CVE-2023-21400

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call.(CVE-2022-45887)

A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. 

(CVE-2023-20588)

In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.

(CVE-2023-21400)

** REJECT ** CVE-2023-4881 was wrongly assigned to a bug that was deemed to be a non-security issue by the Linux kernel security team.(CVE-2023-4881)

A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue().

We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8.

(CVE-2023-4921)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call.(CVE-2022-45887)

A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. 

(CVE-2023-20588)

In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.

(CVE-2023-21400)

** REJECT ** CVE-2023-4881 was wrongly assigned to a bug that was deemed to be a non-security issue by the Linux kernel security team.(CVE-2023-4881)

A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue().

We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8.

(CVE-2023-4921)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call.(CVE-2022-45887)

A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. 

(CVE-2023-20588)

In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.

(CVE-2023-21400)

VUL-0: CVE-2023-32249: kernel: Linux Kernel ksmbd Multichannel Improper Authentication Session Hijack Vulnerability(CVE-2023-32249)

VUL-0: CVE-2023-32251: kernel: Linux Kernel ksmbd Improper Restriction of Excessive Authentication Attempts Protection Bypass Vulnerability(CVE-2023-32251)

VUL-0: CVE-2023-32253: kernel: Linux Kernel ksmbd Session Deadlock Denial-of-Service Vulnerability(CVE-2023-32253)

** REJECT ** CVE-2023-4881 was wrongly assigned to a bug that was deemed to be a non-security issue by the Linux kernel security team.(CVE-2023-4881)

A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue().

We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8.

(CVE-2023-4921)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call.(CVE-2022-45887)

A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. 

(CVE-2023-20588)

In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.

(CVE-2023-21400)

VUL-0: CVE-2023-32249: kernel: Linux Kernel ksmbd Multichannel Improper Authentication Session Hijack Vulnerability(CVE-2023-32249)

VUL-0: CVE-2023-32251: kernel: Linux Kernel ksmbd Improper Restriction of Excessive Authentication Attempts Protection Bypass Vulnerability(CVE-2023-32251)

VUL-0: CVE-2023-32253: kernel: Linux Kernel ksmbd Session Deadlock Denial-of-Service Vulnerability(CVE-2023-32253)

** REJECT ** CVE-2023-4881 was wrongly assigned to a bug that was deemed to be a non-security issue by the Linux kernel security team.(CVE-2023-4881)

A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue().

We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8.

(CVE-2023-4921)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call.(CVE-2022-45887)

A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. 

(CVE-2023-20588)

In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.

(CVE-2023-21400)

VUL-0: CVE-2023-32249: kernel: Linux Kernel ksmbd Multichannel Improper Authentication Session Hijack Vulnerability(CVE-2023-32249)

VUL-0: CVE-2023-32251: kernel: Linux Kernel ksmbd Improper Restriction of Excessive Authentication Attempts Protection Bypass Vulnerability(CVE-2023-32251)

VUL-0: CVE-2023-32253: kernel: Linux Kernel ksmbd Session Deadlock Denial-of-Service Vulnerability(CVE-2023-32253)

** REJECT ** CVE-2023-4881 was wrongly assigned to a bug that was deemed to be a non-security issue by the Linux kernel security team.(CVE-2023-4881)

A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue().

We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8.

(CVE-2023-4921)

In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.

It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3090)

It was discovered that the virtual terminal driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory).(CVE-2023-3567)

It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3609)

It was discovered that the network packet classifier with netfilter/firewall marks implementation in the Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3776)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules flush in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-3777)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-3995)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-4004)

It was discovered that some network classifier implementations in the Linux kernel contained use-after-free vulnerabilities. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-4128)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-21400)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle L2CAP socket release, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-40283)

