CVE-2023-53401

In the Linux kernel, the following vulnerability has been resolved: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() KCSAN found an issue in obj_stock_flush_required(): stock->cached_objcg can be reset between the check and dereference: ================================================================== BUG: KCSAN: data-race in drain_all_stock / drain_obj_stock write to 0xffff888237c2a2f8 of 8 bytes by task 19625 on cpu 0: drain_obj_stock+0x408/0x4e0 mm/memcontrol.c:3306 refill_obj_stock+0x9c/0x1e0 mm/memcontrol.c:3340 obj_cgroup_uncharge+0xe/0x10 mm/memcontrol.c:3408 memcg_slab_free_hook mm/slab.h:587 [inline] __cache_free mm/slab.c:3373 [inline] __do_kmem_cache_free mm/slab.c:3577 [inline] kmem_cache_free+0x105/0x280 mm/slab.c:3602 __d_free fs/dcache.c:298 [inline] dentry_free fs/dcache.c:375 [inline] __dentry_kill+0x422/0x4a0 fs/dcache.c:621 dentry_kill+0x8d/0x1e0 dput+0x118/0x1f0 fs/dcache.c:913 __fput+0x3bf/0x570 fs/file_table.c:329 ____fput+0x15/0x20 fs/file_table.c:349 task_work_run+0x123/0x160 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xcf/0xe0 kernel/entry/common.c:171 exit_to_user_mode_prepare+0x6a/0xa0 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:296 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff888237c2a2f8 of 8 bytes by task 19632 on cpu 1: obj_stock_flush_required mm/memcontrol.c:3319 [inline] drain_all_stock+0x174/0x2a0 mm/memcontrol.c:2361 try_charge_memcg+0x6d0/0xd10 mm/memcontrol.c:2703 try_charge mm/memcontrol.c:2837 [inline] mem_cgroup_charge_skmem+0x51/0x140 mm/memcontrol.c:7290 sock_reserve_memory+0xb1/0x390 net/core/sock.c:1025 sk_setsockopt+0x800/0x1e70 net/core/sock.c:1525 udp_lib_setsockopt+0x99/0x6c0 net/ipv4/udp.c:2692 udp_setsockopt+0x73/0xa0 net/ipv4/udp.c:2817 sock_common_setsockopt+0x61/0x70 net/core/sock.c:3668 __sys_setsockopt+0x1c3/0x230 net/socket.c:2271 __do_sys_setsockopt net/socket.c:2282 [inline] __se_sys_setsockopt net/socket.c:2279 [inline] __x64_sys_setsockopt+0x66/0x80 net/socket.c:2279 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0xffff8881382d52c0 -> 0xffff888138893740 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 19632 Comm: syz-executor.0 Not tainted 6.3.0-rc2-syzkaller-00387-g534293368afa #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 Fix it by using READ_ONCE()/WRITE_ONCE() for all accesses to stock->cached_objcg.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (CVE-2023-53401)

• kernel: RDMA/rxe: Fix incomplete state save in rxe_requester (CVE-2023-53539)

• kernel: RDMA/rxe: Fix mr->map double free (CVE-2022-50543)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (CVE-2023-53401)

• kernel: RDMA/rxe: Fix incomplete state save in rxe_requester (CVE-2023-53539)

