CVE-2021-47600

In the Linux kernel, the following vulnerability has been resolved: dm btree remove: fix use after free in rebalance_children() Move dm_tm_unlock() after dm_tm_dec().

• CVE-url: https://ubuntu.com/security/CVE-2024-26752
  • l2tp: pass correct message length to ip6_append_data
• CVE-url: https://ubuntu.com/security/CVE-2023-52527
  • ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
• CVE-url: https://ubuntu.com/security/CVE-2024-43882
  • exec: Fix ToCToU between perm check and set-uid/gid usage
• CVE-url: https://ubuntu.com/security/CVE-2022-48943
  • KVM: x86/mmu: make apf token non-zero to fix bug
• CVE-url: https://ubuntu.com/security/CVE-2024-38630
  • watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
• CVE-url: https://ubuntu.com/security/CVE-2024-44987
  • ipv6: prevent UAF in ip6_send_skb()
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48742
  • rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
• CVE-url: https://ubuntu.com/security/CVE-2024-44940
  • fou: remove warn in gue_gro_receive on unsupported protocol
• CVE-url: https://ubuntu.com/security/CVE-2024-41059
  • hfsplus: fix uninit-value in copy_name
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47576
  • scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
• CVE-url: https://ubuntu.com/security/CVE-2024-46673
  • scsi: aacraid: Fix double-free on probe failure
• CVE-url: https://ubuntu.com/security/CVE-2024-42271
  • net/iucv: fix use after free in iucv_sock_close()
• Bionic update: upstream stable patchset 2022-04-13 (LP: #1968932) // CVE- url: https://ubuntu.com/security/CVE-2022-48919
  • cifs: fix double free race when mount fails in cifs_get_root()
• CVE-url: https://ubuntu.com/security/CVE-2024-43858
  • jfs: Fix array-index-out-of-bounds in diFree
• CVE-url: https://ubuntu.com/security/CVE-2024-41071
  • wifi: mac80211: Avoid address calculations via out of bounds array indexing
• CVE-url: https://ubuntu.com/security/CVE-2024-42301
  • dev/parport: fix the array out-of-bounds risk
• CVE-url: https://ubuntu.com/security/CVE-2024-46674
  • usb: dwc3: st: fix probed platform device ref count on probe error path
• CVE-url: https://ubuntu.com/security/CVE-2024-43900
  • media: xc2028: avoid use-after-free in load_firmware_cb()
• CVE-url: https://ubuntu.com/security/CVE-2024-42284
  • tipc: Return non-zero value from tipc_udp_addr2str() on error
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47589
  • igbvf: fix double free in igbvf_probe
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47600
  • dm btree remove: fix use after free in rebalance_children()
• CVE-url: https://ubuntu.com/security/CVE-2024-44998
  • atm: idt77252: prevent use after free in dequeue_rx()
• CVE-url: https://ubuntu.com/security/CVE-2024-42280
  • mISDN: Fix a use after free in hfcmulti_tx()
• CVE-url: https://ubuntu.com/security/CVE-2024-42094
  • net/iucv: Avoid explicit cpumask var allocation on stack
• CVE-url: https://ubuntu.com/security/CVE-2024-39499
  • vmci: prevent speculation leaks by sanitizing event in event_deliver()
• CVE-url: https://ubuntu.com/security/CVE-2024-42105
  • nilfs2: fix inode number range checks
• CVE-url: https://ubuntu.com/security/CVE-2024-40988
  • drm/radeon: fix UBSAN warning in kv_dpm.c
• CVE-url: https://ubuntu.com/security/CVE-2024-40916
  • drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found
• CVE-url: https://ubuntu.com/security/CVE-2024-40904
  • USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
• CVE-url: https://ubuntu.com/security/CVE-2024-42106
  • inet_diag: Initialize pad field in struct…

