{"id":"CVE-2019-15126","aliases":["EUVD-2019-6194","GHSA-p2g8-8j8x-3728","MGASA-2021-0103","MGASA-2021-0104","SUSE-SU-2021:4003-1","SUSE-SU-2021:4200-1","SUSE-SU-2021:4201-1","SUSE-SU-2022:0068-1","SUSE-SU-2022:0080-1","SUSE-SU-2022:0090-1","SUSE-SU-2022:0366-1","SUSE-SU-2022:0367-1","SUSE-SU-2022:0371-1","openSUSE-SU-2021:1648-1","openSUSE-SU-2022:0366-1"],"status":"published","title":"An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted...","description":"An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.07314,"percentile":0.94456,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-367"],"published":"2020-02-05T16:17:37Z","modified":"2026-06-17T02:19:44Z","exploits":[{"source":"pocgithub","id":"0x13enny/kr00k","title":"0x13enny/kr00k","date":"2020-03-09","url":"https://github.com/0x13enny/kr00k"},{"source":"pocgithub","id":"hexway/r00kie-kr00kie","title":"hexway/r00kie-kr00kie","date":"2020-03-13","url":"https://github.com/hexway/r00kie-kr00kie"},{"source":"exploitdb","id":"EDB-48233","title":"Broadcom Wi-Fi Devices - 'KR00K Information Disclosure","type":"remote","platform":"multiple","date":"2020-03-18","url":"https://www.exploit-db.com/exploits/48233"},{"source":"pocgithub","id":"akabe1/kr00ker","title":"akabe1/kr00ker","date":"2020-03-18","url":"https://github.com/akabe1/kr00ker"}],"fixes":[{"ecosystem":"Mageia:7","package":"kernel-firmware-nonfree","fixed_in":["20210223-1.mga7.nonfree"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"radeon-firmware","fixed_in":["20210211-1.mga7.nonfree"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"kernel-firmware-nonfree","fixed_in":["20210223-1.mga8.nonfree"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"bcm43xx-firmware","fixed_in":["20180314-4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"bcm43xx-firmware","fixed_in":["20180314-4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"bcm43xx-firmware","fixed_in":["20180314-4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-firmware","fixed_in":["20190618-5.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-firmware","fixed_in":["20190618-5.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"kernel-firmware","fixed_in":["20200107-3.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"kernel-firmware","fixed_in":["20200107-3.23.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"kernel-firmware","fixed_in":["20200107-lp152.2.9.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:7","package":"kernel-firmware-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210223-1.mga7.nonfree"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"radeon-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210211-1.mga7.nonfree"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"kernel-firmware-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210223-1.mga8.nonfree"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"bcm43xx-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180314-4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"bcm43xx-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180314-4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"bcm43xx-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180314-4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190618-5.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190618-5.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-3.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-3.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.106.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.106.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12 SP5","package":"kgraft-patch-SLE12-SP5_Update_27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-8.3.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.106.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.106.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.106.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.106.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.106.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.106.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.106.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.106.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.106.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.85.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.85.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.85.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.85.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.85.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.85.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 12 SP5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-10.73.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 12 SP5","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-10.73.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 12 SP5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-10.73.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 12 SP5","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-10.73.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP1","package":"kernel-livepatch-SLE15-SP1_Update_28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-3.3.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15","package":"kernel-livepatch-SLE15_Update_27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-1.5.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"kernel-vanilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"kernel-vanilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"kernel-vanilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"kernel-vanilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-150.83.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-95.88.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-95.88.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-95.88.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-95.88.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-95.88.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-95.88.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-95.88.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-95.88.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12 SP4","package":"kgraft-patch-SLE12-SP4_Update_24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-6.5.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-95.88.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-95.88.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-95.88.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-95.88.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-95.88.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-95.88.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-lp152.2.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"kernel-vanilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-197.105.1"}]}],"bundled":27}],"products":[{"vendor":"apple","product":"ipados"},{"vendor":"apple","product":"iphone_os"},{"vendor":"apple","product":"mac_os_x"},{"vendor":"broadcom","product":"bcm43012_firmware"},{"vendor":"broadcom","product":"bcm43013_firmware"},{"vendor":"broadcom","product":"bcm4356_firmware"},{"vendor":"broadcom","product":"bcm43752_firmware"},{"vendor":"broadcom","product":"bcm4375_firmware"},{"vendor":"broadcom","product":"bcm4389_firmware"}],"references":[{"url":"https://support.apple.com/kb/HT210721","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"https://support.apple.com/kb/HT210722","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"https://support.apple.com/kb/HT210788","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-wi-fi-info-disclosure","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0001","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.huawei.com/en/psirt/security-notices/huawei-sn-20200228-01-kr00k-en","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.mist.com/documentation/mist-security-advisory-kr00k-attack-faq/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-003.txt","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.synology.com/security/advisory/Synology_SA_20_03","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://packetstormsecurity.com/files/156809/Broadcom-Wi-Fi-KR00K-Proof-Of-Concept.