{"id":"CVE-2015-4036","aliases":["BELL-CVE-2015-4036","DEBIAN-CVE-2015-4036","EUVD-2015-4064","GHSA-f533-g6c5-65cx","MGASA-2015-0236","MGASA-2015-0237","MGASA-2015-0238","SUSE-SU-2015:1324-1","UBUNTU-CVE-2015-4036","USN-2564-1","USN-2634-1","USN-2636-1"],"status":"published","title":"Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel...","description":"Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call.  NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.","severity":{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00589,"percentile":0.48431,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2015-04-09T10:32:39Z","modified":"2026-09-09T06:47:32Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["3.16.7-ckt9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["3.16.7-ckt9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["3.16.7-ckt9-1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kernel","fixed_in":["3.14.43-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kernel-userspace-headers","fixed_in":["3.14.43-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-vboxadditions","fixed_in":["4.3.28-2.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-virtualbox","fixed_in":["4.3.28-2.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-xtables-addons","fixed_in":["2.5-18.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-broadcom-wl","fixed_in":["6.30.223.141-53.mga4.nonfree"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-fglrx","fixed_in":["14.010.1006-23.mga4.nonfree"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-nvidia173","fixed_in":["173.14.39-38.mga4.nonfree"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-nvidia304","fixed_in":["304.125-8.mga4.nonfree"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-nvidia-current","fixed_in":["331.113-8.mga4.nonfree"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kernel-linus","fixed_in":["3.14.43-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kernel-tmb","fixed_in":["3.14.43-1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux","fixed_in":["3.13.0-54.91"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","fixed_in":["3.16.0-34.45~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","fixed_in":["3.19.0-20.20~14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.7-ckt9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.7-ckt9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.7-ckt9-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.43-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.43-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.28-2.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.28-2.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5-18.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-broadcom-wl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.30.223.141-53.mga4.nonfree"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-fglrx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.010.1006-23.mga4.nonfree"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia173","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"173.14.39-38.mga4.nonfree"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia304","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"304.125-8.mga4.nonfree"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"331.113-8.mga4.nonfree"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.43-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.43-1.mga4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12","package":"kgraft-patch-SLE12_Update_6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.3"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-54.91"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-34.45~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1","3.16.0-31.41~14.04.1","3.16.0-31.43~14.04.1","3.16.0-33.44~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-20.20~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-34.45~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1","3.16.0-31.41~14.04.1","3.16.0-31.43~14.04.1","3.16.0-33.44~14.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-54.91"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-20.20~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1"],"bundled":3}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-2634-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/74664","tags":["vdb-entry","x_refsource_BID","x_transferred","VDB Entry","URL Repurposed","advisory","web"]},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=59c816c1f24df0204e01851431d3bab3eb76719c","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/05/13/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","advisory","article","evidence","report"]},{"url":"https://github.com/torvalds/linux/commit/59c816c1f24df0204e01851431d3bab3eb76719c","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1189864","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"http://www.ubuntu.com/usn/USN-2633-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1033729","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","URL Repurposed","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-4036"},{"url":"https://github.com/advisories/GHSA-f533-g6c5-65cx"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2015-4036","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-4036","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0236.