• CVE-url: https://ubuntu.com/security/CVE-2024-26752
  • l2tp: pass correct message length to ip6_append_data
• CVE-url: https://ubuntu.com/security/CVE-2023-52527
  • ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
• CVE-url: https://ubuntu.com/security/CVE-2024-43882
  • exec: Fix ToCToU between perm check and set-uid/gid usage
• CVE-url: https://ubuntu.com/security/CVE-2022-48943
  • KVM: x86/mmu: make apf token non-zero to fix bug
• CVE-url: https://ubuntu.com/security/CVE-2024-38630
  • watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
• CVE-url: https://ubuntu.com/security/CVE-2024-44987
  • ipv6: prevent UAF in ip6_send_skb()
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48742
  • rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
• CVE-url: https://ubuntu.com/security/CVE-2024-44940
  • fou: remove warn in gue_gro_receive on unsupported protocol
• CVE-url: https://ubuntu.com/security/CVE-2024-41059
  • hfsplus: fix uninit-value in copy_name
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47576
  • scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
• CVE-url: https://ubuntu.com/security/CVE-2024-46673
  • scsi: aacraid: Fix double-free on probe failure
• CVE-url: https://ubuntu.com/security/CVE-2024-42271
  • net/iucv: fix use after free in iucv_sock_close()
• Bionic update: upstream stable patchset 2022-04-13 (LP: #1968932) // CVE- url: https://ubuntu.com/security/CVE-2022-48919
  • cifs: fix double free race when mount fails in cifs_get_root()
• CVE-url: https://ubuntu.com/security/CVE-2024-43858
  • jfs: Fix array-index-out-of-bounds in diFree
• CVE-url: https://ubuntu.com/security/CVE-2024-41071
  • wifi: mac80211: Avoid address calculations via out of bounds array indexing
• CVE-url: https://ubuntu.com/security/CVE-2024-42301
  • dev/parport: fix the array out-of-bounds risk
• CVE-url: https://ubuntu.com/security/CVE-2024-46674
  • usb: dwc3: st: fix probed platform device ref count on probe error path
• CVE-url: https://ubuntu.com/security/CVE-2024-43900
  • media: xc2028: avoid use-after-free in load_firmware_cb()
• CVE-url: https://ubuntu.com/security/CVE-2024-42284
  • tipc: Return non-zero value from tipc_udp_addr2str() on error
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47589
  • igbvf: fix double free in igbvf_probe
• Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47600
  • dm btree remove: fix use after free in rebalance_children()
• CVE-url: https://ubuntu.com/security/CVE-2024-44998
  • atm: idt77252: prevent use after free in dequeue_rx()
• CVE-url: https://ubuntu.com/security/CVE-2024-42280
  • mISDN: Fix a use after free in hfcmulti_tx()
• CVE-url: https://ubuntu.com/security/CVE-2024-42094
  • net/iucv: Avoid explicit cpumask var allocation on stack
• CVE-url: https://ubuntu.com/security/CVE-2024-39499
  • vmci: prevent speculation leaks by sanitizing event in event_deliver()
• CVE-url: https://ubuntu.com/security/CVE-2024-42105
  • nilfs2: fix inode number range checks
• CVE-url: https://ubuntu.com/security/CVE-2024-40988
  • drm/radeon: fix UBSAN warning in kv_dpm.c
• CVE-url: https://ubuntu.com/security/CVE-2024-40916
  • drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found
• CVE-url: https://ubuntu.com/security/CVE-2024-40904
  • USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
• CVE-url: https://ubuntu.com/security/CVE-2024-42106
  • inet_diag: Initialize pad field in struct…

• btrfs: fix use-after-free after failure to create a snapshot {CVE-2022-48733}
• hwmon: (nct6775-core) Fix underflows seen when writing limit attributes {CVE-2024-46757}
• wifi: mac80211: Avoid address calculations via out of bounds array indexing {CVE-2024-41071}
• netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one {CVE-2023-39197}
• ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
• exec: Fix ToCToU between perm check and set-uid/gid usage {CVE-2024-43882}
• dm btree remove: fix use after free in rebalance_children() {CVE-2021-47600}
• isdn: cpai: check ctr->cnr to avoid array index out of bound {CVE-2021-4439}
• scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() {CVE-2021-47576}
• igbvf: fix double free in igbvf_probe {CVE-2021-47589}
• mISDN: Fix a use after free in hfcmulti_tx() {CVE-2024-42280}
• dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
• scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}