• kernel: RDMA/rxe: Fix mr->map double free (CVE-2022-50543)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2023-53401 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2023-53401 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() KCSAN found an issue in obj_stock_flush_required(): stock->cached_objcg can be reset between the check and dereference: ================================================================== BUG: KCSAN: data-race in drain_all_stock / drain_obj_stock write to 0xffff888237c2a2f8 of 8 bytes by task 19625 on cpu 0: drain_obj_stock+0x408/0x4e0 mm/memcontrol.c:3306 refill_obj_stock+0x9c/0x1e0 mm/memcontrol.c:3340 obj_cgroup_uncharge+0xe/0x10 mm/memcontrol.c:3408 memcg_slab_free_hook mm/slab.h:587 [inline] __cache_free mm/slab.c:3373 [inline] __do_kmem_cache_free mm/slab.c:3577 [inline] kmem_cache_free+0x105/0x280 mm/slab.c:3602 __d_free fs/dcache.c:298 [inline] dentry_free fs/dcache.c:375 [inline] __dentry_kill+0x422/0x4a0 fs/dcache.c:621 dentry_kill+0x8d/0x1e0 dput+0x118/0x1f0 fs/dcache.c:913 __fput+0x3bf/0x570 fs/file_table.c:329 ____fput+0x15/0x20 fs/file_table.c:349 task_work_run+0x123/0x160 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xcf/0xe0 kernel/entry/common.c:171 exit_to_user_mode_prepare+0x6a/0xa0 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:296 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff888237c2a2f8 of 8 bytes by task 19632 on cpu 1: obj_stock_flush_required mm/memcontrol.c:3319 [inline] drain_all_stock+0x174/0x2a0 mm/memcontrol.c:2361 try_charge_memcg+0x6d0/0xd10 mm/memcontrol.c:2703 try_charge mm/memcontrol.c:2837 [inline] mem_cgroup_charge_skmem+0x51/0x140 mm/memcontrol.c:7290 sock_reserve_memory+0xb1/0x390 net/core/sock.c:1025 sk_setsockopt+0x800/0x1e70 net/core/sock.c:1525 udp_lib_setsockopt+0x99/0x6c0 net/ipv4/udp.c:2692 udp_setsockopt+0x73/0xa0 net/ipv4/udp.c:2817 sock_common_setsockopt+0x61/0x70 net/core/sock.c:3668 __sys_setsockopt+0x1c3/0x230 net/socket.c:2271 __do_sys_setsockopt net/socket.c:2282 [inline] __se_sys_setsockopt net/socket.c:2279 [inline] __x64_sys_setsockopt+0x66/0x80 net/socket.c:2279 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0xffff8881382d52c0 -> 0xffff888138893740 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 19632 Comm: syz-executor.0 Not tainted 6.3.0-rc2-syzkaller-00387-g534293368afa #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 Fix it by using READ_ONCE()/WRITE_ONCE() for all accesses to stock->cached_objcg.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (CVE-2023-53401)
• kernel: RDMA/rxe: Fix incomplete state save in rxe_requester (CVE-2023-53539)
• kernel: RDMA/rxe: Fix mr->map double free (CVE-2022-50543)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (CVE-2023-53401)
• kernel: RDMA/rxe: Fix incomplete state save in rxe_requester (CVE-2023-53539)
• kernel: RDMA/rxe: Fix mr->map double free (CVE-2022-50543)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved:

mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()

KCSAN found an issue in obj_stock_flush_required(): stock->cached_objcg can be reset between the check and dereference:

================================================================== BUG: KCSAN: data-race in drain_all_stock / drain_obj_stock

write to 0xffff888237c2a2f8 of 8 bytes by task 19625 on cpu 0: drain_obj_stock+0x408/0x4e0 mm/memcontrol.c:3306 refill_obj_stock+0x9c/0x1e0 mm/memcontrol.c:3340 obj_cgroup_uncharge+0xe/0x10 mm/memcontrol.c:3408 memcg_slab_free_hook mm/slab.h:587 [inline] __cache_free mm/slab.c:3373 [inline] __do_kmem_cache_free mm/slab.c:3577 [inline] kmem_cache_free+0x105/0x280 mm/slab.c:3602 __d_free fs/dcache.c:298 [inline] dentry_free fs/dcache.c:375 [inline] __dentry_kill+0x422/0x4a0 fs/dcache.c:621 dentry_kill+0x8d/0x1e0 dput+0x118/0x1f0 fs/dcache.c:913 __fput+0x3bf/0x570 fs/file_table.c:329 ____fput+0x15/0x20 fs/file_table.c:349 task_work_run+0x123/0x160 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xcf/0xe0 kernel/entry/common.c:171 exit_to_user_mode_prepare+0x6a/0xa0 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:296 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd

read to 0xffff888237c2a2f8 of 8 bytes by task 19632 on cpu 1: obj_stock_flush_required mm/memcontrol.c:3319 [inline] drain_all_stock+0x174/0x2a0 mm/memcontrol.c:2361 try_charge_memcg+0x6d0/0xd10 mm/memcontrol.c:2703 try_charge mm/memcontrol.c:2837 [inline] mem_cgroup_charge_skmem+0x51/0x140 mm/memcontrol.c:7290 sock_reserve_memory+0xb1/0x390 net/core/sock.c:1025 sk_setsockopt+0x800/0x1e70 net/core/sock.c:1525 udp_lib_setsockopt+0x99/0x6c0 net/ipv4/udp.c:2692 udp_setsockopt+0x73/0xa0 net/ipv4/udp.c:2817 sock_common_setsockopt+0x61/0x70 net/core/sock.c:3668 __sys_setsockopt+0x1c3/0x230 net/socket.c:2271 __do_sys_setsockopt net/socket.c:2282 [inline] __se_sys_setsockopt net/socket.c:2279 [inline] __x64_sys_setsockopt+0x66/0x80 net/socket.c:2279 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0xffff8881382d52c0 -> 0xffff888138893740

Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 19632 Comm: syz-executor.0 Not tainted 6.3.0-rc2-syzkaller-00387-g534293368afa #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023

Fix it by using READ_ONCE()/WRITE_ONCE() for all accesses to stock->cached_objcg.

