CVE-2021-46981

In the Linux kernel, the following vulnerability has been resolved: nbd: Fix NULL pointer in flush_workqueue Open /dev/nbdX first, the config_refs will be 1 and the pointers in nbd_device are still null. Disconnect /dev/nbdX, then reference a null recv_workq. The protection by config_refs in nbd_genl_disconnect is useless. [ 656.366194] BUG: kernel NULL pointer dereference, address: 0000000000000020 [ 656.368943] #PF: supervisor write access in kernel mode [ 656.369844] #PF: error_code(0x0002) - not-present page [ 656.370717] PGD 10cc87067 P4D 10cc87067 PUD 1074b4067 PMD 0 [ 656.371693] Oops: 0002 [#1] SMP [ 656.372242] CPU: 5 PID: 7977 Comm: nbd-client Not tainted 5.11.0-rc5-00040-g76c057c84d28 #1 [ 656.373661] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 [ 656.375904] RIP: 0010:mutex_lock+0x29/0x60 [ 656.376627] Code: 00 0f 1f 44 00 00 55 48 89 fd 48 83 05 6f d7 fe 08 01 e8 7a c3 ff ff 48 83 05 6a d7 fe 08 01 31 c0 65 48 8b 14 25 00 6d 01 00 <f0> 48 0f b1 55 d [ 656.378934] RSP: 0018:ffffc900005eb9b0 EFLAGS: 00010246 [ 656.379350] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 656.379915] RDX: ffff888104cf2600 RSI: ffffffffaae8f452 RDI: 0000000000000020 [ 656.380473] RBP: 0000000000000020 R08: 0000000000000000 R09: ffff88813bd6b318 [ 656.381039] R10: 00000000000000c7 R11: fefefefefefefeff R12: ffff888102710b40 [ 656.381599] R13: ffffc900005eb9e0 R14: ffffffffb2930680 R15: ffff88810770ef00 [ 656.382166] FS: 00007fdf117ebb40(0000) GS:ffff88813bd40000(0000) knlGS:0000000000000000 [ 656.382806] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 656.383261] CR2: 0000000000000020 CR3: 0000000100c84000 CR4: 00000000000006e0 [ 656.383819] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 656.384370] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 656.384927] Call Trace: [ 656.385111] flush_workqueue+0x92/0x6c0 [ 656.385395] nbd_disconnect_and_put+0x81/0xd0 [ 656.385716] nbd_genl_disconnect+0x125/0x2a0 [ 656.386034] genl_family_rcv_msg_doit.isra.0+0x102/0x1b0 [ 656.386422] genl_rcv_msg+0xfc/0x2b0 [ 656.386685] ? nbd_ioctl+0x490/0x490 [ 656.386954] ? genl_family_rcv_msg_doit.isra.0+0x1b0/0x1b0 [ 656.387354] netlink_rcv_skb+0x62/0x180 [ 656.387638] genl_rcv+0x34/0x60 [ 656.387874] netlink_unicast+0x26d/0x590 [ 656.388162] netlink_sendmsg+0x398/0x6c0 [ 656.388451] ? netlink_rcv_skb+0x180/0x180 [ 656.388750] ____sys_sendmsg+0x1da/0x320 [ 656.389038] ? ____sys_recvmsg+0x130/0x220 [ 656.389334] ___sys_sendmsg+0x8e/0xf0 [ 656.389605] ? ___sys_recvmsg+0xa2/0xf0 [ 656.389889] ? handle_mm_fault+0x1671/0x21d0 [ 656.390201] __sys_sendmsg+0x6d/0xe0 [ 656.390464] __x64_sys_sendmsg+0x23/0x30 [ 656.390751] do_syscall_64+0x45/0x70 [ 656.391017] entry_SYSCALL_64_after_hwframe+0x44/0xa9 To fix it, just add if (nbd->recv_workq) to nbd_disconnect_and_put().

