc is NULL, and it will cause gpf issue. The process is as follows: qdisc_create_dflt() sfb_init() tcf_block_get() --->failed, q->qdisc is NULL ... qdisc_put() ... sfb_reset() qdisc_reset(q->qdisc) --->q->qdisc is NULL ops = qdisc->ops The following is the Call Trace information: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] RIP: 0010:qdisc_reset+0x2b/0x6f0 Call Trace: <TASK> sfb_reset+0x37/0xd0 qdisc_reset+0xed/0x6f0 qdisc_destroy+0x82/0x4c0 qdisc_put+0x9e/0xb0 qdisc_create_dflt+0x2c3/0x4a0 mqprio_init+0xa71/0x1760 qdisc_create+0x3eb/0x1000 tc_modify_qdisc+0x408/0x1720 rtnetlink_rcv_msg+0x38e/0xac0 netlink_rcv_skb+0x12d/0x3a0 netlink_unicast+0x4a2/0x740 netlink_sendmsg+0x826/0xcc0 sock_sendmsg+0xc5/0x100 ____sys_sendmsg+0x583/0x690 ___sys_sendmsg+0xe8/0x160 __sys_sendmsg+0xbf/0x160 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f2164122d04 </TASK>

• drm/amd/amdgpu: introduce gc_*_mes_2.bin v2
• proc: fix a dentry lock race between release_task and lookup
• scsi: aacraid: Stop using PCI_IRQ_AFFINITY
• scsi: aacraid: Remove useless code
• scsi: aacraid: Remove unused aac_check_health()
• scsi: aacraid: struct {user,}sgmap{,64,raw}: Replace 1-element arrays with flexible arrays
• scsi: aacraid: Rearrange order of struct aac_srb_unit
• scsi: aacraid: struct aac_ciss_phys_luns_resp: Replace 1-element array with flexible array
• scsi: aacraid: union aac_init: Replace 1-element array with flexible array
• scsi: aacraid: aachba: Replace snprintf() with the safer scnprintf() variant
• Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity"
• scsi: aacraid: Avoid -Warray-bounds warning
• scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity
• scsi: aacraid: Replace all non-returning strlcpy with strscpy
• scsi: aacraid: Declare SCSI host template const
• scsi: aacraid: Drop redundant pci_enable_pcie_error_reporting()
• scsi: aacraid: Allocate cmd_priv with scsicmd
• scsi: aacraid: Remove redundant "the"
• scsi: aacraid: Fix undefined behavior due to shift overflowing the constant
• scsi: aacraid: Clean up some inconsistent indenting
• scsi: aacraid: Move the SCSI pointer to private command data
• scsi: aacraid: Fix spelling of "its"
• scsi: aacraid: Call scsi_done() directly
• scsi: aacraid: Introduce aac_scsi_done()
• scsi: aacraid: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
• scsi: aacraid: Remove an unused include
• x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler {CVE-2024-25743}
• net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356}
• ipv6: mcast: Delay put pmc->idev in mld_del_delrec() {CVE-2025-38550}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• PM: hibernate: defer device probing when resuming from hibernation {CVE-2022-50202}
• net: fix UaF in netns ops registration error path {CVE-2023-52999}
• net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed {CVE-2023-52999}
• usb: typec: fix potential array underflow in ucsi_ccg_sync_control() {CVE-2024-53203}
• soundwire: cadence: fix invalid PDI offset {CVE-2024-38635}
• drm/i915/vma: Fix UAF on destroy against retire race {CVE-2024-26939}
• netns: Make get_net_ns() handle zero refcount net {CVE-2024-40958}
• bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() {CVE-2024-39487}
• wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921}
• wifi: ath11k: fix gtk offload status event locking {CVE-2023-52777}
• wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
• i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() {CVE-2022-48632}
• net/sched: act_mirred: don't override retval if we already lost the skb {CVE-2024-26739}
• can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv {CVE-2021-47459}
• net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg {CVE-2021-47596}
• Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
• crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
• crypto: qat - fix double free during reset
• media: pvrusb2: fix use after free on context disconnection {CVE-2023-52445}
• fs/smb/client: Reset password pointer to NULL {CVE-2023-5345}

• fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297}
• net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356}
• ALSA: usb-audio: Fix size validation in convert_chmap_v3()
• nfsd: don't ignore the return code of svc_proc_register() {CVE-2025-22026}
• net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull {CVE-2023-53104}
• net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
• HID: stop exporting hid_snto32()
• HID: simplify snto32()
• HID: core: fix shift-out-of-bounds in hid_report_raw_event {CVE-2022-48978}
• HID: core: detect and skip invalid inputs to snto32()
• HID: core: don't use negative operands when shift

• fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297}
• net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356}
• ALSA: usb-audio: Fix size validation in convert_chmap_v3()
• nfsd: don't ignore the return code of svc_proc_register() {CVE-2025-22026}
• net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull {CVE-2023-53104}
• net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
• HID: stop exporting hid_snto32()
• HID: simplify snto32()
• HID: core: fix shift-out-of-bounds in hid_report_raw_event {CVE-2022-48978}
• HID: core: detect and skip invalid inputs to snto32()
• HID: core: don't use negative operands when shift

• fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297}
• net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356}
• ALSA: usb-audio: Fix size validation in convert_chmap_v3()
• nfsd: don't ignore the return code of svc_proc_register() {CVE-2025-22026}
• net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull {CVE-2023-53104}
• net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
• HID: stop exporting hid_snto32()
• HID: simplify snto32()
• HID: core: fix shift-out-of-bounds in hid_report_raw_event {CVE-2022-48978}
• HID: core: detect and skip invalid inputs to snto32()
• HID: core: don't use negative operands when shift

• libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
• svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
• drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
• netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
• scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
• bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
• drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
• ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
• tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
• wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
• drm/i915/gem: Really move i915_gem_context.link under ref protection {CVE-2022-48662}
• drm/i915: Release i915_gem_context from a worker {CVE-2022-48662}
• KVM: x86/mmu: Don't advance iterator after restart due to yielding {CVE-2021-47094}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356}
• skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
• nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
• icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
• RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device {CVE-2023-53393}
• scsi: target: iscsi: Fix a race condition between login_work and the login thread {CVE-2022-50350}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
• team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
• cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
• bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
• net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• ice: Fix memory corruption in VF driver {CVE-2022-49722}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• netfilter: nf_conntrack_helper: pass helper to…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• !CONFIG & reference -> this is bug, immediate fail
• CONFIG & no reference -> OK temporarily, must be resolved eventually
• Do not self obsolete older kernel variants
• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Update config files. (bsc#1249186) Enable where we define KABI refs + rely on Kconfig deps.
• build_bug.h: Add KABI assert (bsc#1249186).
• hv_netvsc: Fix panic during namespace deletion with VF (bsc#1248111).
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
• kernel-syms.spec: Drop…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
• CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
• CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
• CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
• CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
• CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
• CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
• CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
• CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
• CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
• CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
• CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
• CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
• CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
• CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
• CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
• CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
• CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
• CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
• CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
• CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).

The following non-security bugs were fixed:

• Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186).
• Limit patch filenames to 100 characters (bsc#1249604).
• Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
• Revert selinux patches that caused regressions (bsc#1249353).
• btrfs: avoid NULL pointer dereference if no valid extent tree (bsc#1249158).
• build_bug.h: Add KABI assert (bsc#1249186).
• hv_netvsc: Fix panic during namespace deletion with VF (bsc#1248111).
• kabi/severities: ignore kABI for atheros helper modules The symbols are used only internally by atheros drivers.
• kernel-binary: Another installation ordering fix (bsc#1241353).
• kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
• kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
• kernel-syms.spec: Drop…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2021-4460: drm/amdkfd: Fix UBSAN shift-out-of-bounds warning (bsc#1250764).
• CVE-2022-48631: ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 (bsc#1223475).
• CVE-2022-50236: iommu/mediatek: Fix crash on isr after kexec() (bsc#1249702).
• CVE-2022-50249: memory: of: Fix refcount leak bug in of_get_ddr_timings() (bsc#1249747).
• CVE-2022-50280: pnode: terminate at peers of source (bsc#1249806).
• CVE-2022-50293: btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range (bsc#1249752).
• CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
• CVE-2022-50350: scsi: target: iscsi: Fix a race condition between login_work and the login thread (bsc#1250261).
• CVE-2022-50356: net: sched: sfb: fix null pointer access issue when sfb_init() fails (bsc#1250040).
• CVE-2022-50367: fs: fix UAF/GPF bug in nilfs_mdt_destroy (bsc#1250277).
• CVE-2022-50394: i2c: ismt: Fix an out-of-bounds bug in ismt_access() (bsc#1250107).
• CVE-2022-50395: integrity: Fix memory leakage in keyring allocation error path (bsc#1250211).
• CVE-2022-50423: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (bsc#1250784).
• CVE-2022-50443: drm/rockchip: lvds: fix PM usage counter unbalance in poweron (bsc#1250768).
• CVE-2022-50459: scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() (bsc#1250850).
• CVE-2022-50481: cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() (bsc#1251051).
• CVE-2022-50485: ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode (bsc#1251197).
• CVE-2022-50505: iommu/amd: Fix pci device refcount leak in ppr_notifier() (bsc#1251086).
• CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
• CVE-2022-50542: media: si470x: Fix use-after-free in si470x_int_in_callback() (bsc#1251330).
• CVE-2022-50571: btrfs: call __btrfs_remove_free_space_cache_locked on cache load failure (bsc#1252487).
• CVE-2023-53183: btrfs: exit gracefully if reloc roots don't match (bsc#1249863).
• CVE-2023-53185: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (bsc#1249820).
• CVE-2023-53188: net: openvswitch: fix race on port output (bsc#1249854).
• CVE-2023-53191: irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains (bsc#1249721).
• CVE-2023-53204: af_unix: Fix data-races around user->unix_inflight (bsc#1249682).
• CVE-2023-53271: ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (bsc#1249916).
• CVE-2023-53282: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write (bsc#1250311).
• CVE-2023-53289: media: bdisp: Add missing check for create_workqueue (bsc#1249941).
• CVE-2023-53292: blk-mq: protect q->elevator by ->sysfs_lock in blk_mq_elv_switch_none (bsc#1250163).
• CVE-2023-53338: lwt: Fix return values of BPF xmit ops (bsc#1250074).
• CVE-2023-53339: btrfs: fix BUG_ON condition in btrfs_cancel_balance (bsc#1250329).
• CVE-2023-53373: crypto: seqiv - Handle EBUSY correctly (bsc#1250137).
• CVE-2023-53433: net: add vlan_get_protocol_and_depth() helper (bsc#1250164).
• CVE-2023-53476: iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() (bsc#1250839).
• CVE-2023-53477: ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (bsc#1250840).
• CVE-2023-53484: lib: cpu_rmap: Avoid use after free on rmap->obj array entries (bsc#1250895).
• CVE-2023-53517: tipc: do not update mtu if msg_max is too small in mtu negotiation (bsc#1250919).
• CVE-2023-53519: media: v4l2-mem2mem: add lock to protect parameter num_rdy (bsc#1250964).
• CVE-2023-53540: wifi: cfg80211: reject auth/assoc to AP with our address (bsc#1251053).
• CVE-2023-53548: net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (bsc#1251066).
• CVE-2023-53556: iavf: Fix use-after-free in free_netdev (bsc#1251059). -…