• btrfs: fix use-after-free after failure to create a snapshot {CVE-2022-48733}
• hwmon: (nct6775-core) Fix underflows seen when writing limit attributes {CVE-2024-46757}
• wifi: mac80211: Avoid address calculations via out of bounds array indexing {CVE-2024-41071}
• netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one {CVE-2023-39197}
• ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
• exec: Fix ToCToU between perm check and set-uid/gid usage {CVE-2024-43882}
• dm btree remove: fix use after free in rebalance_children() {CVE-2021-47600}
• isdn: cpai: check ctr->cnr to avoid array index out of bound {CVE-2021-4439}
• scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() {CVE-2021-47576}
• igbvf: fix double free in igbvf_probe {CVE-2021-47589}
• mISDN: Fix a use after free in hfcmulti_tx() {CVE-2024-42280}
• dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
• scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}

• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• scsi: mpt3sas: Fix kernel panic during drive powercycle test {CVE-2021-47565}
• net/sched: act_skbmod: Skip non-Ethernet packets {CVE-2021-47293}
• scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219}
• net: validate lwtstate->data before returning from skb_tunnel_info() {CVE-2021-47309}
• regmap: Fix possible double-free in regcache_rbtree_exit() {CVE-2021-47483}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() {CVE-2026-23193}
• isdn: cpai: check ctr->cnr to avoid array index out of bound {CVE-2021-3896}
• scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() {CVE-2021-47541}
• scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() {CVE-2021-47576}
• igbvf: fix double free in igbvf_probe {CVE-2021-47589}
• dm btree remove: fix use after free in rebalance_children() {CVE-2021-47600}
• RDMA/cxgb4: Do not dma memory off of the stack {CVE-2019-17075}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• smb: client: reject userspace cifs.spnego descriptions
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}

• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• dm btree remove: fix use after free in rebalance_children() {CVE-2021-47600}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• net/sched: act_skbmod: Skip non-Ethernet packets {CVE-2021-47293}
• scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219}
• drm: Fix use-after-free read in drm_getunique() {CVE-2021-47280}
• net: validate lwtstate->data before returning from skb_tunnel_info() {CVE-2021-47309}
• regmap: Fix possible double-free in regcache_rbtree_exit() {CVE-2021-47483}
• netfilter: nftables: avoid overflows in nft_hash_buckets() {CVE-2021-46992}
• ALSA: seq: Fix race of snd_seq_timer_open() {CVE-2021-47281}
• netfilter: synproxy: Fix out of bounds when parsing TCP options {CVE-2021-47245}
• scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() {CVE-2021-47576}
• net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() {CVE-2021-47541}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• ext4: fix null-ptr-deref in ext4_write_info {CVE-2022-50344}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• smb: client: reject userspace cifs.spnego descriptions
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52754: media: imon: fix access to invalid resource for the second interface (bsc#1225490).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52764: media: gspca: cpia1: shift-out-of-bounds in set_flicker (bsc#1225571).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52832: wifi: mac80211: do not return unset power in ieee80211_get_tx_power() (bsc#1225577).
• CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47247: net/mlx5e: Fix use-after-free of encap entry in neigh update handler (bsc#1224865).
• CVE-2021-47311: net: qcom/emac: fix UAF in emac_remove (bsc#1225010).
• CVE-2021-47368: enetc: Fix illegal access when reading affinity_hint (bsc#1225161).
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2022-48760: USB: core: Fix hang in usb_kill_urb by adding memory barriers (bsc#1226712).
• CVE-2023-52707: sched/psi: Fix use-after-free in ep_remove_wait_queue() (bsc#1225109). polled (bsc#1202623).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
• CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1224703).
• CVE-2024-36894: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (bsc#1225749).
• CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
• CVE-2024-36940: pinctrl: core: delete incorrect free in pinctrl_enable() (bsc#1225840).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
• CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595)
• CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226758).
• CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).

The following non-security bugs were fixed:

• NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633 bsc#1226226).
• ocfs2: adjust enabling place for la window (bsc#1219224).
• ocfs2: fix sparse warnings (bsc#1219224).
• ocfs2: improve write IO performance when fragmentation is high (bsc#1219224).
• ocfs2: speed up chain-list searching (bsc#1219224).
• psi: Fix uaf issue when psi trigger is destroyed while being
• x86/tsc: Trust initial offset in architectural TSC-adjust MSRs (bsc#1222015 bsc#1226962).