• CVE-url: https://ubuntu.com/security/CVE-2023-47233
  • wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-52601
  • jfs: Fix memleak in dbAdjCtl
• CVE-url: https://ubuntu.com/security/CVE-2024-26801
  • Bluetooth: Avoid potential use-after-free in hci_error_reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26805
  • netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
• CVE-url: https://ubuntu.com/security/CVE-2024-26735
  • ipv6: sr: fix possible use-after-free and null-ptr-deref
• CVE-url: https://ubuntu.com/security/CVE-2023-52566
  • nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
• CVE-url: https://ubuntu.com/security/CVE-2021-46981
  • nbd: Fix NULL pointer in flush_workqueue
• CVE-url: https://ubuntu.com/security/CVE-2024-26622
  • tomoyo: fix UAF write bug in tomoyo_write_control()
• CVE-url: https://ubuntu.com/security/CVE-2024-26614
  • tcp: make sure init the accept_queue's spinlocks once
  • ipv6: init the accept_queue's spinlocks in inet6_create
• CVE-url: https://ubuntu.com/security/CVE-2023-52530
  • wifi: mac80211: fix potential key use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-52524
  • net: nfc: llcp: Add lock when modifying device list
• CVE-url: https://ubuntu.com/security/CVE-2021-47173
  • misc/uss720: fix memory leak in uss720_probe
• CVE-url: https://ubuntu.com/security/CVE-2024-26910
  • timers: Get rid of del_singleshot_timer_sync()
  • timers: Update kernel-doc for various functions
  • timers: Use del_timer_sync() even on UP
  • timers: Rename del_timer_sync() to timer_delete_sync()
  • timers: Rename del_timer() to timer_delete()
  • timers: Silently ignore timers with a NULL function
  • timers: Split [try_to_]del_timer_sync to prepare for shutdown mode
  • timers: Add shutdown mechanism to the internal functions
  • timers: Provide timer_shutdown_sync
  • netfilter: ipset: fix performance regression in swap operation
• CVE-url: https://ubuntu.com/security/CVE-2023-52595
  • rt2x00: clear IV's on start to fix AP mode regression
  • wifi: rt2x00: restart beacon queue when hardware reset
• CVE-url: https://ubuntu.com/security/CVE-2023-52617
  • switchtec: Improve MRPC efficiency by enabling write combining
  • switchtec: Add MRPC DMA mode support
  • PCI: switchtec: Fix stdev_release() crash after surprise hot remove
• CVE-url: https://ubuntu.com/security/CVE-2024-26696
  • nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
• CVE-url: https://ubuntu.com/security/CVE-2024-26685
  • nilfs2: fix potential bug in end_buffer_async_write
• CVE-url: https://ubuntu.com/security/CVE-2024-26625
  • llc: call sock_orphan() at release time
• CVE-url: https://ubuntu.com/security/CVE-2023-52615
  • hwrng: core - Fix page fault dead lock on mmap-ed hwrng
• CVE-url: https://ubuntu.com/security/CVE-2023-52486
  • drm: Don't unref the same fb many times by mistake due to deadlock handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26920
  • tracing/trigger: Fix to return error if failed to alloc snapshot
• CVE-url: https://ubuntu.com/security/CVE-2024-26697
  • nilfs2: fix data corruption in dsync block recovery for small block sizes
• CVE-url: https://ubuntu.com/security/CVE-2024-26679
  • inet: read sk->sk_family once in inet_recv_error()
• CVE-url: https://ubuntu.com/security/CVE-2023-52622
  • ext4: remove unnecessary check from alloc_flex_gd()
  • ext4: avoid online resizing failures due to oversized flex bg
• CVE-url: https://ubuntu.com/security/CVE-2024-26635
  • llc: Drop support for ETH_P_TR_802_2.
• CVE-url: https://ubuntu.com/security/CVE-2023-52594
  • wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
• CVE-url:…

• CVE-url: https://ubuntu.com/security/CVE-2023-47233
  • wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-52601
  • jfs: Fix memleak in dbAdjCtl
• CVE-url: https://ubuntu.com/security/CVE-2024-26801
  • Bluetooth: Avoid potential use-after-free in hci_error_reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26805
  • netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
• CVE-url: https://ubuntu.com/security/CVE-2024-26735
  • ipv6: sr: fix possible use-after-free and null-ptr-deref
• CVE-url: https://ubuntu.com/security/CVE-2023-52566
  • nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
• CVE-url: https://ubuntu.com/security/CVE-2021-46981
  • nbd: Fix NULL pointer in flush_workqueue
• CVE-url: https://ubuntu.com/security/CVE-2024-26622
  • tomoyo: fix UAF write bug in tomoyo_write_control()
• CVE-url: https://ubuntu.com/security/CVE-2024-26614
  • tcp: make sure init the accept_queue's spinlocks once