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16008","tags":["report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.42","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.43","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2015-0237.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16007","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2015-0238.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16009","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151324-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/854817","tags":["report"]},{"url":"https://bugzilla.suse.com/854824","tags":["report"]},{"url":"https://bugzilla.suse.com/858727","tags":["report"]},{"url":"https://bugzilla.suse.com/866911","tags":["report"]},{"url":"https://bugzilla.suse.com/867362","tags":["report"]},{"url":"https://bugzilla.suse.com/895814","tags":["report"]},{"url":"https://bugzilla.suse.com/903279","tags":["report"]},{"url":"https://bugzilla.suse.com/907092","tags":["report"]},{"url":"https://bugzilla.suse.com/908491","tags":["report"]},{"url":"https://bugzilla.suse.com/915183","tags":["report"]},{"url":"https://bugzilla.suse.com/917630","tags":["report"]},{"url":"https://bugzilla.suse.com/918618","tags":["report"]},{"url":"https://bugzilla.suse.com/921430","tags":["report"]},{"url":"https://bugzilla.suse.com/924071","tags":["report"]},{"url":"https://bugzilla.suse.com/924526","tags":["report"]},{"url":"https://bugzilla.suse.com/926369","tags":["report"]},{"url":"https://bugzilla.suse.com/926953","tags":["report"]},{"url":"https://bugzilla.suse.com/927455","tags":["report"]},{"url":"https://bugzilla.suse.com/927697","tags":["report"]},{"url":"https://bugzilla.suse.com/927786","tags":["report"]},{"url":"https://bugzilla.suse.com/928131","tags":["report"]},{"url":"https://bugzilla.suse.com/929475","tags":["report"]},{"url":"https://bugzilla.suse.com/929696","tags":["report"]},{"url":"https://bugzilla.suse.com/929879","tags":["report"]},{"url":"https://bugzilla.suse.com/929974","tags":["report"]},{"url":"https://bugzilla.suse.com/930092","tags":["report"]},{"url":"https://bugzilla.suse.com/930399","tags":["report"]},{"url":"https://bugzilla.suse.com/930579","tags":["report"]},{"url":"https://bugzilla.suse.com/930599","tags":["report"]},{"url":"https://bugzilla.suse.com/930972","tags":["report"]},{"url":"https://bugzilla.suse.com/931124","tags":["report"]},{"url":"https://bugzilla.suse.com/931403","tags":["report"]},{"url":"https://bugzilla.suse.com/931538","tags":["report"]},{"url":"https://bugzilla.suse.com/931620","tags":["report"]},{"url":"https://bugzilla.suse.com/931860","tags":["report"]},{"url":"https://bugzilla.suse.com/931988","tags":["report"]},{"url":"https://bugzilla.suse.com/932348","tags":["report"]},{"url":"https://bugzilla.suse.com/932793","tags":["report"]},{"url":"https://bugzilla.suse.com/932897","tags":["report"]},{"url":"https://bugzilla.suse.com/932898","tags":["report"]},{"url":"https://bugzilla.suse.com/932899","tags":["report"]},{"url":"https://bugzilla.suse.com/932900","tags":["report"]},{"url":"https://bugzilla.suse.com/932967","tags":["report"]},{"url":"https://bugzilla.suse.com/933117","tags":["report"]},{"url":"https://bugzilla.suse.com/933429","tags":["report"]},{"url":"https://bugzilla.suse.com/933637","tags":["report"]},{"url":"https://bugzilla.suse.com/933896","tags":["report"]},{"url":"https://bugzilla.suse.com/933904","tags":["report"]},{"url":"https://bugzilla.suse.com/933907","tags":["report"]},{"url":"https://bugzilla.suse.com/934160","tags":["report"]},{"url":"https://bugzilla.suse.com/935083","tags":["report"]},{"url":"https://bugzilla.suse.com/935085","tags":["report"]},{"url":"https://bugzilla.suse.com/935088","tags":["report"]},{"url":"https://bugzilla.suse.com/935174","tags":["report"]},{"url":"https://bugzilla.suse.com/935542","tags":["report"]},{"url":"https://bugzilla.suse.com/935881","tags":["report"]},{"url":"https://bugzilla.suse.com/935918","tags":["report"]},{"url":"https://bugzilla.suse.com/936012","tags":["report"]},{"url":"https://bugzilla.suse.com/936423","tags":["report"]},{"url":"https://bugzilla.suse.com/936445","tags":["report"]},{"url":"https://bugzilla.suse.com/936446","tags":["report"]},{"url":"https://bugzilla.suse.com/936502","tags":["report"]},{"url":"https://bugzilla.suse