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-wifi-en","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-712518.pdf","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://us-cert.cisa.gov/ics/advisories/icsa-20-224-05","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15126"},{"url":"https://github.com/advisories/GHSA-p2g8-8j8x-3728"},{"url":"https://advisories.mageia.org/MGASA-2021-0103.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28475","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2021-0104.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28500","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20214003-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1167162","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15126","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20214200-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20214201-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220068-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1114648","tags":["report"]},{"url":"https://bugzilla.suse.com/1124431","tags":["report"]},{"url":"https://bugzilla.suse.com/1169514","tags":["report"]},{"url":"https://bugzilla.suse.com/1172073","tags":["report"]},{"url":"https://bugzilla.suse.com/1179599","tags":["report"]},{"url":"https://bugzilla.suse.com/1183678","tags":["report"]},{"url":"https://bugzilla.suse.com/1183897","tags":["report"]},{"url":"https://bugzilla.suse.com/1184804","tags":["report"]},{"url":"https://bugzilla.suse.com/1185727","tags":["report"]},{"url":"https://bugzilla.suse.com/1185762","tags":["report"]},{"url":"https://bugzilla.suse.com/1187167","tags":["report"]},{"url":"https://bugzilla.suse.com/1189126","tags":["report"]},{"url":"https://bugzilla.suse.com/1189158","tags":["report"]},{"url":"https://bugzilla.suse.com/1189305","tags":["report"]},{"url":"https://bugzilla.suse.com/1189841","tags":["report"]},{"url":"https://bugzilla.suse.com/1190317","tags":["report"]},{"url":"https://bugzilla.suse.com/1190358","tags":["report"]},{"url":"https://bugzilla.suse.com/1190428","tags":["report"]},{"url":"https://bugzilla.suse.com/1191229","tags":["report"]},{"url":"https://bugzilla.suse.com/1191384","tags":["report"]},{"url":"https://bugzilla.suse.com/1191731","tags":["report"]},{"url":"https://bugzilla.suse.com/1191876","tags":["report"]},{"url":"https://bugzilla.suse.com/1192032","tags":["report"]},{"url":"https://bugzilla.suse.com/1192145","tags":["report"]},{"url":"https://bugzilla.suse.com/1192267","tags":["report"]},{"url":"https://bugzilla.suse.com/1192740","tags":["report"]},{"url":"https://bugzilla.suse.com/1192845","tags":["report"]},{"url":"https://bugzilla.suse.com/1192847","tags":["report"]},{"url":"https://bugzilla.suse.com/1192866","tags":["report"]},{"url":"https://bugzilla.suse.com/1192877","tags":["report"]},{"url":"https://bugzilla.suse.com/1192946","tags":["report"]},{"url":"https://bugzilla.suse.com/1192974","tags":["report"]},{"url":"https://bugzilla.suse.com/1193231","tags":["report"]},{"url":"https://bugzilla.suse.com/1193306","tags":["report"]},{"url":"https://bugzilla.suse.com/1193318","tags":["report"]},{"url":"https://bugzilla.suse.com/1193440","tags":["report"]},{"url":"https://bugzilla.suse.com/1193442","tags":["report"]},{"url":"https://bugzilla.suse.com/1193575","tags":["report"]},{"url":"https://bugzilla.suse.com/1193731","tags":["report"]},{"url":"https://bugzilla.suse.com/1194087","tags":["report"]},{"url":"https://bugzilla.suse.com/1194094","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-25020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-0920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-0935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45486","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220080-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1192987","tags":["report"]},{"url":"https://bugzilla.suse.com/1193669","tags":["report"]},{"url":"https://bugzilla.suse.com/1193727","tags":["report"]},{"url":"https://bugzilla.suse.com/1194001","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4149","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220090-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220366-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1071995","tags":["report"]},{"url":"https://bugzilla.suse.com/1185377","tags":["report"]},{"url":"https://bugzilla.suse.com/1186207","tags":["report"]},{"url":"https://bugzilla.suse.com/1186222","tags":["report"]},{"url":"https://bugzilla.suse.com/1191241","tags":["report"]},{"url":"https://bugzilla.suse.com/1193767","tags":["report"]},{"url":"https://bugzilla.suse.com/1193861","tags":["report"]},{"url":"https://bugzilla.suse.com/1193864","tags":["report"]},{"url":"https://bugzilla.suse.com/1193867","tags":["report"]},{"url":"https://bugzilla.suse.com/1193927","tags":["report"]},{"url":"https://bugzilla.suse.com/1194048","tags":["report"]},{"url":"https://bugzilla.suse.com/1194227","tags":["report"]},{"url":"https://bugzilla.suse.com/1194302","tags":["report"]},{"url":"https://bugzilla.suse.com/1194516","tags":["report"]},{"url":"https://bugzilla.suse.com/1194529","tags":["report"]},{"url":"https://bugzilla.suse.com/1194880","tags":["report"]},{"url":"https://bugzilla.suse.com/1194888","tags":["report"]},{"url":"https://bugzilla.suse.com/1194985","tags":["report"]},{"url":"https://bugzilla.suse.com/1195166","tags":["report"]},{"url":"https://bugzilla.suse.com/1195254","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0330","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220367-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1193506","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0435","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220371-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1177101","tags":["report"]},{"url":"https://bugzilla.suse.com/1193507","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KZGJOQCY3UVCSZY3XFCDUYHPVWB2IH7T/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CFUCZRWH2IP7FOHVYO3TO3G5PFWQXLP6/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-15126","description":"An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.","status":"published","published":"2020-02-05T16:17:37Z","modified":"2024-08-05T00:34:53.246Z","updated_at":"2026-11-02T14:20:21.059499Z"}],"euvd":[{"id":"EUVD-2019-6194","description":"An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.","status":"published","published":"2020-02-05T16:17:37Z","modified":"2024-08-05T00:34:53Z","updated_at":"2026-11-03T02:40:37.184704Z"}],"ghsa":[{"id":"GHSA-p2g8-8j8x-3728","title":"An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted...","description":"An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.","status":"published","published":"2022-05-24T17:08:02Z","modified":"2023-01-29T05:01:27Z","updated_at":"2026-11-02T14:44:49.414884Z"}],"nvd":[{"id":"CVE-2019-15126","description":"An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.","status":"published","published":"2020-02-05T17:15:10.443Z","modified":"2026-06-17T02:19:44.97Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":2.9,"vector":"AV:A/AC:M/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:05:43.875329Z"}],"osv":[{"id":"MGASA-2021-0103","title":"Updated nonfree firmware packages fix security vulnerability","description":"Updated nonfree firmwares fixees various issues, adds new / improved\nhardware support and fixes at least the following security issue:\n\nAn issue was discovered on Broadcom Wi-Fi client devices. Specifically\ntimed and handcrafted traffic can cause internal errors (related to\nstate transitions) in a WLAN device that lead to improper layer 2\nWi-Fi encryption with a consequent possibility of information\ndisclosure over the air for a discrete set of traffic (CVE-2019-15126).