In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287).
• CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially access sensitive information (bsc#1213286).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-2166: Fixed NULL pointer dereference in can_rcv_filter (bsc#1210627).
• CVE-2023-2430: Fixed amissing lock for IOPOLL in io_cqring_event_overflow() in io_uring.c that could allow a privileged user to cause a denial of service (bsc#1211014).
• CVE-2023-2985: Fixed an use-after-free vulnerability in hfsplus_put_super in fs/hfsplus/super.c that could allow a local user to cause a denial of service (bsc#1211867).
• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-3117: Fixed an use-after-free vulnerability in the netfilter subsystem when processing named and anonymous sets in batch requests that could allow a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system (bsc#1213245).
• CVE-2023-31248: Fixed an use-after-free vulnerability in nft_chain_lookup_byid that could allow a local attacker to escalate their privilege (bsc#1213061).
• CVE-2023-3212: Fixed a NULL pointer dereference flaw in the gfs2 file system (bsc#1212265).
• CVE-2023-3268: Fixed an out of bounds memory access flaw in relay_file_read_start_pos in the relayfs (bsc#1212502).
• CVE-2023-3389: Fixed a use-after-free vulnerability in the io_uring subsystem (bsc#1212838).
• CVE-2023-3390: Fixed an use-after-free vulnerability in the netfilter subsystem in net/netfilter/nf_tables_api.c that could allow a local attacker with user access to cause a privilege escalation issue (bsc#1212846).
• CVE-2023-35001: Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege (bsc#1213059).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-3609: Fixed reference counter leak leading to overflow in net/sched (bsc#1213586).
• CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).
• CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543).
• CVE-2023-38409: Fixed a use-after-free in drivers/video/fbdev/core/fbcon.c (bsc#1213417).
• CVE-2023-3863: Fixed a use-after-free flaw in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC (bsc#1213601).
• CVE-2023-4004: Fixed improper element removal netfilter nft_set_pipapo (bsc#1213812).

The following non-security bugs were fixed:

• acpi/iort: remove erroneous id_count check in iort_node_get_rmr_info() (git-fixes).
• acpi: cppc: add acpi disabled check to acpi_cpc_valid() (bsc#1212445).
• acpi: cppc: add definition for undefined fadt preferred pm profile value (bsc#1212445).
• acpi: fix suspend with xen pv (git-fixes).
• acpi: utils: fix acpi_evaluate_dsm_typed() redefinition error…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-2166: Fixed NULL pointer dereference in can_rcv_filter (bsc#1210627).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-3268: Fixed an out of bounds memory access flaw in relay_file_read_start_pos in the relayfs (bsc#1212502).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-3609: Fixed reference counter leak leading to overflow in net/sched (bsc#1213586).
• CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).
• CVE-2023-38409: Fixed an issue in set_con2fb_map in drivers/video/fbdev/core/fbcon.c. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info) (bsc#1213417).
• CVE-2023-3863: Fixed a use-after-free flaw in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC. This flaw allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4004: Fixed improper element removal netfilter nft_set_pipapo (bsc#1213812).

The following non-security bugs were fixed:

• ACPI: CPPC: Add ACPI disabled check to acpi_cpc_valid() (bsc#1212445).
• ACPI: CPPC: Add definition for undefined FADT preferred PM profile value (bsc#1212445).
• ACPI/IORT: Remove erroneous id_count check in iort_node_get_rmr_info() (git-fixes).
• ACPI: utils: Fix acpi_evaluate_dsm_typed() redefinition error (git-fixes).
• afs: Adjust ACK interpretation to try and cope with NAT (git-fixes).
• afs: Fix access after dec in put functions (git-fixes).
• afs: Fix afs_getattr() to refetch file status if callback break occurred (git-fixes).
• afs: Fix dynamic root getattr (git-fixes).
• afs: Fix fileserver probe RTT handling (git-fixes).
• afs: Fix infinite loop found by xfstest generic/676 (git-fixes).
• afs: Fix lost servers_outstanding count (git-fixes).
• afs: Fix server->active leak in afs_put_server (git-fixes).
• afs: Fix setting of mtime when creating a file/dir/symlink (git-fixes).
• afs: Fix updating of i_size with dv jump from server (git-fixes).
• afs: Fix vlserver probe RTT handling (git-fixes).
• afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked (git-fixes).
• afs: Use refcount_t rather than atomic_t (git-fixes).
• afs: Use the operation issue time instead of the reply time for callbacks (git-fixes).
• ALSA: emu10k1: roll up loops in DSP setup code for Audigy (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo NS70AU (git-fixes).
• ALSA: hda/realtek: Add support for DELL Oasis 13/14/16 laptops (git-fixes).
• ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx (git-fixes).
• ALSA: hda/realtek: Fix generic fixup definition for cs35l41 amp (git-fixes).
• ALSA: hda/realtek - remove 3k pull low procedure (git-fixes).
• ALSA: hda/realtek: Support ASUS G713PV laptop (git-fixes).
• ALSA: hda/relatek: Enable Mute LED on HP 250 G8 (git-fixes).
• ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum610 Wireless (git-fixes).
• ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless (git-fixes).
• ALSA: usb-audio: Add quirk for Microsoft Modern Wireless Headset (bsc#1207129).
• ALSA: usb-audio: Always initialize…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-2166: Fixed NULL pointer dereference in can_rcv_filter (bsc#1210627).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-3268: Fixed an out of bounds memory access flaw in relay_file_read_start_pos in the relayfs (bsc#1212502).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-3609: Fixed reference counter leak leading to overflow in net/sched (bsc#1213586).
• CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).
• CVE-2023-4004: Fixed improper element removal netfilter nft_set_pipapo (bsc#1213812).