.com/936556","tags":["report"]},{"url":"https://bugzilla.suse.com/936831","tags":["report"]},{"url":"https://bugzilla.suse.com/936875","tags":["report"]},{"url":"https://bugzilla.suse.com/937032","tags":["report"]},{"url":"https://bugzilla.suse.com/937087","tags":["report"]},{"url":"https://bugzilla.suse.com/937609","tags":["report"]},{"url":"https://bugzilla.suse.com/937612","tags":["report"]},{"url":"https://bugzilla.suse.com/937613","tags":["report"]},{"url":"https://bugzilla.suse.com/937616","tags":["report"]},{"url":"https://bugzilla.suse.com/938022","tags":["report"]},{"url":"https://bugzilla.suse.com/938023","tags":["report"]},{"url":"https://bugzilla.suse.com/938024","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5366","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-4036","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2633-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2634-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2636-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2638-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2564-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2565-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-4036","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-2041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-2042","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3636","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-0275","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-4036","description":"Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call.  NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.","status":"published","published":"2015-08-31T20:00:00Z","modified":"2024-08-06T06:04:02.583Z","updated_at":"2026-11-02T14:35:43.322279Z"}],"euvd":[{"id":"EUVD-2015-4064","description":"Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call.  NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.","status":"published","published":"2015-08-31T20:00:00Z","modified":"2024-08-06T06:04:02Z","updated_at":"2026-11-03T02:22:05.665475Z"}],"ghsa":[{"id":"GHSA-f533-g6c5-65cx","title":"Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel...","description":"Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call.  NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.","status":"published","published":"2022-05-17T03:20:08Z","modified":"2023-01-27T05:06:46Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:42:59.235354Z"}],"nvd":[{"id":"CVE-2015-4036","description":"Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call.  NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.","status":"published","published":"2015-08-31T20:59:01.653Z","modified":"2026-06-17T00:26:40.187Z","cvss":[{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:08.998581Z"}],"osv":[{"id":"BELL-CVE-2015-4036","title":"CVE-2015-4036 does not affect BellSoft software","status":"withdrawn","published":"2015-08-31T20:59:00Z","modified":"2026-01-28T07:20:47.047964Z","cvss":[{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2015-4036","description":"Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call.  NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.","status":"published","published":"2015-08-31T20:59:01Z","modified":"2026-04-16T06:19:41.447563895Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-4036","description":"Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call.  NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.","status":"published","published":"2015-08-31T20:59:01.653Z","modified":"2026-09-09T06:47:32.073018447Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"MGASA-2015-0236","title":"Updated kernel packages fix security vulnerabilities and bugs","description":"Updated kernel fixes security, critical data corruption and pdata loss issues\n\nThis kernel update is based on upstream -longterm 3.14.43 and fixes a\nsecurity issue, and critical data corruption and data loss issues:\n\ndrivers/vhost/scsi.c: potential memory corruption (CVE-2015-4036)\n\next4 filesystem has a bug that make it possible to lose whole file system\nblock worth of data when we hit the specific interaction with unwritten\nand delayed extents in status extent tree.\n\nwhen using software raid 0 on SSDs along with trim/discard, any delete or\nmodification of files can lead to random destruction on the filesystem.\n(this regression was introduced in upstream 3.14.41)\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2015-05-23T18:53:02Z","modified":"2026-04-16T06:25:09.008823281Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"MGASA-2015-0237","title":"Updated kernel-linus packages fix security vulnerabilities and bugs","description":"Updated kernel-linus fixes security, critical data corruption and pdata loss issues\n\nThis kernel-linus update is based on upstream -longterm 3.14.43 and fixes\na security issue, and critical data corruption and data loss issues:\n\ndrivers/vhost/scsi.c: potential memory corruption (CVE-2015-4036)\n\next4 filesystem has a bug that make it possible to lose whole file system\nblock worth of data when we hit the specific interaction with unwritten\nand delayed extents in status extent tree.