\n\nFull list of updates:\n* kernel-firmware-nonfree:\n  - add firmware for Lontium LT9611UXC DSI to HDMI bridge\n  - brcm: Add NVRAM for Vamrs 96boards Rock960\n  - brcm: make AP6212 in bananpi m2 plus/zero work\n  - brcm: Link RPi4's WiFi firmware with DMI machine name\n  - brcm: Update Raspberry Pi 3B+/4B NVRAM for downstream changes\n  - brcm: remove old brcm firmwares that have newer cypress variants\n    (CVE-2019-15126)\n  - cypress: Link the new cypress firmware to the old brcm files\n    (CVE-2019-15126)\n  - i915: Add GuC firmware v49.0.1 for all platforms\n  - i915: Add GuC v49.0.1 for DG1\n  - i915: Add HuC v7.7.1 for DG1\n  - i915: Add DMC v2.01 for ADL-S\n  - mediatek: update MT8173 VPU firmware to v1.1.6\n  - mediatek: add firmware for MT7921\n  - Mellanox: Add new mlxsw_spectrum firmware xx.2008.2304\n  - QCA : Updated firmware files for WCN3991\n  - qcom: add firmware files for Adreno a650\n  - qcom: Add SM8250 Audio DSP firmware\n  - qcom: Add SM8250 Compute DSP firmware\n  - qcom: Add venus firmware files for VPU-1.0\n\n* iwlwifi-firmware:\n  - Update firmware for Intel Bluetooth 9260, 9560 to 22.20.0.3\n  - Update firmware for Intel Bluetooth AX200, AX201, AX210 to 22.30.0.4\n\n* rtlwifi-firmware:\n  - rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x829a_7644\n  - rtl_bt: Update RTL8822C BT(USB I/F) FW to 0x099a_7253\n  - rtl_bt: Update RTL8822C BT(UART I/F) FW to 0x059A_25CB\n  - rtl_bt: Add firmware and config files for RTL8852A BT USB chip\n  - rtw88: RTL8821C: Update firmware to v24.8 (for rfe type 2 support)\n  - rtw88: RTL8822C: Update normal firmware to v9.9.5 (performance fixes)\n  - rtw89: 8852a: add firmware v0.9.12.2\n\n* radeon-firmware:\n  - amdgpu: add initial firmware for green sardine\n","status":"published","published":"2021-03-04T12:26:19Z","modified":"2026-04-16T04:44:20.221237604Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"MGASA-2021-0104","title":"Updated nonfree firmware packages fix security vulnerability","description":"Updated nonfree firmwares fixees various issues, adds new / improved\nhardware support and fixes at least the following security issue:\n\nAn issue was discovered on Broadcom Wi-Fi client devices. Specifically\ntimed and handcrafted traffic can cause internal errors (related to\nstate transitions) in a WLAN device that lead to improper layer 2\nWi-Fi encryption with a consequent possibility of information\ndisclosure over the air for a discrete set of traffic (CVE-2019-15126).\n\nFull list of updates:\n* kernel-firmware-nonfree:\n  - add firmware for Lontium LT9611UXC DSI to HDMI bridge\n  - brcm: Add NVRAM for Vamrs 96boards Rock960\n  - brcm: make AP6212 in bananpi m2 plus/zero work\n  - brcm: Link RPi4's WiFi firmware with DMI machine name\n  - brcm: Update Raspberry Pi 3B+/4B NVRAM for downstream changes\n  - brcm: remove old brcm firmwares that have newer cypress variants\n    (CVE-2019-15126)\n  - cypress: Link the new cypress firmware to the old brcm files\n    (CVE-2019-15126)\n  - i915: Add GuC firmware v49.0.1 for all platforms\n  - i915: Add GuC v49.0.1 for DG1\n  - i915: Add HuC v7.7.1 for DG1\n  - i915: Add DMC v2.01 for ADL-S\n  - mediatek: update MT8173 VPU firmware to v1.1.6\n  - mediatek: add firmware for MT7921\n  - Mellanox: Add new mlxsw_spectrum firmware xx.2008.2304\n  - qcom: add firmware files for Adreno a650\n  - qcom: Add SM8250 Audio DSP firmware\n  - qcom: Add SM8250 Compute DSP firmware\n  - qcom: Add venus firmware files for VPU-1.0\n\n* iwlwifi-firmware:\n  - Update firmware for Intel Bluetooth AX200, AX201, AX210 to 22.30.0.4\n\n* rtlwifi-firmware:\n  - rtw89: 8852a: add firmware v0.9.12.2\n","status":"published","published":"2021-03-04T12:26:19Z","modified":"2026-04-16T04:42:56.689410154Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:1648-1","title":"Security update for kernel-firmware","description":"This update for kernel-firmware fixes the following issues:\n\n- CVE-2019-15126: Updated Broadcom firmware to fix Kr00k bug (bsc#1167162).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2021-12-30T22:33:17Z","modified":"2026-02-04T03:15:42.451027Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2022:0366-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise 15 SP1 LTSS kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).\n- CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).\n- CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c (bnc#1194087).\n- CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).\n- CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).\n- CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)\n- CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)\n- CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).\n- CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).\n- CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).\n- CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).\n- CVE-2021-4135: Fixed zero-initialize memory inside netdevsim for new map's value in function nsim_bpf_map_alloc (bsc#1193927).\n- CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).\n- CVE-2021-4002: Fixed incorrect TLBs flush in hugetlbfs after huge_pmd_unshare (bsc#1192946).\n- CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).\n- CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861). \n- CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).\n- CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bsc#1192877)\n- CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392) (bsc#1193442).\n- CVE-2021-28714: Fixed issue with xen/netback to handle rx queue stall detection (XSA-392) (bsc#1193442).\n- CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391) (bsc#1193440).\n- CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391) (bsc#1193440).\n- CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391) (bsc#1193440).\n- CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192032).\n- CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc (bsc#1193731).\n- CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device (bsc#1179599).\n- CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices aka 'Kr00k'. (bsc#1167162)\n- CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).\n\nThe following non-security bugs were fixed:\n\n- Bluetooth: fix the erroneous flush_work() order (git-fixes).\n- Build: Add obsolete_rebuilds_subpackage (boo#1172073 bsc#1191731).\n- ICMPv6: Add ICMPv6 Parameter Problem, code 3 definition (bsc#1191241 bsc#1195166).\n- IPv6: reply ICMP error if the first fragment do not include all headers (bsc#1191241).\n- elfcore: fix building with clang (bsc#1169514).\n- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).\n- ipv6/netfilter: Discard first fragment not including all headers (bsc#1191241 bsc#1195166).\n- kernel-*-subpackage: Add dependency on kernel scriptlets (bsc#1192740).\n- kernel-binary.spec.in Stop templating the scriptlets for subpackages (bsc#1190358).\n- kernel-binary.spec.in: add zstd to BuildRequires if used\n- kernel-binary.spec.in: make sure zstd is supported by kmod if used\n- kernel-binary.spec: Check for no kernel signing certificates. Also remove unused variable.\n- kernel-binary.spec: Define $image as rpm macro (bsc#1189841).\n- kernel-binary.spec: Do not fail silently when KMP is empty (bsc#1190358). Copy the code from kernel-module-subpackage that deals with empty KMPs.\n- kernel-binary.spec: Do not sign kernel when no key provided (bsc#1187167).\n- kernel-binary.spec: Fix kernel-default-base scriptlets after packaging merge.\n- kernel-binary.spec: Require dwarves for kernel-binary-devel when BTF is enabled (jsc#SLE-17288).\n- kernel-binary.spec: suse-kernel-rpm-scriptlets required for uninstall as well.\n- kernel-cert-subpackage: Fix certificate location in scriptlets (bsc#1189841). \n- kernel-source.spec: install-kernel-tools also required on 15.4\n- kernel-spec-macros: Since rpm 4.17 %verbose is unusable (bsc#1191229). The semantic changed in an incompatible way so invoking the macro now causes a build failure.\n- kprobes: Limit max data_size of the kretprobe instances (bsc#1193669).\n- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).\n- memstick: rtsx_usb_ms: fix UAF (bsc#1194516).\n- moxart: fix potential use-after-free on remove path (bsc#1194516).\n- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).\n- net, xdp: Introduce xdp_prepare_buff utility routine (bsc#1193506).\n- net: Using proper atomic helper (bsc#1186222).\n- net: ipv6: Discard next-hop MTU less than minimum link MTU (bsc#1191241).\n- net: mana: Add RX fencing (bsc#1193506).\n- net: mana: Add XDP support (bsc#1193506).\n- net: mana: Allow setting the number of queues while the NIC is down (bsc#1193506).\n- net: mana: Fix spelling mistake 'calledd' -\u003e 'called' (bsc#1193506).\n- net: mana: Fix the netdev_err()'s vPort argument in mana_init_port() (bsc#1193506).\n- net: mana: Improve the HWC error handling (bsc#1193506).\n- net: mana: Support hibernation and kexec (bsc#1193506).\n- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).