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958.
• CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
• CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
• CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
• CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
• CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
• CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
• CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
• CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
• CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
• CVE-2023-52869: pstore/platform: Add check for kstrdup (bsc#1225050).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2023-52882: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change (bsc#1225692).
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
• CVE-2024-26644: btrfs: do not abort filesystem when attempting to snapshot deleted subvolume (bsc#1221282bsc#1222072).
• CVE-2024-26720: mm: Avoid overflows in dirty throttling logic (bsc#1222364).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
• CVE-2024-26973: fat: fix uninitialized field in nostale filehandles (git-fixesbsc#1223641).
• CVE-2024-27432: net: ethernet: mtk_eth_soc: fix PPE hanging issue (bsc#1224716).
• CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
• CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
• CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (bsc#1224712).
• CVE-2024-35807: ext4: fix corruption during on-line resize (bsc#1224735).
• CVE-2024-35835: net/mlx5e: fix a double-free in arfs_create_groups (bsc#1224605).
• CVE-2024-35848: eeprom: at24: fix memory corruption race condition (bsc#1224612).
• CVE-2024-35857: icmp: prevent possible NULL dereferences from icmp_build_probe() (bsc#1224619).
• CVE-2024-35861:…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52754: media: imon: fix access to invalid resource for the second interface (bsc#1225490).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52764: media: gspca: cpia1: shift-out-of-bounds in set_flicker (bsc#1225571).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52832: wifi: mac80211: do not return unset power in ieee80211_get_tx_power() (bsc#1225577).
• CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52843: llc: verify mac len before…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.


The following security bugs were fixed:

- CVE-2021-47247: net/mlx5e: Fix use-after-free of encap entry in neigh update handler (bsc#1224865).
- CVE-2021-47311: net: qcom/emac: fix UAF in emac_remove (bsc#1225010).
- CVE-2021-47368: enetc: Fix illegal access when reading affinity_hint (bsc#1225161).
- CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
- CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
- CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
- CVE-2022-2938: psi: Fix uaf issue when psi trigger is destroyed while being polled (bsc#1202623).
- CVE-2022-48760: USB: core: Fix hang in usb_kill_urb by adding memory barriers (bsc#1226712).
- CVE-2023-52707: sched/psi: Fix use-after-free in ep_remove_wait_queue() (bsc#1225109). polled (bsc#1202623).
- CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
- CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
- CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
- CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
- CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
- CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
- CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
- CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1224703).
- CVE-2024-36894: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (bsc#1225749).
- CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
- CVE-2024-36940: pinctrl: core: delete incorrect free in pinctrl_enable() (bsc#1225840).
- CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
- CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595).
- CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
- CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).

The following non-security bugs were fixed:

- NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633 bsc#1226226).
- ocfs2: adjust enabling place for la window (bsc#1219224).
- ocfs2: fix sparse warnings (bsc#1219224).
- ocfs2: improve write IO performance when fragmentation is high (bsc#1219224).
- ocfs2: speed up chain-list searching (bsc#1219224).
- psi: Fix uaf issue when psi trigger is destroyed while being
- x86/tsc: Trust initial offset in architectural TSC-adjust MSRs (bsc#1222015 bsc#1226962).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958.
• CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
• CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
• CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
• CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
• CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
• CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
• CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
• CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
• CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
• CVE-2023-52869: pstore/platform: Add check for kstrdup (bsc#1225050).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2023-52882: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change (bsc#1225692).
• CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
• CVE-2024-26644: btrfs: do not abort filesystem when attempting to snapshot deleted subvolume (bsc#1221282, bsc#1222072).
• CVE-2024-26720: mm: Avoid overflows in dirty throttling logic (bsc#1222364).
• CVE-2024-26845: scsi: target: core: Add TMF to tmr_list handling (bsc#1223018).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
• CVE-2024-26973: fat: fix uninitialized field in nostale filehandles (bsc#1223641).
• CVE-2024-27432: net: ethernet: mtk_eth_soc: fix PPE hanging issue (bsc#1224716).
• CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
• CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
• CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (bsc#1224712).
• CVE-2024-35807: ext4: fix corruption during on-line resize (bsc#1224735).
• CVE-2024-35835: net/mlx5e: fix a double-free in arfs_create_groups (bsc#1224605).
• CVE-2024-35848: eeprom: at24: fix memory corruption race condition (bsc#1224612).
• CVE-2024-35857: icmp: prevent possible…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-10135: Legacy pairing and secure-connections pairing authentication Bluetooth might have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access (bsc#1171988).
• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47145: btrfs: do not BUG_ON in link_to_fixup_dir (bsc#1222005).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47201: iavf: free q_vectors before queues in iavf_disable_vf (bsc#1222792).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47275: bcache: avoid oversized read request in cache missing code path (bsc#1224965).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47328: blacklist.conf: bsc#1225047 CVE-2021-47328: breaks kABI Also, does not apply.
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47438: net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() (bsc#1225229)
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47498: dm rq: do not queue request to blk-mq during DM suspend (bsc#1225357).
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47520: can: pch_can: pch_can_rx_normal: fix use after free (bsc#1225431).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743)
• CVE-2021-47580: scsi: scsi_debug: Fix type in min_t to avoid stack OOB (bsc#1226550).
• CVE-2021-47219: scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() (bsc#1222824).
• CVE-2021-47520: can: pch_can: pch_can_rx_normal: fix use after free (bsc#1225431).
• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1226575).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2024-38599: jffs2: prevent xattr node from overflowing the eraseblock (bsc#1226848).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).