\n\nwhen using software raid 0 on SSDs along with trim/discard, any delete or\nmodification of files can lead to random destruction on the filesystem.\n(this regression was introduced in upstream 3.14.41)\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2015-05-27T16:57:52Z","modified":"2026-04-16T06:22:34.924066859Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"MGASA-2015-0238","title":"Updated kernel-tmb packages fix security vulnerabilities and bugs","description":"Updated kernel-tmb fixes security, critical data corruption and pdata loss issues\n\nThis kernel-tmb update is based on upstream -longterm 3.14.43 and fixes\na security issue, and critical data corruption and data loss issues:\n\ndrivers/vhost/scsi.c: potential memory corruption (CVE-2015-4036)\n\next4 filesystem has a bug that make it possible to lose whole file system\nblock worth of data when we hit the specific interaction with unwritten\nand delayed extents in status extent tree.\n\nwhen using software raid 0 on SSDs along with trim/discard, any delete or\nmodification of files can lead to random destruction on the filesystem.\n(this regression was introduced in upstream 3.14.41)\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2015-05-27T16:57:52Z","modified":"2026-04-16T06:23:02.354446648Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"SUSE-SU-2015:1324-1","title":"Security update for the SUSE Linux Enterprise 12 kernel","description":"The SUSE Linux Enterprise 12 kernel was updated to 3.12.44 to receive various security and bugfixes.\n\nThese features were added:\n- mpt2sas: Added Reply Descriptor Post Queue (RDPQ) Array support (bsc#854824).\n- mpt3sas: Bump mpt3sas driver version to 04.100.00.00 (bsc#854817).\n\nFollowing security bugs were fixed:\n- CVE-2015-1805: iov overrun for failed atomic copy could have lead to\n  DoS or privilege escalation (bsc#933429).\n- CVE-2015-3212: A race condition in the way the Linux kernel handled\n  lists of associations in SCTP sockets could have lead to list\n  corruption and kernel panics (bsc#936502).\n- CVE-2015-4036: DoS via memory corruption in vhost/scsi driver\n  (bsc#931988).\n- CVE-2015-4167: Linux kernel built with the UDF file\n  system(CONFIG_UDF_FS) support was vulnerable to a crash. It occurred\n  while fetching inode information from a corrupted/malicious udf file\n  system image (bsc#933907).\n- CVE-2015-4692: DoS via NULL pointer dereference in kvm_apic_has_events\n  function (bsc#935542).\n- CVE-2015-5364: Remote DoS via flood of UDP packets with invalid\n  checksums (bsc#936831).\n- CVE-2015-5366: Remote DoS of EPOLLET epoll applications via flood of\n  UDP packets with invalid checksums (bsc#936831).\n\nSecurity issues already fixed in the previous update but not referenced by CVE:\n- CVE-2014-9728: Kernel built with the UDF file system(CONFIG_UDF_FS)\n  support were vulnerable to a crash (bsc#933904).\n- CVE-2014-9729: Kernel built with the UDF file system(CONFIG_UDF_FS)\n  support were vulnerable to a crash (bsc#933904).\n- CVE-2014-9730: Kernel built with the UDF file system(CONFIG_UDF_FS)\n  support were vulnerable to a crash (bsc#933904).\n- CVE-2014-9731: Kernel built with the UDF file system(CONFIG_UDF_FS)\n  support were vulnerable to information leakage (bsc#933896).\n\nThe following non-security bugs were fixed:\n- ALSA: hda - add codec ID for Skylake display audio codec (bsc#936556).\n- ALSA: hda/hdmi - apply Haswell fix-ups to Skylake display codec\n  (bsc#936556).\n- ALSA: hda_controller: Separate stream_tag for input and output streams\n  (bsc#936556).\n- ALSA: hda_intel: add AZX_DCAPS_I915_POWERWELL for SKL and BSW\n  (bsc#936556).\n- ALSA: hda_intel: apply the Seperate stream_tag for Skylake\n  (bsc#936556).\n- ALSA: hda_intel: apply the Seperate stream_tag for Sunrise Point\n  (bsc#936556).\n- Btrfs: Handle unaligned length in extent_same (bsc#937609).\n- Btrfs: add missing inode item update in fallocate() (bsc#938023).\n- Btrfs: check pending chunks when shrinking fs to avoid corruption\n  (bsc#936445).\n- Btrfs: do not update mtime/ctime on deduped inodes (bsc#937616).\n- Btrfs: fix block group -\u003espace_info null pointer dereference\n  (bsc#935088).\n- Btrfs: fix clone / extent-same deadlocks (bsc#937612).\n- Btrfs: fix deadlock with extent-same and readpage (bsc#937612).\n- Btrfs: fix fsync data loss after append write (bsc#936446).\n- Btrfs: fix hang during inode eviction due to concurrent readahead\n  (bsc#935085).\n- Btrfs: fix memory leak in the extent_same ioctl (bsc#937613).\n- Btrfs: fix race when reusing stale extent buffers that leads to BUG_ON\n  (bsc#926369).