  • ipv6: init the accept_queue's spinlocks in inet6_create
• CVE-url: https://ubuntu.com/security/CVE-2023-52530
  • wifi: mac80211: fix potential key use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-52524
  • net: nfc: llcp: Add lock when modifying device list
• CVE-url: https://ubuntu.com/security/CVE-2021-47173
  • misc/uss720: fix memory leak in uss720_probe
• CVE-url: https://ubuntu.com/security/CVE-2024-26910
  • timers: Get rid of del_singleshot_timer_sync()
  • timers: Update kernel-doc for various functions
  • timers: Use del_timer_sync() even on UP
  • timers: Rename del_timer_sync() to timer_delete_sync()
  • timers: Rename del_timer() to timer_delete()
  • timers: Silently ignore timers with a NULL function
  • timers: Split [try_to_]del_timer_sync to prepare for shutdown mode
  • timers: Add shutdown mechanism to the internal functions
  • timers: Provide timer_shutdown_sync
  • netfilter: ipset: fix performance regression in swap operation
• CVE-url: https://ubuntu.com/security/CVE-2023-52595
  • rt2x00: clear IV's on start to fix AP mode regression
  • wifi: rt2x00: restart beacon queue when hardware reset
• CVE-url: https://ubuntu.com/security/CVE-2023-52617
  • switchtec: Improve MRPC efficiency by enabling write combining
  • switchtec: Add MRPC DMA mode support
  • PCI: switchtec: Fix stdev_release() crash after surprise hot remove
• CVE-url: https://ubuntu.com/security/CVE-2024-26696
  • nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
• CVE-url: https://ubuntu.com/security/CVE-2024-26685
  • nilfs2: fix potential bug in end_buffer_async_write
• CVE-url: https://ubuntu.com/security/CVE-2024-26625
  • llc: call sock_orphan() at release time
• CVE-url: https://ubuntu.com/security/CVE-2023-52615
  • hwrng: core - Fix page fault dead lock on mmap-ed hwrng
• CVE-url: https://ubuntu.com/security/CVE-2023-52486
  • drm: Don't unref the same fb many times by mistake due to deadlock handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26920
  • tracing/trigger: Fix to return error if failed to alloc snapshot
• CVE-url: https://ubuntu.com/security/CVE-2024-26697
  • nilfs2: fix data corruption in dsync block recovery for small block sizes
• CVE-url: https://ubuntu.com/security/CVE-2024-26679
  • inet: read sk->sk_family once in inet_recv_error()
• CVE-url: https://ubuntu.com/security/CVE-2023-52622
  • ext4: remove unnecessary check from alloc_flex_gd()
  • ext4: avoid online resizing failures due to oversized flex bg
• CVE-url: https://ubuntu.com/security/CVE-2024-26635
  • llc: Drop support for ETH_P_TR_802_2.
• CVE-url: https://ubuntu.com/security/CVE-2023-52594
  • wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
• CVE-url:…

[ Ubuntu: 4.15.0-228.239 ]

• CVE-url: https://ubuntu.com/security/CVE-2023-47233
  • wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-52601
  • jfs: Fix memleak in dbAdjCtl
• CVE-url: https://ubuntu.com/security/CVE-2024-26801
  • Bluetooth: Avoid potential use-after-free in hci_error_reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26805
  • netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
• CVE-url: https://ubuntu.com/security/CVE-2024-26735
  • ipv6: sr: fix possible use-after-free and null-ptr-deref
• CVE-url: https://ubuntu.com/security/CVE-2023-52566
  • nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
• CVE-url: https://ubuntu.com/security/CVE-2021-46981
  • nbd: Fix NULL pointer in flush_workqueue
• CVE-url: https://ubuntu.com/security/CVE-2024-26622
  • tomoyo: fix UAF write bug in tomoyo_write_control()
• CVE-url: https://ubuntu.com/security/CVE-2024-26614
  • tcp: make sure init the accept_queue's spinlocks once
  • ipv6: init the accept_queue's spinlocks in inet6_create
• CVE-url: https://ubuntu.com/security/CVE-2023-52530
  • wifi: mac80211: fix potential key use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-52524
  • net: nfc: llcp: Add lock when modifying device list
• CVE-url: https://ubuntu.com/security/CVE-2021-47173
  • misc/uss720: fix memory leak in uss720_probe
• CVE-url: https://ubuntu.com/security/CVE-2024-26910
  • timers: Get rid of del_singleshot_timer_sync()
  • timers: Update kernel-doc for various functions
  • timers: Use del_timer_sync() even on UP
  • timers: Rename del_timer_sync() to timer_delete_sync()
  • timers: Rename del_timer() to timer_delete()
  • timers: Silently ignore timers with a NULL function
  • timers: Split [try_to_]del_timer_sync to prepare for shutdown mode
  • timers: Add shutdown mechanism to the internal functions
  • timers: Provide timer_shutdown_sync