The following non-security bugs were fixed:

• afs: Fix access after dec in put functions (git-fixes).
• afs: Fix afs_getattr() to refetch file status if callback break occurred (git-fixes).
• afs: Fix dynamic root getattr (git-fixes).
• afs: Fix fileserver probe RTT handling (git-fixes).
• afs: Fix infinite loop found by xfstest generic/676 (git-fixes).
• afs: Fix lost servers_outstanding count (git-fixes).
• afs: Fix server->active leak in afs_put_server (git-fixes).
• afs: Fix setting of mtime when creating a file/dir/symlink (git-fixes).
• afs: Fix updating of i_size with dv jump from server (git-fixes).
• afs: Fix vlserver probe RTT handling (git-fixes).
• afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked (git-fixes).
• afs: Use refcount_t rather than atomic_t (git-fixes).
• afs: Use the operation issue time instead of the reply time for callbacks (git-fixes).
• afs: adjust ack interpretation to try and cope with nat (git-fixes).
• alsa: emu10k1: roll up loops in dsp setup code for audigy (git-fixes).
• alsa: hda/realtek: support asus g713pv laptop (git-fixes).
• alsa: hda/relatek: enable mute led on hp 250 g8 (git-fixes).
• alsa: usb-audio: add quirk for microsoft modern wireless headset (bsc#1207129).
• alsa: usb-audio: update for native dsd support quirks (git-fixes).
• asoc: atmel: fix the 8k sample parameter in i2sc master (git-fixes).
• asoc: codecs: es8316: fix dmic config (git-fixes).
• asoc: da7219: check for failure reading aad irq events (git-fixes).
• asoc: da7219: flush pending aad irq when suspending (git-fixes).
• asoc: fsl_sai: disable bit clock with transmitter (git-fixes).
• asoc: fsl_spdif: silence output on stop (git-fixes).
• asoc: rt5682-sdw: fix for jd event handling in clockstop mode0 (git-fixes).
• asoc: rt711-sdca: fix for jd event handling in clockstop mode0 (git-fixes).
• asoc: rt711: fix for jd event handling in clockstop mode0 (git-fixes).
• asoc: wm8904: fill the cache for wm8904_adc_test_0 register (git-fixes).
• ata: pata_ns87415: mark ns87560_tf_read static (git-fixes).
• block, bfq: Fix division by zero error on zero wsum (bsc#1213653).
• block: Fix a source code comment in include/uapi/linux/blkzoned.h (git-fixes).
• can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED (git-fixes).
• ceph: do not let check_caps skip sending responses for revoke msgs (bsc#1213856).
• coda: Avoid partial allocation of sig_inputArgs (git-fixes).
• dlm: fix missing lkb refcount handling (git-fixes).
• dlm: fix plock invalid read (git-fixes).
• documentation: devices.txt: reconcile serial/ucc_uart minor numers (git-fixes). -…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287).
• CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially access sensitive information (bsc#1213286).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-2166: Fixed NULL pointer dereference in can_rcv_filter (bsc#1210627).
• CVE-2023-2985: Fixed an use-after-free vulnerability in hfsplus_put_super in fs/hfsplus/super.c that could allow a local user to cause a denial of service (bsc#1211867).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-3117: Fixed an use-after-free vulnerability in the netfilter subsystem when processing named and anonymous sets in batch requests that could allow a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system (bsc#1213245).
• CVE-2023-31248: Fixed an use-after-free vulnerability in nft_chain_lookup_byid that could allow a local attacker to escalate their privilege (bsc#1213061).
• CVE-2023-3268: Fixed an out of bounds memory access flaw in relay_file_read_start_pos in the relayfs (bsc#1212502).
• CVE-2023-3390: Fixed an use-after-free vulnerability in the netfilter subsystem in net/netfilter/nf_tables_api.c that could allow a local attacker with user access to cause a privilege escalation issue (bsc#1212846).
• CVE-2023-35001: Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege (bsc#1213059).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-3609: Fixed reference counter leak leading to overflow in net/sched (bsc#1213586).
• CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).
• CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543).
• CVE-2023-4004: Fixed improper element removal netfilter nft_set_pipapo (bsc#1213812).