\n- Btrfs: fix use after free when close_ctree frees the orphan_rsv\n  (bsc#938022).\n- Btrfs: pass unaligned length to btrfs_cmp_data() (bsc#937609).\n- Btrfs: provide super_operations-\u003einode_get_dev (bsc#927455).\n- Drivers: hv: balloon: check if ha_region_mutex was acquired in\n  MEM_CANCEL_ONLINE case.\n- Drivers: hv: fcopy: process deferred messages when we complete the\n  transaction.\n- Drivers: hv: fcopy: rename fcopy_work -\u003e fcopy_timeout_work.\n- Drivers: hv: fcopy: set .owner reference for file operations.\n- Drivers: hv: fcopy: switch to using the hvutil_device_state state\n  machine.\n- Drivers: hv: hv_balloon: correctly handle num_pages\u003eINT_MAX case.\n- Drivers: hv: hv_balloon: correctly handle val.freeram lower than num_pages case.\n- Drivers: hv: hv_balloon: do not lose memory when onlining order is not\n  natural.\n- Drivers: hv: hv_balloon: do not online pages in offline blocks.\n- Drivers: hv: hv_balloon: eliminate jumps in piecewiese linear floor\n  function.\n- Drivers: hv: hv_balloon: eliminate the trylock path in\n  acquire/release_region_mutex.\n- Drivers: hv: hv_balloon: keep locks balanced on add_memory() failure.\n- Drivers: hv: hv_balloon: refuse to balloon below the floor.\n- Drivers: hv: hv_balloon: report offline pages as being used.\n- Drivers: hv: hv_balloon: survive ballooning request with num_pages=0.\n- Drivers: hv: kvp: move poll_channel() to hyperv_vmbus.h.\n- Drivers: hv: kvp: rename kvp_work -\u003e kvp_timeout_work.\n- Drivers: hv: kvp: reset kvp_context.\n- Drivers: hv: kvp: switch to using the hvutil_device_state state\n  machine.\n- Drivers: hv: util: Fix a bug in the KVP code. reapply upstream change\n  ontop of v3.12-stable change\n- Drivers: hv: util: On device remove, close the channel after\n  de-initializing the service.\n- Drivers: hv: util: introduce hv_utils_transport abstraction.\n- Drivers: hv: util: introduce state machine for util drivers.\n- Drivers: hv: util: move kvp/vss function declarations to\n  hyperv_vmbus.h.\n- Drivers: hv: vmbus: Add device and vendor ID to vmbus devices.\n- Drivers: hv: vmbus: Add support for VMBus panic notifier handler\n  (bsc#934160).\n- Drivers: hv: vmbus: Add support for the NetworkDirect GUID.\n- Drivers: hv: vmbus: Correcting truncation error for constant\n  HV_CRASH_CTL_CRASH_NOTIFY (bsc#934160).\n- Drivers: hv: vmbus: Export the vmbus_sendpacket_pagebuffer_ctl().\n- Drivers: hv: vmbus: Fix a bug in rescind processing in\n  vmbus_close_internal().\n- Drivers: hv: vmbus: Fix a siganlling host signalling issue.\n- Drivers: hv: vmbus: Get rid of some unnecessary messages.\n- Drivers: hv: vmbus: Get rid of some unused definitions.\n- Drivers: hv: vmbus: Handle both rescind and offer messages in the same\n  context.\n- Drivers: hv: vmbus: Implement the protocol for tearing down vmbus\n  state.\n- Drivers: hv: vmbus: Introduce a function to remove a rescinded offer.\n- Drivers: hv: vmbus: Perform device register in the per-channel work\n  element.\n- Drivers: hv: vmbus: Permit sending of packets without payload.\n- Drivers: hv: vmbus: Properly handle child device remove.\n- Drivers: hv: vmbus: Remove the channel from the channel list(s) on\n  failure.\n- Drivers: hv: vmbus: Suport an API to send packet with additional\n  control.\n- Drivers: hv: vmbus: Suport an API to send pagebuffers with additional\n  control.\n- Drivers: hv: vmbus: Teardown clockevent devices on module unload.\n- Drivers: hv: vmbus: Teardown synthetic interrupt controllers on module\n  unload.\n- Drivers: hv: vmbus: Use a round-robin algorithm for picking the\n  outgoing channel.\n- Drivers: hv: vmbus: Use the vp_index map even for channels bound to CPU\n  0.\n- Drivers: hv: vmbus: avoid double kfree for device_obj.\n- Drivers: hv: vmbus: briefly comment num_sc and next_oc.\n- Drivers: hv: vmbus: decrease num_sc on subchannel removal.\n- Drivers: hv: vmbus: distribute subchannels among all vcpus.\n- Drivers: hv: vmbus: do cleanup on all vmbus_open() failure paths.\n- Drivers: hv: vmbus: introduce vmbus_acpi_remove.\n- Drivers: hv: vmbus: kill tasklets on module unload.\n- Drivers: hv: vmbus: move init_vp_index() call to vmbus_process_offer().\n- Drivers: hv: vmbus: prevent cpu offlining on newer hypervisors.\n- Drivers: hv: vmbus: rename channel work queues.\n- Drivers: hv: vmbus: teardown hv_vmbus_con workqueue and\n  vmbus_connection pages on shutdown.\n- Drivers: hv: vmbus: unify calls to percpu_channel_enq().\n- Drivers: hv: vmbus: unregister panic notifier on module unload.\n- Drivers: hv: vmbus:Update preferred vmbus protocol version to windows\n  10.\n- Drivers: hv: vss: process deferred messages when we complete the\n  transaction.\n- Drivers: hv: vss: switch to using the hvutil_device_state state\n  machine.\n- Enable CONFIG_BRIDGE_NF_EBTABLES on s390x (bsc#936012)\n- Fix connection reuse when sk_error_report is used (bsc#930972).