\n- objtool: Support Clang non-section symbols in ORC generation (bsc#1169514).\n- post.sh: detect /usr mountpoint too\n- recordmcount.pl: fix typo in s390 mcount regex (bsc#1192267).\n- recordmcount.pl: look for jgnop instruction as well as bcrl on s390 (bsc#1192267).\n- rpm/kernel-binary.spec.in: Use kmod-zstd provide. This makes it possible to use kmod with ZSTD support on non-Tumbleweed.\n- rpm/kernel-binary.spec.in: avoid conflicting suse-release suse-release had arbitrary values in staging, we can't use it for dependencies. The filesystem one has to be enough (boo#1184804).\n- rpm/kernel-binary.spec.in: do not strip vmlinux again (bsc#1193306). \n- rpm/kernel-binary.spec: Use only non-empty certificates.\n- rpm/kernel-obs-build.spec.in: make builds reproducible (bsc#1189305).\n- rpm/kernel-source.rpmlintrc: ignore new include/config files. \n- rpm/kernel-source.spec.in: do some more for vanilla_only.\n- rpm: Abolish image suffix (bsc#1189841).\n- rpm: Abolish scritplet templating (bsc#1189841). Outsource kernel-binary and KMP scriptlets to suse-module-tools. \n- rpm: Define $certs as rpm macro (bsc#1189841). \n- rpm: Fold kernel-devel and kernel-source scriptlets into spec files (bsc#1189841). \n- rpm: fix kmp install path\n- rpm: use _rpmmacrodir (boo#1191384)\n- tty: hvc: replace BUG_ON() with negative return value.\n- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).\n- x86/xen: Mark cpu_bringup_and_idle() as dead_end_function (bsc#1169514).\n- xen/blkfront: do not take local copy of a request from the ring page (git-fixes).\n- xen/blkfront: do not trust the backend response data blindly (git-fixes).\n- xen/blkfront: read response from backend only once (git-fixes).\n- xen/netfront: disentangle tx_skb_freelist (git-fixes).\n- xen/netfront: do not read data from request on the ring page (git-fixes).\n- xen/netfront: do not trust the backend response data blindly (git-fixes).\n- xen/netfront: read response from backend only once (git-fixes).\n- xen: sync include/xen/interface/io/ring.h with Xen's newest version (git-fixes).\n- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).\n","status":"published","published":"2022-02-10T16:40:07Z","modified":"2026-02-04T03:26:59.901347Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"SUSE-SU-2021:4003-1","title":"Security update for bcm43xx-firmware","description":"This update for bcm43xx-firmware fixes the following issues:\n\n- CVE-2019-15126: Fixed a bug which could have allowed unauthorized decryption of some WPA2-encrypted traffic (bsc#1167162).\n","status":"published","published":"2021-12-13T09:30:19Z","modified":"2026-02-04T04:25:37.256978Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2021:4200-1","title":"Security update for kernel-firmware","description":"This update for kernel-firmware fixes the following issues:\n\n- CVE-2019-15126: Updated Broadcom firmware to fix Kr00k bug (bsc#1167162).\n","status":"published","published":"2021-12-30T08:36:48Z","modified":"2025-05-02T04:30:06.420809Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2021:4201-1","title":"Security update for kernel-firmware","description":"This update for kernel-firmware fixes the following issues:\n\n- CVE-2019-15126: Updated Broadcom firmware to fix Kr00k bug (bsc#1167162).\n","status":"published","published":"2021-12-30T08:37:06Z","modified":"2026-02-04T03:17:32.244Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0068-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 12 SP5 kernel was updated.\n\nThe following security bugs were fixed:\n\n- CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices aka 'Kr00k'. (bsc#1167162)\n- CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bsc#1192877)\n- CVE-2021-0935: Fixed out of bounds write due to a use after free which could lead to local escalation of privilege with System execution privileges needed in ip6_xmit. (bsc#1192032)\n- CVE-2018-25020: Fixed an issue in the BPF subsystem in the Linux kernel mishandled situations with a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions, leading to an overflow. (bsc#1193575)\n- CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc. (bsc#1193731) \n- CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses. (bsc#1194094)\n- CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c. (bsc#1194087)\n- CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)\n- CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)\n- CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)\n- CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)\n- CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)\n- CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)\n- CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bsc#1192847)\n- CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)\n- CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bsc#1179599)\n\nThe following non-security bugs were fixed:\n\n- blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).\n- cifs: Add new mount parameter 'acdirmax' to allow caching directory metadata (bsc#1190317).\n- cifs: Add new parameter 'acregmax' for distinct file and directory metadata timeout (bsc#1190317).\n- cifs: convert list_for_each to entry variant (jsc#SLE-20656).\n- cifs: convert revalidate of directories to using directory metadata cache timeout (bsc#1190317).\n- cifs: Do not leak EDEADLK to dgetents64 for STATUS_USER_SESSION_DELETED (bsc#1190317).\n- cifs: fiemap: do not return EINVAL if get nothing (bsc#1190317).\n- cifs: Fix a potencially linear read overflow (git-fixes).\n- cifs: fix a sign extension bug (git-fixes).\n- cifs: fix incorrect check for null pointer in header_assemble (bsc#1190317).\n- cifs: fix memory leak of smb3_fs_context_dup::server_hostname (bsc#1190317).\n- cifs: fix missed refcounting of ipc tcon (git-fixes).\n- cifs: fix potential use-after-free bugs (jsc#SLE-20656).\n- cifs: fix print of hdr_flags in dfscache_proc_show() (jsc#SLE-20656).\n- cifs: fix wrong release in sess_alloc_buffer() failed path (bsc#1190317).\n- cifs: for compound requests, use open handle if possible (bsc#1190317).\n- cifs: introduce new helper for cifs_reconnect() (jsc#SLE-20656).\n- cifs: move to generic async completion (bsc#1190317).\n- cifs: nosharesock should be set on new server (git-fixes).\n- cifs: nosharesock should not share socket with future sessions (bsc#1190317).\n- cifs: On cifs_reconnect, resolve the hostname again (bsc#1190317).\n- cifs: properly invalidate cached root handle when closing it (bsc#1190317).\n- cifs: release lock earlier in dequeue_mid error case (bsc#1190317).\n- cifs: set a minimum of 120s for next dns resolution (bsc#1190317).\n- cifs: Simplify reconnect code when dfs upcall is enabled (bsc#1190317).\n- cifs: split out dfs code from cifs_reconnect() (jsc#SLE-20656).\n- cifs: support nested dfs links over reconnect (jsc#SLE-20656).\n- cifs: support share failover when remounting (jsc#SLE-20656).\n- cifs: To match file servers, make sure the server hostname matches (bsc#1190317).\n- config: INPUT_EVBUG=n (bsc#1192974). Debug driver unsuitable for production, only enabled on ppc64.\n- constraints: Build aarch64 on recent ARMv8.1 builders. Request asimdrdm feature which is available only on recent ARMv8.1 CPUs. This should prevent scheduling the kernel on an older slower builder.\n- cred: allow get_cred() and put_cred() to be given NULL (git-fixes).\n- EDAC/amd64: Handle three rank interleaving mode (bsc#1114648).\n- elfcore: correct reference to CONFIG_UML (git-fixes).\n- elfcore: fix building with clang (bsc#1169514).\n- fuse: release pipe buf after last use (bsc#1193318).\n- genirq: Move initial affinity setup to irq_startup() (bsc#1193231).\n- genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP (bsc#1193231).\n- genirq: Remove mask argument from setup_affinity() (bsc#1193231).\n- genirq: Rename setup_affinity() to irq_setup_affinity() (bsc#1193231).\n- genirq: Split out irq_startup() code (bsc#1193231).\n- lpfc: Reintroduce old IRQ probe logic (bsc#1183897).\n- md: fix a lock order reversal in md_alloc (git-fixes).\n- net: hso: fix control-request directions (git-fixes).\n- net: hso: fix muxed tty registration (git-fixes).\n- net: lan78xx: fix division by zero in send path (git-fixes).\n- net: mana: Allow setting the number of queues while the NIC is down (jsc#SLE-18779, bsc#1185727).\n- net: mana: Fix spelling mistake 'calledd' -\u003e 'called' (jsc#SLE-18779, bsc#1185727).