  • netfilter: ipset: fix performance regression in swap operation
• CVE-url: https://ubuntu.com/security/CVE-2023-52595
  • rt2x00: clear IV's on start to fix AP mode regression
  • wifi: rt2x00: restart beacon queue when hardware reset
• CVE-url: https://ubuntu.com/security/CVE-2023-52617
  • switchtec: Improve MRPC efficiency by enabling write combining
  • switchtec: Add MRPC DMA mode support
  • PCI: switchtec: Fix stdev_release() crash after surprise hot remove
• CVE-url: https://ubuntu.com/security/CVE-2024-26696
  • nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
• CVE-url: https://ubuntu.com/security/CVE-2024-26685
  • nilfs2: fix potential bug in end_buffer_async_write
• CVE-url: https://ubuntu.com/security/CVE-2024-26625
  • llc: call sock_orphan() at release time
• CVE-url: https://ubuntu.com/security/CVE-2023-52615
  • hwrng: core - Fix page fault dead lock on mmap-ed hwrng
• CVE-url: https://ubuntu.com/security/CVE-2023-52486
  • drm: Don't unref the same fb many times by mistake due to deadlock handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26920
  • tracing/trigger: Fix to return error if failed to alloc snapshot
• CVE-url: https://ubuntu.com/security/CVE-2024-26697
  • nilfs2: fix data corruption in dsync block recovery for small block sizes
• CVE-url: https://ubuntu.com/security/CVE-2024-26679
  • inet: read sk->sk_family once in inet_recv_error()
• CVE-url: https://ubuntu.com/security/CVE-2023-52622
  • ext4: remove unnecessary check from alloc_flex_gd()
  • ext4: avoid online resizing failures due to oversized flex bg
• CVE-url: https://ubuntu.com/security/CVE-2024-26635
  • llc: Drop support for ETH_P_TR_802_2.
• CVE-url: https://ubuntu.com/security/CVE-2023-52594
  • wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() *…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-36780: Fixed a reference leak when pm_runtime_get_sync fails in i2c (bsc#1220556).
• CVE-2020-36782: Fixed a reference leak when pm_runtime_get_sync fails in i2c imx-lpi2c (bsc#1220560).
• CVE-2020-36783: Fixed a reference leak when pm_runtime_get_sync fails in i2c img-scb (bsc#1220561).
• CVE-2021-23134: Fixed a use-after-free issue in nfc sockets (bsc#1186060).
• CVE-2021-46909: Fixed a PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46921: Fixed ordering in queued_write_lock_slowpath (bsc#1220468).
• CVE-2021-46930: Fixed a list_head check warning caused by uninitialization of list_head in usb mtu3 (bsc#1220484).
• CVE-2021-46938: Fixed a double free of blk_mq_tag_set in dev remove after table load fails in dm rq (bsc#1220554).
• CVE-2021-46939: Fixed a denial of service in trace_clock_global() in tracing (bsc#1220580).
• CVE-2021-46943: Fixed an oops in set_fmt error handling in media: staging/intel-ipu3 (bsc#1220583).
• CVE-2021-46944: Fixed a memory leak in imu_fmt in media staging/intel-ipu3 (bsc#1220566).
• CVE-2021-46950: Fixed a data corruption bug in raid1 arrays using bitmaps in md/raid1 (bsc#1220662).
• CVE-2021-46951: Fixed an integer underflow of efi_tpm_final_log_size in tpm_read_log_efi in tpm efi (bsc#1220615).
• CVE-2021-46958: Fixed a race between transaction aborts and fsyncs leading to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46960: Fixed a warning on smb2_get_enc_key in cifs (bsc#1220528).
• CVE-2021-46961: Fixed an error on not enabling irqs when handling spurious interrups in irqchip/gic-v3 (bsc#1220529).
• CVE-2021-46962: Fixed a resource leak in the remove function in mmc uniphier-sd (bsc#1220532).
• CVE-2021-46963: Fixed a denial of service in qla2xxx_mqueuecommand() in scsi qla2xxx (bsc#1220536)
• CVE-2021-46971: Fixed unconditional security_locked_down() call in perf/core (bsc#1220697).
• CVE-2021-46981: Fixed a NULL pointer in flush_workqueue in nbd (bsc#1220611).
• CVE-2021-46984: Fixed an out of bounds access in kyber_bio_merge() in kyber (bsc#1220631).
• CVE-2021-46988: Fixed release page in error path to avoid BUG_ON in userfaultfd (bsc#1220706).
• CVE-2021-46990: Fixed a denial of service when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46991: Fixed a use-after-free in i40e_client_subtask (bsc#1220575).
• CVE-2021-46992: Fixed a bug to avoid overflows in nft_hash_buckets (bsc#1220638).
• CVE-2021-46998: Fixed an use after free bug in enic_hard_start_xmit in ethernet/enic (bsc#1220625).
• CVE-2021-47000: Fixed an inode leak on getattr error in __fh_to_dentry in ceph (bsc#1220669).
• CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2021-47015: Fixed a RX consumer index logic in the error path in bnxt_rx_pkt() in bnxt_en (bsc#1220794).