\n- GHES: Carve out error queueing in a separate function (bsc#917630).\n- GHES: Carve out the panic functionality (bsc#917630).\n- GHES: Elliminate double-loop in the NMI handler (bsc#917630).\n- GHES: Make NMI handler have a single reader (bsc#917630).\n- GHES: Panic right after detection (bsc#917630).\n- IB/mlx4: Fix wrong usage of IPv4 protocol for multicast attach/detach\n  (bsc#918618).\n- Initialize hv_netvsc_packet-\u003exmit_more to avoid transfer stalls\n- KVM: PPC: BOOK3S: HV: CMA: Reserve cma region only in hypervisor mode\n  (bsc#908491).\n- KVM: s390: virtio-ccw: Handle command rejects (bsc#931860).\n- MODSIGN: loading keys from db when SecureBoot disabled (bsc#929696).\n- MODSIGN: loading keys from db when SecureBoot disabled (bsc#929696).\n- PCI: pciehp: Add hotplug_lock to serialize hotplug events (bsc#866911).\n- Revert 'MODSIGN: loading keys from db when SecureBoot disabled'. This\n  reverts commit b45412d4, because it breaks legacy boot.\n- SUNRPC: Report connection error values to rpc_tasks on the pending\n  queue (bsc#930972).\n- Update s390x kabi files with netfilter change (bsc#936012)\n- client MUST ignore EncryptionKeyLength if CAP_EXTENDED_SECURITY is set\n  (bsc#932348).\n- cpufreq: pcc: Enable autoload of pcc-cpufreq for ACPI processors\n  (bsc#933117).\n- dmapi: fix value from newer Linux strnlen_user() (bsc#932897).\n- drm/i915/hsw: Fix workaround for server AUX channel clock divisor\n  (bsc#935918).\n- drm/i915: Evict CS TLBs between batches (bsc#935918).\n- drm/i915: Fix DDC probe for passive adapters (bsc#935918).\n- drm/i915: Handle failure to kick out a conflicting fb driver\n  (bsc#935918).\n- drm/i915: drop WaSetupGtModeTdRowDispatch:snb (bsc#935918).\n- drm/i915: save/restore GMBUS freq across suspend/resume on gen4\n  (bsc#935918).\n- edd: support original Phoenix EDD 3.0 information (bsc#929974).\n- ext4: fix over-defensive complaint after journal abort (bsc#935174).\n- fs/cifs: Fix corrupt SMB2 ioctl requests (bsc#931124).\n- ftrace: add oco handling patch (bsc#924526).\n- ftrace: allow architectures to specify ftrace compile options\n  (bsc#924526).\n- ftrace: let notrace function attribute disable hotpatching if necessary\n  (bsc#924526).\n- hugetlb, kabi: do not account hugetlb pages as NR_FILE_PAGES\n  (bsc#930092).\n- hugetlb: do not account hugetlb pages as NR_FILE_PAGES (bsc#930092).\n- hv: channel: match var type to return type of wait_for_completion.\n- hv: do not schedule new works in\n  vmbus_onoffer()/vmbus_onoffer_rescind().\n- hv: hv_balloon: match var type to return type of wait_for_completion.\n- hv: hv_util: move vmbus_open() to a later place.\n- hv: hypervvssd: call endmntent before call setmntent again.\n- hv: no rmmod for hv_vmbus and hv_utils.\n- hv: remove the per-channel workqueue.\n- hv: run non-blocking message handlers in the dispatch tasklet.\n- hv: vmbus: missing curly braces in vmbus_process_offer().\n- hv: vmbus_free_channels(): remove the redundant free_channel().\n- hv: vmbus_open(): reset the channel state on ENOMEM.\n- hv: vmbus_post_msg: retry the hypercall on some transient errors.\n- hv_netvsc: Allocate the receive buffer from the correct NUMA node.\n- hv_netvsc: Allocate the sendbuf in a NUMA aware way.\n- hv_netvsc: Clean up two unused variables.\n- hv_netvsc: Cleanup the test for freeing skb when we use sendbuf\n  mechanism.\n- hv_netvsc: Define a macro RNDIS_AND_PPI_SIZE.\n- hv_netvsc: Eliminate memory allocation in the packet send path.\n- hv_netvsc: Fix a bug in netvsc_start_xmit().\n- hv_netvsc: Fix the packet free when it is in skb headroom.\n- hv_netvsc: Implement batching in send buffer.\n- hv_netvsc: Implement partial copy into send buffer.\n- hv_netvsc: Use the xmit_more skb flag to optimize signaling the host.\n- hv_netvsc: change member name of struct netvsc_stats.\n- hv_netvsc: introduce netif-msg into netvsc module.\n- hv_netvsc: remove unused variable in netvsc_send().\n- hv_netvsc: remove vmbus_are_subchannels_present() in\n  rndis_filter_device_add().\n- hv_netvsc: try linearizing big SKBs before dropping them.\n- hv_netvsc: use per_cpu stats to calculate TX/RX data.\n- hv_netvsc: use single existing drop path in netvsc_start_xmit.\n- hv_vmbus: Add gradually increased delay for retries in\n  vmbus_post_msg().\n- hyperv: Implement netvsc_get_channels() ethool op.\n- hyperv: hyperv_fb: match wait_for_completion_timeout return type.\n- iommu/amd: Handle integer overflow in dma_ops_area_alloc (bsc#931538).\n- iommu/amd: Handle large pages correctly in free_pagetable (bsc#935881).\n- ipr: Increase default adapter init stage change timeout (bsc#930579).\n- ipv6: do not delete previously existing ECMP routes if add fails\n  (bsc#930399).\n- ipv6: fix ECMP route replacement (bsc#930399).\n- jbd2: improve error messages for inconsistent journal heads\n  (bsc#935174).