\n- net: mana: Fix the netdev_err()'s vPort argument in mana_init_port() (jsc#SLE-18779, bsc#1185727).\n- net: mana: Improve the HWC error handling (jsc#SLE-18779, bsc#1185727).\n- net: mana: Support hibernation and kexec (jsc#SLE-18779, bsc#1185727).\n- net: mana: Use kcalloc() instead of kzalloc() (jsc#SLE-18779, bsc#1185727).\n- net: pegasus: fix uninit-value in get_interrupt_interval (git-fixes).\n- net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of '0' if no IRQ is available (git-fixes).\n- nfsd: do not alloc under spinlock in rpc_parse_scope_id (git-fixes).\n- nfsd: Handle the NFSv4 READDIR 'dircount' hint being zero (git-fixes).\n- nvme-fc: avoid race between time out and tear down (bsc#1185762).\n- nvme-fc: remove freeze/unfreeze around update_nr_hw_queues (bsc#1185762).\n- nvme-fc: update hardware queues before using them (bsc#1185762).\n- nvme-fc: wait for queues to freeze before calling update_hr_hw_queues (bsc#1183678).\n- nvme-pci: add NO APST quirk for Kioxia device (git-fixes).\n- objtool: Support Clang non-section symbols in ORC generation (bsc#1169514).\n- platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()' (git-fixes).\n- platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning (git-fixes).\n- pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds (git-fixes).\n- rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request (git-fixes).\n- scsi: core: Fix bad pointer dereference when ehandler kthread is invalid (git-fixes).\n- scsi: core: Put LLD module refcnt after SCSI device is released (git-fixes).\n- scsi: iscsi: Adjust iface sysfs attr detection (git-fixes).\n- scsi: lpfc: Add additional debugfs support for CMF (bsc1192145).\n- scsi: lpfc: Adjust CMF total bytes and rxmonitor (bsc1192145).\n- scsi: lpfc: Cap CMF read bytes to MBPI (bsc1192145).\n- scsi: lpfc: Change return code on I/Os received during link bounce (bsc1192145).\n- scsi: lpfc: Fix leaked lpfc_dmabuf mbox allocations with NPIV (bsc1192145).\n- scsi: lpfc: Fix lpfc_force_rscn ndlp kref imbalance (bsc1192145).\n- scsi: lpfc: Fix non-recovery of remote ports following an unsolicited LOGO (bsc#1189126).\n- scsi: lpfc: Fix NPIV port deletion crash (bsc1192145).\n- scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup (bsc1192145).\n- scsi: lpfc: Update lpfc version to 14.0.0.4 (bsc1192145).\n- scsi: mpt3sas: Fix kernel panic during drive powercycle test (git-fixes).\n- scsi: qla2xxx: edif: Fix app start delay (git-fixes).\n- scsi: qla2xxx: edif: Fix app start fail (git-fixes).\n- scsi: qla2xxx: edif: Fix EDIF bsg (git-fixes).\n- scsi: qla2xxx: edif: Fix off by one bug in qla_edif_app_getfcinfo() (git-fixes).\n- scsi: qla2xxx: edif: Flush stale events and msgs on session down (git-fixes).\n- scsi: qla2xxx: edif: Increase ELS payload (git-fixes).\n- scsi: qla2xxx: Fix gnl list corruption (git-fixes).\n- scsi: qla2xxx: Fix mailbox direction flags in qla2xxx_get_adapter_id() (git-fixes).\n- scsi: qla2xxx: Format log strings only if needed (git-fixes).\n- scsi: qla2xxx: Relogin during fabric disturbance (git-fixes).\n- smb3: add additional null check in SMB2_ioctl (bsc#1190317).\n- smb3: add additional null check in SMB2_open (bsc#1190317).\n- smb3: add additional null check in SMB2_tcon (bsc#1190317).\n- smb3: correct server pointer dereferencing check to be more consistent (bsc#1190317).\n- smb3: correct smb3 ACL security descriptor (bsc#1190317).\n- smb3: do not error on fsync when readonly (bsc#1190317).\n- smb3: remove trivial dfs compile warning (jsc#SLE-20656).\n- SUNRPC: async tasks mustn't block waiting for memory (bsc#1191876 bsc#1192866).\n- SUNRPC: improve 'swap' handling: scheduling and PF_MEMALLOC (bsc#1191876 bsc#1192866).\n- tracing: Check pid filtering when creating events (git-fixes).\n- tracing: Fix pid filtering when triggers are attached (git-fixes).\n- tty: hvc: replace BUG_ON() with negative return value (git-fixes).\n- usb: Add compatibility quirk flags for iODD 2531/2541 (git-fixes).\n- usb: dwc2: hcd_queue: Fix use of floating point literal (git-fixes).\n- usb: serial: option: add Fibocom FM101-GL variants (git-fixes).\n- usb: serial: option: add prod. id for Quectel EG91 (git-fixes).\n- usb: serial: option: add Quectel EC200S-CN module support (git-fixes).\n- usb: serial: option: add Telit LE910Cx composition 0x1204 (git-fixes).\n- usb: serial: option: add Telit LE910S1 0x9200 composition (git-fixes).\n- usb: serial: qcserial: add EM9191 QDL support (git-fixes).\n- x86/msi: Force affinity setup before startup (bsc#1193231).\n- x86/pkey: Fix undefined behaviour with PKRU_WD_BIT (bsc#1114648).\n- x86/sme: Explicitly map new EFI memmap table as encrypted (bsc#1114648).\n- x86/xen: Add xenpv_restore_regs_and_return_to_usermode() (bsc#1114648).\n- x86/xen: Mark cpu_bringup_and_idle() as dead_end_function (bsc#1169514).\n- xen: sync include/xen/interface/io/ring.h with Xen's newest version (git-fixes).\n- xen/blkfront: do not take local copy of a request from the ring page (git-fixes).\n- xen/blkfront: do not trust the backend response data blindly (git-fixes).\n- xen/blkfront: read response from backend only once (git-fixes).\n- xen/netfront: disentangle tx_skb_freelist (git-fixes).\n- xen/netfront: do not read data from request on the ring page (git-fixes).\n- xen/netfront: do not trust the backend response data blindly (git-fixes).\n- xen/netfront: read response from backend only once (git-fixes).\n","status":"published","published":"2022-01-13T14:11:18Z","modified":"2026-02-04T02:40:02.920711Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0080-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 12 SP5 kernel was updated.\n\nThe following security bugs were fixed:\n\n- CVE-2021-4083: Fixed a race condition with Unix domain socket garbage collection that can lead to read memory after free. (bsc#1193727)\n- CVE-2021-4149: Fixed an improper lock operation in btrfs which allows users to crash the kernel or deadlock the system. (bsc#1194001)\n- CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses. (bsc#1194094)\n- CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c. (bsc#1194087)\n- CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc. (bsc#1193731) \n- CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)\n- CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)\n- CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)\n- CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)\n- CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)\n- CVE-2018-25020: Fixed an issue in the BPF subsystem in the Linux kernel mishandled situations with a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions, leading to an overflow. (bsc#1193575)\n- CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)\n- CVE-2021-0935: Fixed out of bounds write due to a use after free which could lead to local escalation of privilege with System execution privileges needed in ip6_xmit. (bsc#1192032)\n- CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices aka 'Kr00k'. (bsc#1167162)\n- CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bsc#1192877)\n- CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)\n- CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bsc#1192847)\n- CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bsc#1179599)\n\nThe following non-security bugs were fixed:\n\n- blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).\n- bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22913)\n- bpf: Disallow unprivileged bpf by default (jsc#SLE-22913).\n- cifs: Add new mount parameter 'acdirmax' to allow caching directory metadata (bsc#1190317).\n- cifs: Add new parameter 'acregmax' for distinct file and directory metadata timeout (bsc#1190317).\n- cifs: convert list_for_each to entry variant (jsc#SLE-20656).\n- cifs: convert revalidate of directories to using directory metadata cache timeout (bsc#1190317).\n- cifs: Do not leak EDEADLK to dgetents64 for STATUS_USER_SESSION_DELETED (bsc#1190317).\n- cifs: fiemap: do not return EINVAL if get nothing (bsc#1190317).\n- cifs: Fix a potencially linear read overflow (git-fixes).\n- cifs: fix a sign extension bug (git-fixes).\n- cifs: fix incorrect check for null pointer in header_assemble (bsc#1190317).\n- cifs: fix memory leak of smb3_fs_context_dup::server_hostname (bsc#1190317).\n- cifs: fix missed refcounting of ipc tcon (git-fixes).