The following non-security bugs were fixed:

• acpi: utils: fix acpi_evaluate_dsm_typed() redefinition error (git-fixes).
• add module_firmware() for firmware_tg357766 (git-fixes).
• afs: adjust ack interpretation to try and cope with nat (git-fixes).
• afs: fix access after dec in put functions (git-fixes).
• afs: fix afs_getattr() to refetch file status if callback break occurred (git-fixes).
• afs: fix dynamic root getattr (git-fixes).
• afs: fix fileserver probe rtt handling (git-fixes).
• afs: fix infinite loop found by xfstest generic/676 (git-fixes).
• afs: fix lost servers_outstanding count (git-fixes).
• afs: fix server->active leak in afs_put_server (git-fixes).
• afs: fix setting of mtime when creating a file/dir/symlink (git-fixes).
• afs: fix updating of i_size with dv jump from server (git-fixes).
• afs: fix vlserver probe rtt handling (git-fixes).
• afs: return -eagain, not -eremoteio, when a file already locked (git-fixes).
• afs: use refcount_t rather than atomic_t (git-fixes).
• afs: use the operation issue time instead of the reply time for callbacks (git-fixes).
• alsa: emu10k1: roll up loops in dsp setup code for audigy (git-fixes).
• alsa: fireface: make read-only const array for model names static (git-fixes).
• alsa: hda/realtek - remove 3k pull low…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287).
• CVE-2023-3268: Fixed an out of bounds memory access flaw in relay_file_read_start_pos in the relayfs (bsc#1212502).
• CVE-2023-2166: Fixed NULL pointer dereference in can_rcv_filter (bsc#1210627).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-4004: Fixed improper element removal netfilter nft_set_pipapo (bsc#1213812).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).
• CVE-2023-3863: Fixed a use-after-free flaw in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC. This flaw allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-3609: Fixed reference counter leak leading to overflow in net/sched (bsc#1213586).
• CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585).
• CVE-2023-38409: Fixed an issue in set_con2fb_map in drivers/video/fbdev/core/fbcon.c. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info) (bsc#1213417).
• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).

The following non-security bugs were fixed:

• ACPI: CPPC: Add ACPI disabled check to acpi_cpc_valid() (bsc#1212445).
• ACPI: CPPC: Add definition for undefined FADT preferred PM profile value (bsc#1212445).
• ACPI: utils: Fix acpi_evaluate_dsm_typed() redefinition error (git-fixes).
• ACPI/IORT: Remove erroneous id_count check in iort_node_get_rmr_info() (git-fixes).
• afs: Adjust ACK interpretation to try and cope with NAT (git-fixes).
• afs: Fix access after dec in put functions (git-fixes).
• afs: Fix afs_getattr() to refetch file status if callback break occurred (git-fixes).
• afs: Fix dynamic root getattr (git-fixes).
• afs: Fix fileserver probe RTT handling (git-fixes).
• afs: Fix infinite loop found by xfstest generic/676 (git-fixes).
• afs: Fix lost servers_outstanding count (git-fixes).
• afs: Fix server->active leak in afs_put_server (git-fixes).
• afs: Fix setting of mtime when creating a file/dir/symlink (git-fixes).
• afs: Fix updating of i_size with dv jump from server (git-fixes).
• afs: Fix vlserver probe RTT handling (git-fixes).
• afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked (git-fixes).
• afs: Use refcount_t rather than atomic_t (git-fixes).
• afs: Use the operation issue time instead of the reply time for callbacks (git-fixes).
• ALSA: emu10k1: roll up loops in DSP setup code for Audigy (git-fixes).
• ALSA: hda/realtek - remove 3k pull low procedure (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo NS70AU (git-fixes).
• ALSA: hda/realtek: Add support for DELL Oasis 13/14/16 laptops (git-fixes).
• ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx (git-fixes).
• ALSA: hda/realtek: Fix generic fixup definition for cs35l41 amp (git-fixes).
• ALSA: hda/realtek: Support ASUS G713PV laptop (git-fixes).
• ALSA: hda/relatek: Enable Mute LED on HP 250 G8 (git-fixes).
• ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum610 Wireless (git-fixes).
• ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless (git-fixes).
• ALSA: usb-audio: Add quirk for Microsoft Modern Wireless Headset (bsc#1207129).
• ALSA: usb-audio: Add quirk for Tascam…