\n- jbd2: revise KERN_EMERG error messages (bsc#935174).\n- kabi/severities: Add s390 symbols allowed to change in bsc#931860\n- kabi: only use sops-\u003eget_inode_dev with proper fsflag.\n- kernel: add panic_on_warn.\n- kexec: allocate the kexec control page with KEXEC_CONTROL_MEMORY_GFP\n  (bsc#928131).\n- kgr: fix redirection on s390x arch (bsc#903279).\n- kgr: move kgr_task_in_progress() to sched.h.\n- kgr: send a fake signal to all blocking tasks.\n- kvm: irqchip: Break up high order allocations of kvm_irq_routing_table\n  (bsc#926953).\n- libata: Blacklist queued TRIM on all Samsung 800-series (bsc#930599).\n- mei: bus: () can be static.\n- mm, thp: really limit transparent hugepage allocation to local node (VM\n  Performance, bsc#931620).\n- mm, thp: respect MPOL_PREFERRED policy with non-local node (VM\n  Performance, bsc#931620).\n- mm/mempolicy.c: merge alloc_hugepage_vma to alloc_pages_vma (VM\n  Performance, bsc#931620).\n- mm/thp: allocate transparent hugepages on local node (VM Performance,\n  bsc#931620).\n- net/mlx4_en: Call register_netdevice in the proper location\n  (bsc#858727).\n- net/mlx4_en: Do not attempt to TX offload the outer UDP checksum for\n  VXLAN (bsc#858727).\n- net: fib6: fib6_commit_metrics: fix potential NULL pointer dereference\n  (bsc#867362).\n- net: introduce netdev_alloc_pcpu_stats() for drivers.\n- net: ipv6: fib: do not sleep inside atomic lock (bsc#867362).\n- netdev: set __percpu attribute on netdev_alloc_pcpu_stats.\n- netdev_alloc_pcpu_stats: use less common iterator variable.\n- netfilter: xt_NFQUEUE: fix --queue-bypass regression (bsc#935083)\n- ovl: default permissions (bsc#924071).\n- ovl: move s_stack_depth .\n- powerpc/perf/hv-24x7: use kmem_cache instead of aligned stack\n  allocations (bsc#931403).\n- powerpc/pseries: Correct cpu affinity for dlpar added cpus (bsc#932967).\n- powerpc: Add VM_FAULT_HWPOISON handling to powerpc page fault handler\n  (bsc#929475).\n- powerpc: Fill in si_addr_lsb siginfo field (bsc#929475).\n- powerpc: Simplify do_sigbus (bsc#929475).\n- reiserfs: Fix use after free in journal teardown (bsc#927697).\n- rtlwifi: rtl8192cu: Fix kernel deadlock (bsc#927786).\n- s390/airq: add support for irq ranges (bsc#931860).\n- s390/airq: silence lockdep warning (bsc#931860).\n- s390/compat,signal: change return values to -EFAULT (bsc#929879).\n- s390/ftrace: hotpatch support for function tracing (bsc#924526).\n- s390/irq: improve displayed interrupt order in /proc/interrupts\n  (bsc#931860).\n- s390/kernel: use stnsm 255 instead of stosm 0 (bsc#929879).\n- s390/kgr: reorganize kgr infrastructure in entry64.S.\n- s390/mm: align 64-bit PIE binaries to 4GB (bsc#929879).\n- s390/mm: limit STACK_RND_MASK for compat tasks (bsc#929879).\n- s390/rwlock: add missing local_irq_restore calls (bsc#929879).\n- s390/sclp_vt220: Fix kernel panic due to early terminal input\n  (bsc#931860).\n- s390/smp: only send external call ipi if needed (bsc#929879).\n- s390/spinlock,rwlock: always to a load-and-test first (bsc#929879).\n- s390/spinlock: cleanup spinlock code (bsc#929879).\n- s390/spinlock: optimize spin_unlock code (bsc#929879).\n- s390/spinlock: optimize spinlock code sequence (bsc#929879).\n- s390/spinlock: refactor arch_spin_lock_wait[_flags] (bsc#929879).\n- s390/time: use stck clock fast for do_account_vtime (bsc#929879).\n- s390: Remove zfcpdump NR_CPUS dependency (bsc#929879).\n- s390: add z13 code generation support (bsc#929879).\n- s390: avoid z13 cache aliasing (bsc#929879).\n- s390: fix control register update (bsc#929879).\n- s390: optimize control register update (bsc#929879).\n- s390: z13 base performance (bsc#929879).\n- sched: fix __sched_setscheduler() vs load balancing race (bsc#921430)\n- scsi: retry MODE SENSE on unit attention (bsc#895814).\n- scsi_dh_alua: Recheck state on unit attention (bsc#895814).\n- scsi_dh_alua: fixup crash in alua_rtpg_work() (bsc#895814).\n- scsi_dh_alua: parse device id instead of target id (bsc#895814).\n- scsi_dh_alua: recheck RTPG in regular intervals (bsc#895814).\n- scsi_dh_alua: update all port states (bsc#895814).\n- sd: always retry READ CAPACITY for ALUA state transition (bsc#895814).\n- st: null pointer dereference panic caused by use after kref_put by\n  st_open (bsc#936875).\n- supported.conf: add btrfs to kernel-$flavor-base (bsc#933637)\n- udf: Remove repeated loads blocksize (bsc#933907).\n- usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub\n  port reset (bsc#938024).\n- vTPM: set virtual device before passing to ibmvtpm_reset_crq\n  (bsc#937087).\n- vfs: add super_operations-\u003eget_inode_dev (bsc#927455).\n- virtio-ccw: virtio-ccw adapter interrupt support (bsc#931860).\n- virtio-rng: do not crash if virtqueue is broken (bsc#931860).\n- virtio: fail adding buffer on broken queues (bsc#931860).\n- virtio: virtio_break_device() to mark all virtqueues broken\n  (bsc#931860).