The following non-security bugs were fixed:

• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• kvm: prevent kvm_clock time-warps (bsc#1197439).
• net: unix: properly re-increment inflight counter of GC discarded candidates (bsc#1223384).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-41069: ASoC: topology: Fix route memory corruption (bsc#1228644).
• CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808)
• CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743).
• CVE-2024-40994: ptp: fix integer overflow in max_vclocks_store (bsc#1227829).
• CVE-2024-41012: filelock: Remove locks reliably when fcntl/close race is detected (bsc#1228247).
• CVE-2024-42093: net/dpaa2: Avoid explicit cpumask var allocation on stack (bsc#1228680).
• CVE-2024-40989: KVM: arm64: Disassociate vcpus from redistributor region on teardown (bsc#1227823).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
• CVE-2024-40956: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list (bsc#1227810).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2024-39463: 9p: add missing locking around taking dentry fid list (bsc#1227090).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-35901: net: mana: Fix Rx DMA datasize and skb_over_panic (bsc#1224495).
• CVE-2024-42230: powerpc/pseries: Fix scv instruction crash with kexec (bsc#1194869).
• CVE-2024-36974: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (bsc#1226519).
• CVE-2024-38555: net/mlx5: Discard command completions in internal error (bsc#1226607).

The following non-security bugs were fixed:

• NFS: Do not re-read the entire page cache to find the next cookie (bsc#1226662).
• NFS: Reduce use of uncached readdir (bsc#1226662).
• NFSv4.x: by default serialize open/close operations (bsc#1226226 bsc#1223863).
• X.509: Fix the parser of extended key usage for length (bsc#1218820).
• btrfs: sysfs: update fs features directory asynchronously (bsc#1226168).
• cgroup/cpuset: Prevent UAF in proc_cpuset_show() (bsc#1228801).
• jfs: xattr: fix buffer overflow for invalid xattr (bsc#1227383).
• kABI: rtas: Workaround false positive due to lost definition (bsc#1227487).
• kernel-binary: vdso: Own module_dir
• net/dcb: check for detached device before executing callbacks (bsc#1215587).
• ocfs2: fix DIO failure due to insufficient transaction credits (bsc#1216834).
• powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() (bsc#1227487).
• powerpc/rtas: clean up includes (bsc#1227487).
• workqueue: Improve scalability of workqueue watchdog touch (bsc#1193454).
• workqueue: wq_watchdog_touch is always called with valid CPU (bsc#1193454).