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-2166: Fixed NULL pointer dereference in can_rcv_filter (bsc#1210627).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-3268: Fixed an out of bounds memory access flaw in relay_file_read_start_pos in the relayfs (bsc#1212502).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).
• CVE-2023-4004: Fixed improper element removal netfilter nft_set_pipapo (bsc#1213812).

The following non-security bugs were fixed:

• afs: adjust ack interpretation to try and cope with nat (git-fixes).
• afs: fix access after dec in put functions (git-fixes).
• afs: fix afs_getattr() to refetch file status if callback break occurred (git-fixes).
• afs: fix dynamic root getattr (git-fixes).
• afs: fix fileserver probe rtt handling (git-fixes).
• afs: fix infinite loop found by xfstest generic/676 (git-fixes).
• afs: fix lost servers_outstanding count (git-fixes).
• afs: fix server->active leak in afs_put_server (git-fixes).
• afs: fix setting of mtime when creating a file/dir/symlink (git-fixes).
• afs: fix updating of i_size with dv jump from server (git-fixes).
• afs: fix vlserver probe rtt handling (git-fixes).
• afs: return -eagain, not -eremoteio, when a file already locked (git-fixes).
• afs: use refcount_t rather than atomic_t (git-fixes).
• afs: use the operation issue time instead of the reply time for callbacks (git-fixes).
• alsa: emu10k1: roll up loops in dsp setup code for audigy (git-fixes).
• alsa: hda/realtek: support asus g713pv laptop (git-fixes).
• alsa: hda/relatek: enable mute led on hp 250 g8 (git-fixes).
• alsa: usb-audio: add quirk for microsoft modern wireless headset (bsc#1207129).
• alsa: usb-audio: update for native dsd support quirks (git-fixes).
• asoc: atmel: fix the 8k sample parameter in i2sc master (git-fixes).
• asoc: codecs: es8316: fix dmic config (git-fixes).
• asoc: da7219: check for failure reading aad irq events (git-fixes).
• asoc: da7219: flush pending aad irq when suspending (git-fixes).
• asoc: fsl_sai: disable bit clock with transmitter (git-fixes).
• asoc: fsl_spdif: silence output on stop (git-fixes).
• asoc: rt5682-sdw: fix for jd event handling in clockstop mode0 (git-fixes).
• asoc: rt711-sdca: fix for jd event handling in clockstop mode0 (git-fixes).
• asoc: rt711: fix for jd event handling in clockstop mode0 (git-fixes).
• asoc: wm8904: fill the cache for wm8904_adc_test_0 register (git-fixes).
• ata: pata_ns87415: mark ns87560_tf_read static (git-fixes).
• block, bfq: fix division by zero error on zero wsum (bsc#1213653).
• block: fix a source code comment in include/uapi/linux/blkzoned.h (git-fixes).
• can: gs_usb: gs_can_close(): add missing set of can state to can_state_stopped (git-fixes).
• ceph: do not let check_caps skip sending responses for revoke msgs (bsc#1213856).
• coda: avoid partial allocation of sig_inputargs (git-fixes).
• dlm: fix missing lkb refcount handling (git-fixes).
• dlm: fix plock invalid read (git-fixes).
• documentation: devices.txt: reconcile serial/ucc_uart minor numers (git-fixes).
• drm/amd/display: disable mpc split by default on special asic (git-fixes).
• drm/amd/display: keep phy active for dp displays on dcn31 (git-fixes).
• drm/client: fix memory…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).