\n- cifs: fix potential use-after-free bugs (jsc#SLE-20656).\n- cifs: fix print of hdr_flags in dfscache_proc_show() (jsc#SLE-20656).\n- cifs: fix wrong release in sess_alloc_buffer() failed path (bsc#1190317).\n- cifs: for compound requests, use open handle if possible (bsc#1190317).\n- cifs: introduce new helper for cifs_reconnect() (jsc#SLE-20656).\n- cifs: move to generic async completion (bsc#1190317).\n- cifs: nosharesock should be set on new server (git-fixes).\n- cifs: nosharesock should not share socket with future sessions (bsc#1190317).\n- cifs: On cifs_reconnect, resolve the hostname again (bsc#1190317).\n- cifs: properly invalidate cached root handle when closing it (bsc#1190317).\n- cifs: release lock earlier in dequeue_mid error case (bsc#1190317).\n- cifs: set a minimum of 120s for next dns resolution (bsc#1190317).\n- cifs: Simplify reconnect code when dfs upcall is enabled (bsc#1190317).\n- cifs: split out dfs code from cifs_reconnect() (jsc#SLE-20656).\n- cifs: support nested dfs links over reconnect (jsc#SLE-20656).\n- cifs: support share failover when remounting (jsc#SLE-20656).\n- cifs: To match file servers, make sure the server hostname matches (bsc#1190317).\n- config: disable unprivileged BPF by default (jsc#SLE-22913) Backport of mainline commit 8a03e56b253e ('bpf: Disallow unprivileged bpf by default') only changes kconfig default, used e.g. for 'make oldconfig' when the config option is missing, but does not update our kernel configs used for build. Update also these to make sure unprivileged BPF is really disabled by default.\n- config: INPUT_EVBUG=n (bsc#1192974). Debug driver unsuitable for production, only enabled on ppc64.\n- constraints: Build aarch64 on recent ARMv8.1 builders. Request asimdrdm feature which is available only on recent ARMv8.1 CPUs. This should prevent scheduling the kernel on an older slower builder.\n- cred: allow get_cred() and put_cred() to be given NULL (git-fixes).\n- EDAC/amd64: Handle three rank interleaving mode (bsc#1114648).\n- elfcore: correct reference to CONFIG_UML (git-fixes).\n- elfcore: fix building with clang (bsc#1169514).\n- fuse: release pipe buf after last use (bsc#1193318).\n- genirq: Move initial affinity setup to irq_startup() (bsc#1193231).\n- genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP (bsc#1193231).\n- genirq: Remove mask argument from setup_affinity() (bsc#1193231).\n- genirq: Rename setup_affinity() to irq_setup_affinity() (bsc#1193231).\n- genirq: Split out irq_startup() code (bsc#1193231).\n- kprobes: Limit max data_size of the kretprobe instances (bsc#1193669).\n- lpfc: Reintroduce old IRQ probe logic (bsc#1183897).\n- md: fix a lock order reversal in md_alloc (git-fixes).\n- net: hso: fix control-request directions (git-fixes).\n- net: hso: fix muxed tty registration (git-fixes).\n- net: lan78xx: fix division by zero in send path (git-fixes).\n- net: mana: Allow setting the number of queues while the NIC is down (jsc#SLE-18779, bsc#1185727).\n- net: mana: Fix spelling mistake 'calledd' -\u003e 'called' (jsc#SLE-18779, bsc#1185727).\n- net: mana: Fix the netdev_err()'s vPort argument in mana_init_port() (jsc#SLE-18779, bsc#1185727).\n- net: mana: Improve the HWC error handling (jsc#SLE-18779, bsc#1185727).\n- net: mana: Support hibernation and kexec (jsc#SLE-18779, bsc#1185727).\n- net: mana: Use kcalloc() instead of kzalloc() (jsc#SLE-18779, bsc#1185727).\n- net: pegasus: fix uninit-value in get_interrupt_interval (git-fixes).\n- net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of '0' if no IRQ is available (git-fixes).\n- nfsd: do not alloc under spinlock in rpc_parse_scope_id (git-fixes).\n- nfsd: Handle the NFSv4 READDIR 'dircount' hint being zero (git-fixes).\n- nvme-fc: avoid race between time out and tear down (bsc#1185762).\n- nvme-fc: remove freeze/unfreeze around update_nr_hw_queues (bsc#1185762).\n- nvme-fc: update hardware queues before using them (bsc#1185762).\n- nvme-fc: wait for queues to freeze before calling update_hr_hw_queues (bsc#1183678).\n- nvme-pci: add NO APST quirk for Kioxia device (git-fixes).\n- objtool: Support Clang non-section symbols in ORC generation (bsc#1169514).\n- platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()' (git-fixes).\n- platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning (git-fixes).\n- pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds (git-fixes).\n- printk: Remove printk.h inclusion in percpu.h (bsc#1192987).\n- rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request (git-fixes).\n- scsi: core: Fix bad pointer dereference when ehandler kthread is invalid (git-fixes).\n- scsi: core: Put LLD module refcnt after SCSI device is released (git-fixes).\n- scsi: iscsi: Adjust iface sysfs attr detection (git-fixes).\n- scsi: lpfc: Add additional debugfs support for CMF (bsc1192145).\n- scsi: lpfc: Adjust CMF total bytes and rxmonitor (bsc1192145).\n- scsi: lpfc: Cap CMF read bytes to MBPI (bsc1192145).\n- scsi: lpfc: Change return code on I/Os received during link bounce (bsc1192145).\n- scsi: lpfc: Fix leaked lpfc_dmabuf mbox allocations with NPIV (bsc1192145).\n- scsi: lpfc: Fix lpfc_force_rscn ndlp kref imbalance (bsc1192145).\n- scsi: lpfc: Fix non-recovery of remote ports following an unsolicited LOGO (bsc#1189126).\n- scsi: lpfc: Fix NPIV port deletion crash (bsc1192145).\n- scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup (bsc1192145).\n- scsi: lpfc: Update lpfc version to 14.0.0.4 (bsc1192145).\n- scsi: mpt3sas: Fix kernel panic during drive powercycle test (git-fixes).\n- scsi: qla2xxx: edif: Fix app start delay (git-fixes).\n- scsi: qla2xxx: edif: Fix app start fail (git-fixes).\n- scsi: qla2xxx: edif: Fix EDIF bsg (git-fixes).\n- scsi: qla2xxx: edif: Fix off by one bug in qla_edif_app_getfcinfo() (git-fixes).\n- scsi: qla2xxx: edif: Flush stale events and msgs on session down (git-fixes).\n- scsi: qla2xxx: edif: Increase ELS payload (git-fixes).\n- scsi: qla2xxx: Fix gnl list corruption (git-fixes).\n- scsi: qla2xxx: Fix mailbox direction flags in qla2xxx_get_adapter_id() (git-fixes).\n- scsi: qla2xxx: Format log strings only if needed (git-fixes).\n- scsi: qla2xxx: Relogin during fabric disturbance (git-fixes).\n- smb3: add additional null check in SMB2_ioctl (bsc#1190317).\n- smb3: add additional null check in SMB2_open (bsc#1190317).\n- smb3: add additional null check in SMB2_tcon (bsc#1190317).\n- smb3: correct server pointer dereferencing check to be more consistent (bsc#1190317).\n- smb3: correct smb3 ACL security descriptor (bsc#1190317).\n- smb3: do not error on fsync when readonly (bsc#1190317).\n- smb3: remove trivial dfs compile warning (jsc#SLE-20656).\n- SUNRPC: async tasks mustn't block waiting for memory (bsc#1191876 bsc#1192866).\n- SUNRPC: async tasks mustn't block waiting for memory (bsc#1191876 bsc#1192866).\n- SUNRPC: async tasks mustn't block waiting for memory (bsc#1191876 bsc#1192866).\n- SUNRPC: improve 'swap' handling: scheduling and PF_MEMALLOC (bsc#1191876 bsc#1192866).\n- swiotlb-xen: avoid double free (git-fixes).\n- tracing: Check pid filtering when creating events (git-fixes).\n- tracing: Fix pid filtering when triggers are attached (git-fixes).\n- tracing: use %ps format string to print symbols (git-fixes).\n- tty: hvc: replace BUG_ON() with negative return value (git-fixes).\n- USB: Add compatibility quirk flags for iODD 2531/2541 (git-fixes).\n- USB: dwc2: hcd_queue: Fix use of floating point literal (git-fixes).\n- USB: serial: option: add Fibocom FM101-GL variants (git-fixes).\n- USB: serial: option: add prod. id for Quectel EG91 (git-fixes).\n- USB: serial: option: add Quectel EC200S-CN module support (git-fixes).\n- USB: serial: option: add Telit LE910Cx composition 0x1204 (git-fixes).\n- USB: serial: option: add Telit LE910S1 0x9200 composition (git-fixes).\n- USB: serial: qcserial: add EM9191 QDL support (git-fixes).\n- x86/msi: Force affinity setup before startup (bsc#1193231).\n- x86/pkey: Fix undefined behaviour with PKRU_WD_BIT (bsc#1114648).\n- x86/sme: Explicitly map new EFI memmap table as encrypted (bsc#1114648).\n- x86/xen: Add xenpv_restore_regs_and_return_to_usermode() (bsc#1114648).\n- x86/xen: Mark cpu_bringup_and_idle() as dead_end_function (bsc#1169514).\n- x86/xen: swap NX determination and GDT setup on BSP (git-fixes).\n- xen-pciback: redo VF placement in the virtual topology (git-fixes).\n- xen: sync include/xen/interface/io/ring.h with Xen's newest version (git-fixes).