• CVE-2021-47020: Fixed a memory leak in stream config error path in soundwire stream (bsc#1220785).
• CVE-2021-47034: Fixed a kernel memory fault for pte update on radix in powerpc/64s (bsc#1220687).
• CVE-2021-47045: Fixed a null pointer dereference in lpfc_prep_els_iocb() in scsi lpfc (bsc#1220640).
• CVE-2021-47049: Fixed an after free in __vmbus_open() in hv vmbus (bsc#1220692).
• CVE-2021-47051: Fixed a PM reference leak in lpspi_prepare_xfer_hardware() in spi fsl-lpspi (bsc#1220764).
• CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).
• CVE-2021-47056: Fixed a user-memory-access error on vf2pf_lock in crypto (bsc#1220769).
• CVE-2021-47058: Fixed a possible user-after-free in set debugfs_name in regmap (bsc#1220779).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2021-47063: Fixed a potential…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-36780: Fixed a reference leak when pm_runtime_get_sync fails in i2c (bsc#1220556).
• CVE-2020-36781: Fixed reference leak when pm_runtime_get_sync fails in i2c/imx (bsc#1220557).
• CVE-2020-36782: Fixed a reference leak when pm_runtime_get_sync fails in i2c imx-lpi2c (bsc#1220560).
• CVE-2020-36783: Fixed a reference leak when pm_runtime_get_sync fails in i2c img-scb (bsc#1220561).
• CVE-2021-46908: Fixed incorrect permission flag for mixed signed bounds arithmetic in bpf (bsc#1220425).
• CVE-2021-46909: Fixed a PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46911: Fixed kernel panic (bsc#1220400).
• CVE-2021-46914: Fixed unbalanced device enable/disable in suspend/resume in pci_disable_device() (bsc#1220465).
• CVE-2021-46917: Fixed wq cleanup of WQCFG registers in idxd (bsc#1220432).
• CVE-2021-46918: Fixed not clearing MSIX permission entry on shutdown in idxd (bsc#1220429).
• CVE-2021-46919: Fixed wq size store permission state in idxd (bsc#1220414).
• CVE-2021-46920: Fixed clobbering of SWERR overflow bit on writeback (bsc#1220426).
• CVE-2021-46921: Fixed ordering in queued_write_lock_slowpath (bsc#1220468).
• CVE-2021-46922: Fixed TPM reservation for seal/unseal (bsc#1220475).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46938: Fixed a double free of blk_mq_tag_set in dev remove after table load fails in dm rq (bsc#1220554).
• CVE-2021-46939: Fixed a denial of service in trace_clock_global() in tracing (bsc#1220580).
• CVE-2021-46943: Fixed an oops in set_fmt error handling in media: staging/intel-ipu3 (bsc#1220583).
• CVE-2021-46944: Fixed a memory leak in imu_fmt in media staging/intel-ipu3 (bsc#1220566).
• CVE-2021-46950: Fixed a data corruption bug in raid1 arrays using bitmaps in md/raid1 (bsc#1220662).
• CVE-2021-46951: Fixed an integer underflow of efi_tpm_final_log_size in tpm_read_log_efi in tpm efi (bsc#1220615).
• CVE-2021-46956: Fixed memory leak in virtio_fs_probe() (bsc#1220516).
• CVE-2021-46958: Fixed a race between transaction aborts and fsyncs leading to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46959: Fixed use-after-free with devm_spi_alloc_* (bsc#1220734).
• CVE-2021-46960: Fixed a warning on smb2_get_enc_key in cifs (bsc#1220528).
• CVE-2021-46961: Fixed spurious interrup handling (bsc#1220529).
• CVE-2021-46962: Fixed a resource leak in the remove function in mmc uniphier-sd (bsc#1220532).
• CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand() (bsc#1220536).
• CVE-2021-46971: Fixed unconditional security_locked_down() call (bsc#1220697).
• CVE-2021-46976: Fixed crash in auto_retire in drm/i915 (bsc#1220621).
• CVE-2021-46980: Fixed not retrieving all the PDOs instead of just the first 4 in usb/typec/ucsi (bsc#1220663).
• CVE-2021-46981: Fixed a NULL pointer in flush_workqueue in nbd (bsc#1220611).
• CVE-2021-46983: Fixed NULL pointer dereference when SEND is completed with error (bsc#1220639).
• CVE-2021-46984: Fixed an out of bounds access in kyber_bio_merge() in kyber (bsc#1220631).
• CVE-2021-46988: Fixed release page in error path to avoid BUG_ON (bsc#1220706).
• CVE-2021-46990: Fixed a denial of service when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46991: Fixed a use-after-free in i40e_client_subtask (bsc#1220575).