The following non-security bugs were fixed:

• ARM: spear: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• Do not add and remove genksyms ifdefs
• clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• e1000: Fix fall-through warnings for Clang (jsc#PED-5738).
• e1000: Fix typos in comments (jsc#PED-5738).
• e1000: Remove unnecessary use of kmap_atomic() (jsc#PED-5738).
• e1000: drop unneeded assignment in e1000_set_itr() (jsc#PED-5738).
• e1000: switch to napi_consume_skb() (jsc#PED-5738).
• intel/e1000:fix repeated words in comments (jsc#PED-5738).
• intel: remove checker warning (jsc#PED-5738).
• kabi/severities: Ignore newly added SRSO mitigation functions
• md/raid0: Factor out helper for mapping and submitting a bio (bsc#1213916).
• md/raid0: Fix performance regression for large sequential writes (bsc#1213916).
• net: e1000: remove repeated word 'slot' for e1000_main.c (jsc#PED-5738).
• net: e1000: remove repeated words for e1000_hw.c (jsc#PED-5738).
• powerpc/rtas: block error injection when locked down (bsc#1023051). -…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).

The following non-security bugs were fixed:

• kabi/severities: Ignore newly added SRSO mitigation functions
• x86/cpu/kvm: Provide UNTRAIN_RET_VM (git-fixes).
• x86/cpu: Cleanup the untrain mess (git-fixes).
• x86/cpu: Rename original retbleed methods (git-fixes).
• x86/cpu: Rename srso_(.*)alias to srso_alias\1 (git-fixes).
• x86/retpoline: Do not clobber RFLAGS during srso_safe_ret() (git-fixes).
• x86/speculation: Add cpu_show_gds() prototype (git-fixes).
• x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (git-fixes).
• x86/srso: Correct the mitigation status when SMT is disabled (git-fixes).
• x86/srso: Disable the mitigation on unaffected configurations (git-fixes).
• x86/srso: Explain the untraining sequences a bit more (git-fixes).
• x86: Move gds_ucode_mitigated() declaration to header (git-fixes).

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).

The following non-security bugs were fixed:

• ARM: spear: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• Do not add and remove genksyms ifdefs
• clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• e1000: Fix fall-through warnings for Clang (jsc#PED-5738).
• e1000: Fix typos in comments (jsc#PED-5738).
• e1000: Remove unnecessary use of kmap_atomic() (jsc#PED-5738).
• e1000: drop unneeded assignment in e1000_set_itr() (jsc#PED-5738).
• e1000: switch to napi_consume_skb() (jsc#PED-5738).
• intel/e1000:fix repeated words in comments (jsc#PED-5738).
• intel: remove checker warning (jsc#PED-5738).
• kabi/severities: Ignore newly added SRSO mitigation functions
• md/raid0: Factor out helper for mapping and submitting a bio (bsc#1213916).
• md/raid0: Fix performance regression for large sequential writes (bsc#1213916).
• net: e1000: remove repeated word 'slot' for e1000_main.c (jsc#PED-5738).
• net: e1000: remove repeated words for e1000_hw.c (jsc#PED-5738).
• powerpc/rtas: block error injection when locked down (bsc#1023051). -…

Daniel Moghimi discovered that some Intel(R) Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. (CVE-2022-40982)

Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. (CVE-2023-20593)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3609)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle certain error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3610)

It was discovered that the Quick Fair Queueing network scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3611)

It was discovered that the network packet classifier with netfilter/firewall marks implementation in the Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3776)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules flush in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3777)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3995)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4004)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle bound chain deactivation in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4015)

Daniel Moghimi discovered that some Intel(R) Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. (CVE-2022-40982)

Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. (CVE-2023-20593)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3609)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle certain error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3610)

It was discovered that the Quick Fair Queueing network scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3611)

It was discovered that the network packet classifier with netfilter/firewall marks implementation in the Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3776)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules flush in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3777)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3995)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4004)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle bound chain deactivation in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4015)

Daniel Moghimi discovered that some Intel(R) Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. (CVE-2022-40982)

Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. (CVE-2023-20593)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3609)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle certain error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3610)

It was discovered that the Quick Fair Queueing network scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3611)