\n- xen/blkfront: do not take local copy of a request from the ring page (git-fixes).\n- xen/blkfront: do not trust the backend response data blindly (git-fixes).\n- xen/blkfront: read response from backend only once (git-fixes).\n- xen/netfront: disentangle tx_skb_freelist (git-fixes).\n- xen/netfront: do not read data from request on the ring page (git-fixes).\n- xen/netfront: do not trust the backend response data blindly (git-fixes).\n- xen/netfront: read response from backend only once (git-fixes).\n- xen/x86: fix PV trap handling on secondary processors (git-fixes).\n","status":"published","published":"2022-01-14T11:08:11Z","modified":"2026-02-04T03:52:17.48257Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0090-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices aka 'Kr00k'. (bsc#1167162)\n- CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bsc#1179599)\n- CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc. (bsc#1193731)\n- CVE-2021-0935: Fixed out of bounds write due to a use after free which could lead to local escalation of privilege with System execution privileges needed in ip6_xmit. (bsc#1192032)\n- CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)\n- CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)\n- CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)\n- CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)\n- CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)\n- CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)\n- CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bsc#1192877)\n- CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)\n- CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bsc#1192847)\n- CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses. (bsc#1194094)\n- CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c. (bsc#1194087)\n\nThe following non-security bugs were fixed:\n\n- blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).\n- cifs: fix missed refcounting of ipc tcon (git-fixes).\n- cifs: nosharesock should be set on new server (git-fixes).\n- config: INPUT_EVBUG=n (bsc#1192974). Debug driver unsuitable for production, only enabled on ppc64.\n- constraints: Build aarch64 on recent ARMv8.1 builders. Request asimdrdm feature which is available only on recent ARMv8.1 CPUs. This should prevent scheduling the kernel on an older slower builder.\n- edac/amd64: Handle three rank interleaving mode (bsc#1114648).\n- elfcore: correct reference to CONFIG_UML (git-fixes).\n- fuse: release pipe buf after last use (bsc#1193318).\n- genirq: Move initial affinity setup to irq_startup() (bsc#1193231).\n- genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP (bsc#1193231).\n- genirq: Remove mask argument from setup_affinity() (bsc#1193231).\n- genirq: Rename setup_affinity() to irq_setup_affinity() (bsc#1193231).\n- genirq: Split out irq_startup() code (bsc#1193231).\n- kernel-*-subpackage: Add dependency on kernel scriptlets (bsc#1192740).\n- kernel-binary.spec.in Stop templating the scriptlets for subpackages (bsc#1190358). The script part for base package case is completely separate from the part for subpackages. Remove the part for subpackages from the base package script and use the KMP scripts for subpackages instead.\n- kernel-binary.spec.in: add zstd to BuildRequires if used\n- kernel-binary.spec.in: make sure zstd is supported by kmod if used\n- kernel-binary.spec: Check for no kernel signing certificates. Also remove unused variable.\n- kernel-binary.spec: Define $image as rpm macro (bsc#1189841).\n- kernel-binary.spec: Do not fail silently when KMP is empty (bsc#1190358). Copy the code from kernel-module-subpackage that deals with empty KMPs.\n- kernel-binary.spec: Do not sign kernel when no key provided (bsc#1187167).\n- kernel-binary.spec: Fix kernel-default-base scriptlets after packaging merge.\n- kernel-binary.spec: Require dwarves for kernel-binary-devel when BTF is enabled (jsc#SLE-17288). About the pahole version: v1.18 should be bare mnimum, v1.22 should be fully functional, for now we ship git snapshot with fixes on top of v1.21.\n- kernel-binary.spec: suse-kernel-rpm-scriptlets required for uninstall as well. Fixes: e98096d5cf85 ('rpm: Abolish scritplet templating (bsc#1189841).')\n- kernel-cert-subpackage: Fix certificate location in scriptlets (bsc#1189841). Fixes: d9a1357edd73 ('rpm: Define $certs as rpm macro (bsc#1189841).')\n- kernel-source.spec: install-kernel-tools also required on 15.4\n- kernel-spec-macros: Since rpm 4.17 %verbose is unusable (bsc#1191229). The semantic changed in an incompatible way so invoking the macro now causes a build failure.\n- lpfc: Reintroduce old IRQ probe logic (bsc#1183897).\n- net: mana: Allow setting the number of queues while the NIC is down (jsc#SLE-18779, bsc#1185727).\n- net: mana: Fix spelling mistake 'calledd' -\u003e 'called' (jsc#SLE-18779, bsc#1185727).\n- net: mana: Fix the netdev_err()'s vPort argument in mana_init_port() (jsc#SLE-18779, bsc#1185727).\n- net: mana: Improve the HWC error handling (jsc#SLE-18779, bsc#1185727).\n- net: mana: Support hibernation and kexec (jsc#SLE-18779, bsc#1185727).\n- net: mana: Use kcalloc() instead of kzalloc() (jsc#SLE-18779, bsc#1185727).\n- net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of '0' if no IRQ is available (git-fixes).\n- nvme-fc: avoid race between time out and tear down (bsc#1185762).\n- nvme-fc: remove freeze/unfreeze around update_nr_hw_queues (bsc#1185762).\n- nvme-fc: update hardware queues before using them (bsc#1185762).\n- nvme-fc: wait for queues to freeze before calling update_hr_hw_queues (bsc#1183678).\n- nvme-pci: add NO APST quirk for Kioxia device (git-fixes).\n- platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()' (git-fixes).\n- platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning (git-fixes).\n- post.sh: detect /usr mountpoint too\n- readme: Modernize build instructions.\n- recordmcount.pl: fix typo in s390 mcount regex (bsc#1192267).\n- recordmcount.pl: look for jgnop instruction as well as bcrl on s390 (bsc#1192267).\n- rpm/kernel-binary.spec.in: Use kmod-zstd provide. This makes it possible to use kmod with ZSTD support on non-Tumbleweed.\n- rpm/kernel-binary.spec.in: avoid conflicting suse-release suse-release had arbitrary values in staging, we can't use it for dependencies. The filesystem one has to be enough (boo#1184804).\n- rpm/kernel-binary.spec.in: do not strip vmlinux again (bsc#1193306) After usrmerge, vmlinux file is not named vmlinux-\u0026lt;version\u003e, but simply vmlinux. And this is not reflected in STRIP_KEEP_SYMTAB we set. So fix this by removing the dash...\n- rpm/kernel-binary.spec: Use only non-empty certificates.\n- rpm/kernel-obs-build.spec.in: make builds reproducible (bsc#1189305)\n- rpm/kernel-source.rpmlintrc: ignore new include/config files In 5.13, since 0e0345b77ac4, config files have no longer .h suffix. Adapt the zero-length check. Based on Martin Liska's change.\n- rpm/kernel-source.spec.in: do some more for vanilla_only Make sure: * sources are NOT executable * env is not used as interpreter * timestamps are correct We do all this for normal kernel builds, but not for vanilla_only kernels (linux-next and vanilla).\n- rpm: Abolish image suffix (bsc#1189841). This is used only with vanilla kernel which is not supported in any way. The only effect is has is that the image and initrd symlinks are created with this suffix. These symlinks are not used except on s390 where the unsuffixed symlinks are used by zipl. There is no reason why a vanilla kernel could not be used with zipl as well as it's quite unexpected to not be able to boot when only a vanilla kernel is installed. Finally we now have a backup zipl kernel so if the vanilla kernel is indeed unsuitable the backup kernel can be used.\n- rpm: Abolish scritplet templating (bsc#1189841). Outsource kernel-binary and KMP scriptlets to suse-module-tools. This allows fixing bugs in the scriptlets as well as defining initrd regeneration policy independent of the kernel packages.\n- rpm: Define $certs as rpm macro (bsc#1189841). Also pass around only the shortened hash rather than full filename. As has been discussed in bsc#1124431 comment 51 https://bugzilla.suse.com/show_bug.cgi?id=1124431#c51 the placement of the certificates is an API which cannot be changed unless we can ensure that no two kernels that use different certificate location can be built with the same certificate.