\n- virtio_blk: verify if queue is broken after virtqueue_get_buf()\n  (bsc#931860).\n- virtio_ccw: fix hang in set offline processing (bsc#931860).\n- virtio_ccw: fix vcdev pointer handling issues (bsc#931860).\n- virtio_ccw: introduce device_lost in virtio_ccw_device (bsc#931860).\n- virtio_net: do not crash if virtqueue is broken (bsc#931860).\n- virtio_net: verify if queue is broken after virtqueue_get_buf()\n  (bsc#931860).\n- virtio_ring: adapt to notify() returning bool (bsc#931860).\n- virtio_ring: add new function virtqueue_is_broken() (bsc#931860).\n- virtio_ring: change host notification API (bsc#931860).\n- virtio_ring: let virtqueue_{kick()/notify()} return a bool\n  (bsc#931860).\n- virtio_ring: plug kmemleak false positive (bsc#931860).\n- virtio_scsi: do not call virtqueue_add_sgs(... GFP_NOIO) holding\n  spinlock (bsc#931860).\n- virtio_scsi: verify if queue is broken after virtqueue_get_buf()\n  (bsc#931860).\n- vmxnet3: Bump up driver version number (bsc#936423).\n- vmxnet3: Changes for vmxnet3 adapter version 2 (fwd) (bug#936423).\n- vmxnet3: Fix memory leaks in rx path (fwd) (bug#936423).\n- vmxnet3: Register shutdown handler for device (fwd) (bug#936423).\n- x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A\n  (bsc#907092).\n- x86/PCI: Use host bridge _CRS info on systems with \u003e32 bit addressing\n  (bsc#907092).\n- x86/kgr: move kgr infrastructure from asm to C.\n- x86/mm: Improve AMD Bulldozer ASLR workaround (bsc#937032).\n- xfrm: release dst_orig in case of error in xfrm_lookup() (bsc#932793).\n- xfs: Skip dirty pages in -\u003ereleasepage (bsc#915183).\n- xfs: fix xfs_setattr for DMAPI (bsc#932900).\n- xfs_dmapi: fix transaction ilocks (bsc#932899).\n- xfs_dmapi: fix value from newer Linux strnlen_user() (bsc#932897).\n- xfs_dmapi: xfs_dm_rdwr() uses dir file ops not file's ops (bsc#932898).\n","status":"published","published":"2015-07-16T14:57:20Z","modified":"2026-02-04T03:21:11.873218Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2015-4036","description":"Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call. NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.","status":"published","published":"2015-05-21T00:00:00Z","modified":"2026-04-22T10:09:58.472245Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2564-1","title":"linux-lts-utopic vulnerabilities","description":"\nAn integer overflow was discovered in the stack randomization feature of\nthe Linux kernel on 64 bit platforms. A local attacker could exploit this\nflaw to bypass the Address Space Layout Randomization (ASLR) protection\nmechanism. (CVE-2015-1593)\n\nAn information leak was discovered in the Linux Kernel's handling of\nuserspace configuration of the link layer control (LLC). A local user could\nexploit this flaw to read data from other sysctl settings. (CVE-2015-2041)\n\nAn information leak was discovered in how the Linux kernel handles setting\nthe Reliable Datagram Sockets (RDS) settings. A local user could exploit\nthis flaw to read data from other sysctl settings. (CVE-2015-2042)\n\nA memory corruption flaw was discovered in the Linux kernel's scsi\nsubsystem. A local attacker could potentially exploit this flaw to cause a\ndenial of service (system crash). (CVE-2015-4036)\n","status":"published","published":"2015-04-09T10:32:39Z","modified":"2026-02-10T04:40:53Z","updated_at":"2026-11-02T16:58:09.227524Z"},{"id":"USN-2634-1","title":"linux vulnerabilities","description":"Wen Xu discovered a use-after-free flaw in the Linux kernel's ipv4 ping\nsupport. A local user could exploit this flaw to cause a denial of service\n(system crash) or gain administrative privileges on the system.\n(CVE-2015-3636)\n\nA memory corruption flaw was discovered in the Linux kernel's scsi\nsubsystem. A local attacker could potentially exploit this flaw to cause a\ndenial of service (system crash). (CVE-2015-4036)\n","status":"published","published":"2015-06-10T21:47:12Z","modified":"2026-04-22T09:13:40.512511Z","updated_at":"2026-11-02T16:58:09.227524Z"},{"id":"USN-2636-1","title":"linux-lts-vivid vulnerabilities","description":"Xiong Zhou discovered a bug in the way the EXT4 filesystem handles\nfallocate zero range functionality when the page size is greater than the\nblock size. A local attacker could exploit this flaw to cause a denial of\nservice (system crash). (CVE-2015-0275)\n\nWen Xu discovered a use-after-free flaw in the Linux kernel's ipv4 ping\nsupport. A local user could exploit this flaw to cause a denial of service\n(system crash) or gain administrative privileges on the system.\n(CVE-2015-3636)\n\nA memory corruption flaw was discovered in the Linux kernel's scsi\nsubsystem. A local attacker could potentially exploit this flaw to cause a\ndenial of service (system crash). (CVE-2015-4036)\n","status":"published","published":"2015-06-10T21:51:41Z","modified":"2026-02-10T04:40:54Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}