It was discovered that the network packet classifier with netfilter/firewall marks implementation in the Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3776)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules flush in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3777)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3995)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4004)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle bound chain deactivation in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4015)

Daniel Moghimi discovered that some Intel(R) Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. (CVE-2022-40982)

William Zhao discovered that the Traffic Control (TC) subsystem in the Linux kernel did not properly handle network packet retransmission in certain situations. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2022-4269)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly check buffer indexes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2022-48502)

Seth Jenkins discovered that the Linux kernel did not properly perform address randomization for a per-cpu memory management structure. A local attacker could use this to expose sensitive information (kernel memory) or in conjunction with another kernel vulnerability. (CVE-2023-0597)

It was discovered that a race condition existed in the btrfs file system implementation in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-1611)

It was discovered that the APM X-Gene SoC hardware monitoring driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information (kernel memory). (CVE-2023-1855)

It was discovered that the ST NCI NFC driver did not properly handle device removal events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-1990)

Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of service (bluetooth communication). (CVE-2023-2002)

Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. (CVE-2023-20593)

It was discovered that the XFS file system implementation in the Linux kernel did not properly perform metadata validation when mounting certain images. An attacker could use this to specially craft a file system image that, when mounted, could cause a denial of service (system crash). (CVE-2023-2124)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

Juan Jose Lopez Jaimez, Meador Inge, Simon Scannell, and Nenad Stojanovski discovered that the BPF verifier in the Linux kernel did not properly mark registers for precision tracking in certain situations, leading to an out- of-bounds access vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-2163)

It was discovered that the SLIMpro I2C device driver in the Linux kernel did not properly validate user-supplied data in some situations, leading to an out-of-bounds write vulnerability. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-2194)

It was discovered that the perf subsystem in the Linux kernel contained a use-after-free vulnerability. A privileged local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-2235)

Zheng Zhang discovered that the device-mapper implementation in…

Daniel Moghimi discovered that some Intel(R) Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. (CVE-2022-40982)

Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. (CVE-2023-20593)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3609)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle certain error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3610)

It was discovered that the Quick Fair Queueing network scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3611)