• CVE-2021-46992: Fixed a bug to avoid overflows in nft_hash_buckets (bsc#1220638).
• CVE-2021-46998: Fixed an use after free bug in enic_hard_start_xmit in ethernet/enic (bsc#1220625).
• CVE-2021-47000: Fixed an inode leak on getattr error in __fh_to_dentry in ceph (bsc#1220669).
• CVE-2021-47001: Fixed cwnd update ordering in xprtrdma (bsc#1220670).
• CVE-2021-47003: Fixed…

The SUSE Linux Enterprise 15 SP3 LTSS kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-36781: Fixed reference leak when pm_runtime_get_sync fails in i2c/imx (bsc#1220557).
• CVE-2021-46911: Fixed kernel panic (bsc#1220400).
• CVE-2021-46914: Fixed unbalanced device enable/disable in suspend/resume in pci_disable_device() (bsc#1220465).
• CVE-2021-46917: Fixed wq cleanup of WQCFG registers in idxd (bsc#1220432).
• CVE-2021-46918: Fixed not clearing MSIX permission entry on shutdown in idxd (bsc#1220429).
• CVE-2021-46919: Fixed wq size store permission state in idxd (bsc#1220414).
• CVE-2021-46920: Fixed clobbering of SWERR overflow bit on writeback (bsc#1220426).
• CVE-2021-46922: Fixed TPM reservation for seal/unseal (bsc#1220475).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46956: Fixed memory leak in virtio_fs_probe() (bsc#1220516).
• CVE-2021-46959: Fixed use-after-free with devm_spi_alloc_* (bsc#1220734).
• CVE-2021-46961: Fixed spurious interrup handling (bsc#1220529).
• CVE-2021-46971: Fixed unconditional security_locked_down() call (bsc#1220697).
• CVE-2021-46976: Fixed crash in auto_retire in drm/i915 (bsc#1220621).
• CVE-2021-46980: Fixed not retrieving all the PDOs instead of just the first 4 in usb/typec/ucsi (bsc#1220663).
• CVE-2021-46983: Fixed NULL pointer dereference when SEND is completed with error (bsc#1220639).
• CVE-2021-46988: Fixed release page in error path to avoid BUG_ON (bsc#1220706).
• CVE-2021-47001: Fixed cwnd update ordering in xprtrdma (bsc#1220670).
• CVE-2021-47003: Fixed potential null dereference on pointer status in idxd_cmd_exec (bsc#1220677).
• CVE-2021-47009: Fixed memory leak on object td (bsc#1220733).
• CVE-2021-47014: Fixed wild memory access when clearing fragments in net/sched/act_ct (bsc#1220630).
• CVE-2021-47017: Fixed use after free in ath10k_htc_send_bundle (bsc#1220678).
• CVE-2021-47026: Fixed not destroying sysfs after removing session from active list (bsc#1220685).
• CVE-2021-47035: Fixed wrong WO permissions on second-level paging entries in iommu/vt-d (bsc#1220688).
• CVE-2021-47038: Fixed deadlock between hci_dev->lock and socket lock in bluetooth (bsc#1220753).
• CVE-2021-47044: Fixed shift-out-of-bounds in load_balance() in sched/fair (bsc#1220759).
• CVE-2021-47046: Fixed off by one in hdmi_14_process_transaction() (bsc#1220758).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47109: Fixed NUD_NOARP entries to be forced GCed (bsc#1221534).
• CVE-2021-47130: Fixed freeing unallocated p2pmem in nvmet (bsc#1221552).
• CVE-2021-47137: Fixed memory corruption in RX ring in net/lantiq (bsc#1221932).
• CVE-2021-47150: Fixed the potential memory leak in fec_enet_init() (bsc#1221973).
• CVE-2021-47160: Fixed VLAN traffic leaks in dsa: mt7530 (bsc#1221974).
• CVE-2021-47164: Fixed null pointer dereference accessing lag dev in net/mlx5e (bsc#1221978).
• CVE-2021-47174: Fixed missing check in irq_fpu_usable() (bsc#1221990).
• CVE-2021-47175: Fixed OOB access in net/sched/fq_pie (bsc#1222003).
• CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource() (bsc#1222660).
• CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145, bsc#1222664).
• CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).
• CVE-2021-47189: Fixed denial of service due to memory…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).
• CVE-2020-36312: Fixed an issue in virt/kvm/kvm_main.c that had a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure (bsc#1184509).
• CVE-2021-23134: Fixed a use-after-free issue in nfc sockets (bsc#1186060).
• CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).
• CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).
• CVE-2021-46909: Fixed a PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46938: Fixed a double free of blk_mq_tag_set in dev remove after table load fails in dm rq (bsc#1220554).