• mm: zswap: fix missing folio cleanup in writeback race path {CVE-2024-26832}
• mm: fix zswap writeback race condition {CVE-2023-53178}
• dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929}
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• gpio: davinci: Validate the obtained number of IRQs {CVE-2024-42092}
• ASoC: topology: Fix references to freed memory {CVE-2024-41069}
• Bluetooth: hci_sock: Fix not validating setsockopt user input {CVE-2024-35963}
• Bluetooth: ISO: Fix not validating setsockopt user input {CVE-2024-35964}
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
• dma-direct: Leak pages on dma_set_decrypted() failure {CVE-2024-35939}
• wifi: mwifiex: avoid possible NULL skb pointer dereference {CVE-2023-53384}
• md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request {CVE-2023-53380}
• icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
• thermal: core: prevent potential string overflow {CVE-2023-52868}
• drm/amdkfd: Fix shift out-of-bounds issue {CVE-2023-52816}
• drm/vkms: Fix null-ptr-deref in vkms_release() {CVE-2022-50369}
• nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
• net/mlx5: Fix tainted pointer delete is case of flow rules creation fail {CVE-2024-40940}
• ipvlan: add ipvlan_route_v6_outbound() helper {CVE-2023-52796}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
• platform/x86: wmi: remove unnecessary initializations
• perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
• do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
• net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• kobject_uevent: Fix OOB access within zap_modalias_env() {CVE-2024-42292}
• mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() {CVE-2023-53401}
• net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
• drm/radeon: possible buffer overflow {CVE-2023-52867}
• media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
• wifi: mac80211_hwsim: Fix possible NULL dereference {CVE-2023-53209}
• vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
• wifi: iwlwifi: fw: fix memory leak in debugfs {CVE-2023-53422}
• drm/amdgpu: fix memory leak in mes self test {CVE-2023-53370}
• skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
• md/raid10: fix leak of 'r10bio->remaining' for recovery {CVE-2023-53299}
• nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
• ppdev: Add an error check in register_device {CVE-2024-36015}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
• net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
• net: add atomic_long_t to net_device_stats fields {CVE-2024-26882}

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4: do not BUG…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
• CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
• CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
• CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
• CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
• CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
• CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
• CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
• CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
• CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
• CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
• CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (bsc#1247167).
• CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
• CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
• CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
• CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
• CVE-2025-38491: mptcp: make fallback action and fallback decision…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4: do…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4: do…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4:…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
• CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
• CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
• CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
• CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
• CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
• CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
• CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
• CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
• CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct (bsc#1248202).
• CVE-2025-38526: ice: add NULL check in eswitch lag check (bsc#1248192).
• CVE-2025-38527: smb: client: fix use-after-free in cifs_oplock_break (bsc#1248199).
• CVE-2025-38533: net: libwx: fix the using of Rx buffer DMA (bsc#1248200).
• CVE-2025-38544: rxrpc: Fix bug due to prealloc collision (bsc#1248225).
• CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
• CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
• CVE-2025-38584: padata: Fix pd UAF once and for all (bsc1248343).
• CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
• CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
• CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
• CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
• CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
• CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
• CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1248512).
• CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
• CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
• CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
• CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
• CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
• CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
• CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
• CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
• CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
• CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
• CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
• CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
• CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
• CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes (bsc#1249156).
• CVE-2025-38701: ext4: do not…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).
• CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).
• CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).
• CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).
• CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (bsc#1249182).
• CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
• CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).
• CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).
• CVE-2025-39683: tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286).
• CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).
• CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).
• CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).
• CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).
• CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
• CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).
• CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).
• CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).
• CVE-2025-39832: net/mlx5: Add sync reset drop mode support (bsc#1249901).
• CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
• CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
• CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).
• CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
• CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
• CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).
• CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).
• CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).
• CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).
• CVE-2025-39898: e1000e: fix heap overflow in e1000_set_eeprom (bsc#1250742).
• CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).
• CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).
• CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).
• CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).
• CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).
• CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).
• CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).
• CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051). -…

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).
• CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).
• CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).
• CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).
• CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (bsc#1249182).
• CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
• CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).
• CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).
• CVE-2025-39683: tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286).
• CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).
• CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).
• CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).
• CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).
• CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
• CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).
• CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).
• CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).
• CVE-2025-39832: net/mlx5: Add sync reset drop mode support (bsc#1249901).
• CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
• CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
• CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).
• CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
• CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
• CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).
• CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).
• CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).
• CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).
• CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).
• CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).
• CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).
• CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).
• CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).
• CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).
• CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).
• CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).
• CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052). -…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).
• CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).
• CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).
• CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).
• CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (bsc#1249182).
• CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).
• CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
• CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).
• CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).
• CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).
• CVE-2025-39683: tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286).
• CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).
• CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).
• CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).
• CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).
• CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).
• CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).
• CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).
• CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).
• CVE-2025-39832: net/mlx5: Add sync reset drop mode support (bsc#1249901).
• CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).
• CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).
• CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).
• CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).
• CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr (bsc#1250297).
• CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).
• CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).
• CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).
• CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).
• CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).
• CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).
• CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).
• CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).
• CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).
• CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).
• CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).
• CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).
• CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052). -…