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-41069: ASoC: topology: Fix route memory corruption (bsc#1228644).
• CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
• CVE-2023-52885: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (bsc#1227750).
• CVE-2022-48792: scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task (bsc#1228013).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1224918).
• CVE-2021-47126: ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions (bsc#1221539).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2021-47580: scsi: scsi_debug: Fix type in min_t to avoid stack OOB (bsc#1226550).
• CVE-2021-47219: scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() (bsc#1222824).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bsc#1186463).
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (bsc#1179610).
• CVE-2022-48821: misc: fastrpc: avoid double fput() on failed usercopy (bsc#1227976).
• CVE-2021-47506: nfsd: fix use-after-free due to delegation race (bsc#1225404).
• CVE-2021-47520: can: pch_can: pch_can_rx_normal: fix use after free (bsc#1225431).
• CVE-2024-26583: tls: fix use-after-free on failed backlog decryption (bsc#1220185).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1226575).
• CVE-2024-36974: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (bsc#1226519).

The following non-security bugs were fixed:

• Fix spurious WARNING caused by a qxl driver patch (bsc#1227213)
• X.509: Fix the parser of extended key usage for length (bsc#1218820 bsc#1226666).
• ocfs2: fix DIO failure due to insufficient transaction credits (bsc#1216834).
• powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() (bsc#1227487).
• powerpc/rtas: clean up includes (bsc#1227487).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-41069: ASoC: topology: Fix route memory corruption (bsc#1228644).
• CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808)
• CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743)
• CVE-2024-40994: ptp: fix integer overflow in max_vclocks_store (bsc#1227829).
• CVE-2024-41012: filelock: Remove locks reliably when fcntl/close race is detected (bsc#1228247).
• CVE-2024-42093: net/dpaa2: Avoid explicit cpumask var allocation on stack (bsc#1228680).
• CVE-2024-40989: KVM: arm64: Disassociate vcpus from redistributor region on teardown (bsc#1227823).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
• CVE-2024-40956: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list (bsc#1227810).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2024-39463: 9p: add missing locking around taking dentry fid list (bsc#1227090).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-35901: net: mana: Fix Rx DMA datasize and skb_over_panic (bsc#1224495).
• CVE-2024-42230: powerpc/pseries: Fix scv instruction crash with kexec (bsc#1194869).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2024-36974: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (bsc#1226519).
• CVE-2024-38555: net/mlx5: Discard command completions in internal error (bsc#1226607).

The following non-security bugs were fixed:

• NFS: Do not re-read the entire page cache to find the next cookie (bsc#1226662).
• NFS: Reduce use of uncached readdir (bsc#1226662).
• NFSv4.x: by default serialize open/close operations (bsc#1226226 bsc#1223863).
• X.509: Fix the parser of extended key usage for length (bsc#1218820).
• btrfs: sysfs: update fs features directory asynchronously (bsc#1226168).
• cgroup/cpuset: Prevent UAF in proc_cpuset_show() (bsc#1228801).
• jfs: xattr: fix buffer overflow for invalid xattr (bsc#1227383).
• kABI: rtas: Workaround false positive due to lost definition (bsc#1227487).
• kernel-binary: vdso: Own module_dir
• net/dcb: check for detached device before executing callbacks (bsc#1215587).
• ocfs2: fix DIO failure due to insufficient transaction credits (bsc#1216834).
• powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() (bsc#1227487).
• powerpc/rtas: clean up includes (bsc#1227487).
• workqueue: Improve scalability of workqueue watchdog touch (bsc#1193454).
• workqueue: wq_watchdog_touch is always called with valid CPU (bsc#1193454).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
• CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958).
• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47186: tipc: check for null after calling kmemdup (bsc#1222702).
• CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
• CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
• CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
• CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
• CVE-2021-47546: ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
• CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
• CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
• CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
• CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571).
• CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len. (bsc#1226555).
• CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
• CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
• CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
• CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
• CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071).
• CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869).
• CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
• CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
• CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52787: blk-mq: make…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (bsc#1179610).
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bsc#1186463).
• CVE-2021-47126: ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions (bsc#1221539).
• CVE-2021-47219: scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() (bsc#1222824).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1224918).
• CVE-2021-47506: nfsd: fix use-after-free due to delegation race (bsc#1225404).
• CVE-2021-47520: can: pch_can: pch_can_rx_normal: fix use after free (bsc#1225431).
• CVE-2021-47580: scsi: scsi_debug: Fix type in min_t to avoid stack OOB (bsc#1226550).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1226575).
• CVE-2022-48792: scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task (bsc#1228013).
• CVE-2022-48821: misc: fastrpc: avoid double fput() on failed usercopy (bsc#1227976).
• CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).
• CVE-2023-52885: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (bsc#1227750).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2024-36974: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (bsc#1226519).
• CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-40956: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list (bsc#1227810).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
• CVE-2024-41069: ASoC: topology: Fix route memory corruption (bsc#1228644).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743).