• CVE-2021-46939: Fixed a denial of service in trace_clock_global() in tracing (bsc#1220580).
• CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).
• CVE-2021-46950: Fixed a data corruption bug in raid1 arrays using bitmaps in md/raid1 (bsc#1220662).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).
• CVE-2021-46958: Fixed a race between transaction aborts and fsyncs leading to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46960: Fixed a warning on smb2_get_enc_key in cifs (bsc#1220528).
• CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand() (bsc#1220536).
• CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).
• CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).
• CVE-2021-46981: Fixed a NULL pointer in flush_workqueue in nbd (bsc#1220611).
• CVE-2021-46988: Fixed release page in error path to avoid BUG_ON (bsc#1220706).
• CVE-2021-46990: Fixed a denial of service when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46998: Fixed an use after free bug in enic_hard_start_xmit in ethernet/enic (bsc#1220625).
• CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).
• CVE-2021-47015: Fixed a RX consumer index logic in the error path in bnxt_rx_pkt() in bnxt_en (bsc#1220794).
• CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).
• CVE-2021-47034: Fixed a kernel memory fault for pte update on radix in powerpc/64s (bsc#1220687).
• CVE-2021-47045: Fixed a null pointer dereference in lpfc_prep_els_iocb() in scsi lpfc (bsc#1220640).
• CVE-2021-47049: Fixed an after free in __vmbus_open() in hv vmbus (bsc#1220692).
• CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).
• CVE-2021-47056: Fixed a user-memory-access error on vf2pf_lock in crypto (bsc#1220769).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2021-47063: Fixed a potential use-after-free during bridge detach in drm bridge/panel (bsc#1220777).
• CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).
• CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).
• CVE-2021-47071: Fixed a memory leak in error handling paths in hv_uio_cleanup() in uio_hv_generic (bsc#1220846).
• CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221532).
• CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221541).
• CVE-2021-47113: Abort…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).
• CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).
• CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).
• CVE-2021-46909: Fixed a PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46938: Fixed a double free of blk_mq_tag_set in dev remove after table load fails in dm rq (bsc#1220554).
• CVE-2021-46939: Fixed a denial of service in trace_clock_global() in tracing (bsc#1220580).
• CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).
• CVE-2021-46950: Fixed a data corruption bug in raid1 arrays using bitmaps in md/raid1 (bsc#1220662).
• CVE-2021-46958: Fixed a race between transaction aborts and fsyncs leading to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46960: Fixed a warning on smb2_get_enc_key in cifs (bsc#1220528).
• CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand() (bsc#1220536).
• CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).
• CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).
• CVE-2021-46981: Fixed a NULL pointer in flush_workqueue in nbd (bsc#1220611).
• CVE-2021-46988: Fixed release page in error path to avoid BUG_ON (bsc#1220706).
• CVE-2021-46990: Fixed a denial of service when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46998: Fixed an use after free bug in enic_hard_start_xmit in ethernet/enic (bsc#1220625).
• CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).
• CVE-2021-47015: Fixed a RX consumer index logic in the error path in bnxt_rx_pkt() in bnxt_en (bsc#1220794).
• CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).
• CVE-2021-47034: Fixed a kernel memory fault for pte update on radix in powerpc/64s (bsc#1220687).
• CVE-2021-47045: Fixed a null pointer dereference in lpfc_prep_els_iocb() in scsi lpfc (bsc#1220640).
• CVE-2021-47049: Fixed an after free in __vmbus_open() in hv vmbus (bsc#1220692).
• CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).
• CVE-2021-47056: Fixed a user-memory-access error on vf2pf_lock in crypto (bsc#1220769).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2021-47063: Fixed a potential use-after-free during bridge detach in drm bridge/panel (bsc#1220777).
• CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).
• CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).
• CVE-2021-47071: Fixed a memory leak in error handling paths in hv_uio_cleanup() in uio_hv_generic (bsc#1220846).
• CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221532).
• CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221541).
• CVE-2021-47114: Fixed a data corruption by fallocate in ocfs2 (bsc#1221548).
• CVE-2021-47117: Fixed a crash in ext4_es_cache_extent as ext4_split_extent_at failed in ext4 (bsc#1221575).
• CVE-2021-47118: Fixed an use-after-free in init task's struct pid in pid (bsc#1221605).
• CVE-2021-47119: Fixed a memory leak in ext4_fill_super in ext4 (bsc#1221608). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).
• CVE-2020-36312: Fixed an issue in virt/kvm/kvm_main.c that had a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure (bsc#1184509).
• CVE-2021-23134: Fixed a use-after-free issue in nfc sockets (bsc#1186060).
• CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).
• CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).
• CVE-2021-46909: Fixed PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46938: Fixed double free of blk_mq_tag_set in dev remove after table load fails (bsc#1220554).
• CVE-2021-46939: Fixed possible hung in trace_clock_global() (bsc#1220580).
• CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).
• CVE-2021-46950: Fixed possible data corruption in md/raid1 when ending a failed write request (bsc#1220662).
• CVE-2021-46958: Fixed race between transaction aborts and fsyncs that could lead to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46960: Fixed wrong error code from smb2_get_enc_key() (bsc#1220528).
• CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand() (bsc#1220536).
• CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).
• CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).
• CVE-2021-46981: Fixed NULL pointer in flush_workqueue (bsc#1220611).
• CVE-2021-46988: Fixed possible crash in userfaultfd due to unreleased page (bsc#1220706).
• CVE-2021-46990: Fixed crashes when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46998: Fixed a use after free bug in enic_hard_start_xmit() (bsc#1220625).
• CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).
• CVE-2021-47015: Fixed RX consumer index logic in the error path in bnxt_en (bsc#1220794).
• CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).
• CVE-2021-47034: Fixed resolved pte update for kernel memory on radix in powerpc/64s (bsc#1220687).
• CVE-2021-47045: Fixed null pointer dereference in lpfc_prep_els_iocb() (bsc#1220640).
• CVE-2021-47049: Fixed Use after free in __vmbus_open() (bsc#1220692).
• CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).
• CVE-2021-47056: Fixed uninitialized lock in adf_vf2pf_shutdown() (bsc#1220769).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2021-47063: Fixed possible use-after-free in panel_bridge_detach() (bsc#1220777).
• CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).
• CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).
• CVE-2021-47071: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220846).
• CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221532).
• CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221541).
• CVE-2021-47114: Fixed data corruption by fallocate in ocfs2 (bsc#1221548).
• CVE-2021-47117: Fixed bug on in ext4_es_cache_extent() as ext4_split_extent_at() failed (bsc#1221575).
• CVE-2021-47118: Fixed possible use-after-free when initializing cad_pid (bsc#1221605). -…

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Block layer subsystem;
• Userspace I/O drivers;
• Ceph distributed file system;
• Ext4 file system;
• JFS file system;
• NILFS2 file system;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Netlink;
• NFC subsystem;
• Tomoyo security module; (CVE-2023-52524, CVE-2023-52530, CVE-2023-52601, CVE-2023-52439, CVE-2024-26635, CVE-2023-52602, CVE-2024-26614, CVE-2024-26704, CVE-2023-52604, CVE-2023-52566, CVE-2021-46981, CVE-2024-26622, CVE-2024-26735, CVE-2024-26805, CVE-2024-26801, CVE-2023-52583)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Block layer subsystem;
• Userspace I/O drivers;
• Ceph distributed file system;
• Ext4 file system;
• JFS file system;
• NILFS2 file system;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Netlink;
• NFC subsystem;
• Tomoyo security module; (CVE-2023-52524, CVE-2023-52530, CVE-2023-52601, CVE-2023-52439, CVE-2024-26635, CVE-2023-52602, CVE-2024-26614, CVE-2024-26704, CVE-2023-52604, CVE-2023-52566, CVE-2021-46981, CVE-2024-26622, CVE-2024-26735, CVE-2024-26805, CVE-2024-26801, CVE-2023-52583)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Block layer subsystem;
• Userspace I/O drivers;
• Ceph distributed file system;
• Ext4 file system;
• JFS file system;
• NILFS2 file system;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Netlink;
• NFC subsystem;
• Tomoyo security module; (CVE-2023-52524, CVE-2023-52530, CVE-2023-52601, CVE-2023-52439, CVE-2024-26635, CVE-2023-52602, CVE-2024-26614, CVE-2024-26704, CVE-2023-52604, CVE-2023-52566, CVE-2021-46981, CVE-2024-26622, CVE-2024-26735, CVE-2024-26805, CVE-2024-26801, CVE-2023-52583)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Block layer subsystem;
• Userspace I/O drivers;
• Ceph distributed file system;
• Ext4 file system;
• JFS file system;
• NILFS2 file system;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Netlink;
• NFC subsystem;
• Tomoyo security module; (CVE-2023-52524, CVE-2023-52530, CVE-2023-52601, CVE-2023-52439, CVE-2024-26635, CVE-2023-52602, CVE-2024-26614, CVE-2024-26704, CVE-2023-52604, CVE-2023-52566, CVE-2021-46981, CVE-2024-26622, CVE-2024-26735, CVE-2024-26805, CVE-2024-26801, CVE-2023-52583)