It was discovered that the network packet classifier with netfilter/firewall marks implementation in the Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3776)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules flush in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3777)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3995)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4004)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle bound chain deactivation in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4015)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• TTY drivers;
• Netfilter;
• Network traffic control;
• VMware vSockets driver; (CVE-2024-53141, CVE-2024-53103, CVE-2024-40967, CVE-2024-53164)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• TTY drivers;
• Netfilter;
• Network traffic control;
• VMware vSockets driver; (CVE-2024-53141, CVE-2024-53103, CVE-2024-40967, CVE-2024-53164)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• TTY drivers;
• Netfilter;
• Network traffic control;
• VMware vSockets driver; (CVE-2024-53141, CVE-2024-53103, CVE-2024-40967, CVE-2024-53164)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• TTY drivers;
• Netfilter;
• Network traffic control;
• VMware vSockets driver; (CVE-2024-53141, CVE-2024-53103, CVE-2024-40967, CVE-2024-53164)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• TTY drivers;
• Netfilter;
• Network traffic control;
• VMware vSockets driver; (CVE-2024-53141, CVE-2024-53103, CVE-2024-40967, CVE-2024-53164)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• Block layer subsystem;
• ACPI drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• TPM device driver;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• NTB driver;
• Virtio pmem driver;
• Parport drivers;
• PCI subsystem;
• SPI subsystem;
• Direct Digital Synthesis drivers;
• TTY drivers;
• USB Device Class drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• Framebuffer layer;
• BTRFS file system;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• File systems infrastructure;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• SMB network file system;
• Network traffic control;
• Network sockets;
• TCP network protocol;
• BPF subsystem;
• Perf events;
• Arbitrary resource management;
• Timer substystem drivers;
• Tracing infrastructure;
• Closures library;
• Memory management;
• Amateur Radio drivers;
• Bluetooth subsystem;
• Ethernet bridge;
• CAN network layer;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Netfilter;
• Netlink;
• SCTP protocol;
• TIPC protocol;
• VMware vSockets driver;
• Wireless networking;
• XFRM subsystem;
• Key management;
• FireWire sound drivers;
• AudioScience HPI driver;
• Amlogic Meson SoC drivers;
• KVM core; (CVE-2024-50116, CVE-2024-43863, CVE-2024-47757, CVE-2024-50236, CVE-2024-53104, CVE-2024-47701, CVE-2024-46854, CVE-2024-50024, CVE-2024-46849, CVE-2024-50035, CVE-2024-50262, CVE-2024-50184, CVE-2023-52458, CVE-2024-47696, CVE-2024-49957, CVE-2024-47692, CVE-2024-50007, CVE-2024-49867, CVE-2024-49900, CVE-2024-50167, CVE-2024-47697, CVE-2024-53164, CVE-2024-50179, CVE-2024-44931, CVE-2024-50301, CVE-2024-50218, CVE-2024-49995, CVE-2024-47742, CVE-2024-47756, CVE-2021-47469, CVE-2024-49982, CVE-2024-50229, CVE-2024-49851, CVE-2024-47685, CVE-2024-50265, CVE-2024-50195, CVE-2024-47747, CVE-2024-50273, CVE-2024-53066, CVE-2024-49924, CVE-2024-49963, CVE-2024-50287, CVE-2024-49948, CVE-2024-47674, CVE-2024-40967, CVE-2024-35887, CVE-2024-50044, CVE-2024-50099, CVE-2024-53059, CVE-2024-50171, CVE-2024-50082, CVE-2024-41066, CVE-2024-50202, CVE-2024-49868, CVE-2024-49952, CVE-2024-49965, CVE-2024-50296, CVE-2024-49903, CVE-2024-50194, CVE-2024-47712, CVE-2024-53101, CVE-2024-40953, CVE-2024-47706, CVE-2024-49958, CVE-2024-50059, CVE-2024-47713, CVE-2024-47737, CVE-2024-49902, CVE-2024-49959, CVE-2024-53103, CVE-2024-49973, CVE-2024-50045, CVE-2024-47710, CVE-2024-50131, CVE-2024-47671, CVE-2024-50205, CVE-2024-47672, CVE-2024-50234, CVE-2024-50233, CVE-2024-49860, CVE-2024-50127, CVE-2024-50168, CVE-2024-49962, CVE-2024-38544, CVE-2024-47749, CVE-2024-49949, CVE-2024-50096, CVE-2024-50033, CVE-2024-49955, CVE-2024-49938, CVE-2024-47698, CVE-2024-50230, CVE-2024-47723, CVE-2024-49877, CVE-2024-50180, CVE-2024-49879, CVE-2024-53061, CVE-2024-47679, CVE-2024-49892, CVE-2024-50299, CVE-2024-49896, CVE-2024-40911, CVE-2024-50134, CVE-2024-47740, CVE-2024-50039, CVE-2024-49985, CVE-2024-41016, CVE-2024-50269, CVE-2024-50290, CVE-2024-49882, CVE-2024-47699, CVE-2023-52917, CVE-2024-50267, CVE-2024-50151, CVE-2024-50251, CVE-2024-49966, CVE-2024-49981,…

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• S390 architecture;
• SuperH RISC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• Virtio block driver;
• TPM device driver;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCPI message protocol;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Microsoft Hyper-V drivers;
• I2C subsystem;
• I3C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• NTB driver;
• Virtio pmem driver;
• NVME drivers;
• Parport drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Real Time Clock drivers;
• SCSI subsystem;
• SuperH / SH-Mobile drivers;
• QCOM SoC drivers;
• SPI subsystem;
• Direct Digital Synthesis drivers;
• TTY drivers;
• USB Device Class drivers;
• USB Gadget drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Port Controller Manager driver;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• BTRFS file system;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• File systems infrastructure;
• JFFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• Overlay file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• Timer subsystem;
• VLANs driver;
• Bluetooth subsystem;
• LAPB network protocol;
• Network traffic control;
• Network sockets;
• TCP network protocol;
• Kernel init infrastructure;
• BPF subsystem;
• Kernel CPU control infrastructure;
• Perf events;
• Arbitrary resource management;
• Tracing infrastructure;
• Closures library;
• Memory management;
• 9P file system network protocol;
• Amateur Radio drivers;
• Ethernet bridge;
• CAN network layer;
• Networking core;
• DCCP (Datagram Congestion Control Protocol);
• IEEE802154.4 network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• IEEE 802.15.4 subsystem;
• Netfilter;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• SCTP…