The following non-security bugs were fixed:

• Fix spurious WARNING caused by a qxl driver patch (bsc#1227213)
• nfs: Clean up directory array handling (bsc#1226662).
• nfs: Clean up nfs_readdir_page_filler() (bsc#1226662).
• nfs: Clean up readdir struct nfs_cache_array (bsc#1226662).
• nfs: Do not discard readdir results (bsc#1226662).
• nfs: Do not overfill uncached readdir pages (bsc#1226662).
• nfs: Do not re-read the entire page cache to find the next cookie (bsc#1226662).
• nfs: Ensure contents of struct nfs_open_dir_context are consistent (bsc#1226662).
• nfs: Fix up directory verifier races (bsc#1226662).
• nfs: Further optimisations for 'ls -l' (bsc#1226662).
• nfs: More readdir cleanups (bsc#1226662).
• nfs: Reduce number of RPC calls when doing uncached readdir (bsc#1226662).
• nfs: Reduce use of uncached readdir (bsc#1226662).
• nfs: Support larger readdir buffers (bsc#1226662).
• nfs: Use the 64-bit server readdir cookies when possible (bsc#1226662).
• nfs: optimise readdir cache page invalidation (bsc#1226662).
• nfsv4.x: by default serialize open/close operations (bsc#1223863 bsc#1227362)
• ocfs2: fix DIO failure due to insufficient transaction credits (bsc#1216834).
• powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() (bsc#1227487).
• powerpc/rtas: clean up includes (bsc#1227487).
• x.509: Fix the parser of extended key usage for length (bsc#1218820, bsc#1226666).

This update for the Linux Kernel 5.3.18-150200_24_175 fixes several issues.

The following security issues were fixed:

• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1227472).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309).

This update for the Linux Kernel 5.3.18-150200_24_197 fixes several issues.

The following security issues were fixed:

• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1227472).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1227651).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).

This update for the Linux Kernel 5.3.18-150200_24_166 fixes several issues.

The following security issues were fixed:

• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1227472).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309).

This update for the Linux Kernel 5.3.18-150200_24_169 fixes several issues.

The following security issues were fixed:

• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1227472).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309).

This update for the Linux Kernel 5.3.18-150200_24_188 fixes several issues.

The following security issues were fixed:

• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1227472).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1225312).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1227651).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325).
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150200_24_194 fixes several issues.

The following security issues were fixed:

• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1227472).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1225312).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1227651).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).

This update for the Linux Kernel 5.3.18-150200_24_183 fixes several issues.

The following security issues were fixed:

• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1227472).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1225312).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1227651).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325).
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150200_24_178 fixes several issues.

The following security issues were fixed:

• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1227472).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309).

This update for the Linux Kernel 5.3.18-150200_24_191 fixes several issues.

The following security issues were fixed:

• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1227472).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1225312).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1227651).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325).
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150200_24_194 fixes several issues.

The following security issues were fixed:

• CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225733).
• CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229553).
• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1227472).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1225312).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1227651).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).

This update for the Linux Kernel 5.3.18-150200_24_183 fixes several issues.

The following security issues were fixed:

• CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225733).
• CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229553).
• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1227472).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1225312).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1227651).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325).
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150200_24_197 fixes several issues.

The following security issues were fixed:

• CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229553).
• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1227472).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1227651).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).

This update for the Linux Kernel 5.3.18-150200_24_191 fixes several issues.

The following security issues were fixed:

• CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225733).
• CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229553).
• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1227472).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1225312).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1227651).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325).
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).

This update for the Linux Kernel 5.3.18-150200_24_188 fixes several issues.

The following security issues were fixed:

• CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225733).
• CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229553).
• CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1227472).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1225312).
• CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1227651).
• CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325).
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225202).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
• CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537).
• CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145).
• CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059).
• CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619).