\n- rpm: Fold kernel-devel and kernel-source scriptlets into spec files (bsc#1189841). These are unchanged since 2011 when they were introduced. No need to track them separately.\n- rpm: fix kmp install path\n- rpm: support gz and zst compression methods Extend commit 18fcdff43a00 ('rpm: support compressed modules') for compression methods other than xz.\n- rpm: use _rpmmacrodir (boo#1191384)\n- scsi: core: Fix bad pointer dereference when ehandler kthread is invalid (git-fixes).\n- scsi: core: Put LLD module refcnt after SCSI device is released (git-fixes).\n- scsi: iscsi: Adjust iface sysfs attr detection (git-fixes).\n- scsi: lpfc: Add additional debugfs support for CMF (bsc#1192145).\n- scsi: lpfc: Adjust CMF total bytes and rxmonitor (bsc#1192145).\n- scsi: lpfc: Cap CMF read bytes to MBPI (bsc#1192145).\n- scsi: lpfc: Change return code on I/Os received during link bounce (bsc#1192145).\n- scsi: lpfc: Fix NPIV port deletion crash (bsc#1192145).\n- scsi: lpfc: Fix leaked lpfc_dmabuf mbox allocations with NPIV (bsc#1192145).\n- scsi: lpfc: Fix lpfc_force_rscn ndlp kref imbalance (bsc#1192145).\n- scsi: lpfc: Fix non-recovery of remote ports following an unsolicited LOGO (bsc#1189126).\n- scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup (bsc#1192145).\n- scsi: lpfc: Update lpfc version to 14.0.0.4 (bsc#1192145).\n- scsi: mpt3sas: Fix kernel panic during drive powercycle test (git-fixes).\n- scsi: qla2xxx: Fix gnl list corruption (git-fixes).\n- scsi: qla2xxx: Fix mailbox direction flags in qla2xxx_get_adapter_id() (git-fixes).\n- scsi: qla2xxx: Format log strings only if needed (git-fixes).\n- scsi: qla2xxx: Relogin during fabric disturbance (git-fixes).\n- scsi: qla2xxx: edif: Fix EDIF bsg (git-fixes).\n- scsi: qla2xxx: edif: Fix app start delay (git-fixes).\n- scsi: qla2xxx: edif: Fix app start fail (git-fixes).\n- scsi: qla2xxx: edif: Fix off by one bug in qla_edif_app_getfcinfo() (git-fixes).\n- scsi: qla2xxx: edif: Flush stale events and msgs on session down (git-fixes).\n- scsi: qla2xxx: edif: Increase ELS payload (git-fixes).\n- tracing: Check pid filtering when creating events (git-fixes).\n- tracing: Fix pid filtering when triggers are attached (git-fixes).\n- tty: hvc: replace BUG_ON() with negative return value (git-fixes).\n- usb-storage: Add compatibility quirk flags for iODD 2531/2541 (git-fixes).\n- usb: dwc2: hcd_queue: Fix use of floating point literal (git-fixes).\n- usb: serial: option: add Fibocom FM101-GL variants (git-fixes).\n- usb: serial: option: add Quectel EC200S-CN module support (git-fixes).\n- usb: serial: option: add Telit LE910Cx composition 0x1204 (git-fixes).\n- usb: serial: option: add Telit LE910S1 0x9200 composition (git-fixes).\n- usb: serial: option: add prod. id for Quectel EG91 (git-fixes).\n- usb: serial: qcserial: add EM9191 QDL support (git-fixes).\n- x86/msi: Force affinity setup before startup (bsc#1193231).\n- x86/pkey: Fix undefined behaviour with PKRU_WD_BIT (bsc#1114648).\n- x86/sme: Explicitly map new EFI memmap table as encrypted (bsc#1114648).\n- x86/xen: Add xenpv_restore_regs_and_return_to_usermode() (bsc#1114648).\n- xen/blkfront: do not take local copy of a request from the ring page (git-fixes).\n- xen/blkfront: do not trust the backend response data blindly (git-fixes).\n- xen/blkfront: read response from backend only once (git-fixes).\n- xen/netfront: disentangle tx_skb_freelist (git-fixes).\n- xen/netfront: do not read data from request on the ring page (git-fixes).\n- xen/netfront: do not trust the backend response data blindly (git-fixes).\n- xen/netfront: read response from backend only once (git-fixes).\n- xen: sync include/xen/interface/io/ring.h with Xen's newest version (git-fixes).\n","status":"published","published":"2022-01-17T15:24:54Z","modified":"2026-02-04T04:31:47.463386Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0366-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise 15 SP1 LTSS kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).\n- CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).\n- CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c (bnc#1194087).\n- CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).\n- CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).\n- CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)\n- CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)\n- CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).\n- CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).\n- CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).\n- CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).\n- CVE-2021-4135: Fixed zero-initialize memory inside netdevsim for new map's value in function nsim_bpf_map_alloc (bsc#1193927).\n- CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).\n- CVE-2021-4002: Fixed incorrect TLBs flush in hugetlbfs after huge_pmd_unshare (bsc#1192946).\n- CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).\n- CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861). \n- CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).\n- CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bsc#1192877)\n- CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392) (bsc#1193442).\n- CVE-2021-28714: Fixed issue with xen/netback to handle rx queue stall detection (XSA-392) (bsc#1193442).\n- CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391) (bsc#1193440).\n- CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391) (bsc#1193440).\n- CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391) (bsc#1193440).\n- CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192032).\n- CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc (bsc#1193731).\n- CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device (bsc#1179599).\n- CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices aka 'Kr00k'. (bsc#1167162)\n- CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).\n\nThe following non-security bugs were fixed:\n\n- Bluetooth: fix the erroneous flush_work() order (git-fixes).\n- Build: Add obsolete_rebuilds_subpackage (boo#1172073 bsc#1191731).\n- ICMPv6: Add ICMPv6 Parameter Problem, code 3 definition (bsc#1191241 bsc#1195166).\n- IPv6: reply ICMP error if the first fragment do not include all headers (bsc#1191241).\n- elfcore: fix building with clang (bsc#1169514).\n- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).\n- ipv6/netfilter: Discard first fragment not including all headers (bsc#1191241 bsc#1195166).\n- kernel-*-subpackage: Add dependency on kernel scriptlets (bsc#1192740).\n- kernel-binary.spec.in Stop templating the scriptlets for subpackages (bsc#1190358).\n- kernel-binary.spec.in: add zstd to BuildRequires if used\n- kernel-binary.spec.in: make sure zstd is supported by kmod if used\n- kernel-binary.spec: Check for no kernel signing certificates. Also remove unused variable.\n- kernel-binary.spec: Define $image as rpm macro (bsc#1189841).\n- kernel-binary.spec: Do not fail silently when KMP is empty (bsc#1190358). Copy the code from kernel-module-subpackage that deals with empty KMPs.\n- kernel-binary.spec: Do not sign kernel when no key provided (bsc#1187167).\n- kernel-binary.spec: Fix kernel-default-base scriptlets after packaging merge.\n- kernel-binary.spec: Require dwarves for kernel-binary-devel when BTF is enabled (jsc#SLE-17288).\n- kernel-binary.spec: suse-kernel-rpm-scriptlets required for uninstall as well.\n- kernel-cert-subpackage: Fix certificate location in scriptlets (bsc#1189841). \n- kernel-source.spec: install-kernel-tools also required on 15.4\n- kernel-spec-macros: Since rpm 4.17 %verbose is unusable (bsc#1191229). The semantic changed in an incompatible way so invoking the macro now causes a build failure.\n- kprobes: Limit max data_size of the kretprobe instances (bsc#1193669).\n- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).\n- memstick: rtsx_usb_ms: fix UAF (bsc#1194516).\n- moxart: fix potential use-after-free on remove path (bsc#1194516).\n- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).\n- net, xdp: Introduce xdp_prepare_buff utility routine (bsc#1193506).\n- net: Using proper atomic helper (bsc#1186222).\n- net: ipv6: Discard next-hop MTU less than minimum link MTU (bsc#1191241).\n- net: mana: Add RX fencing (bsc#1193506).\n- net: mana: Add XDP support (bsc#1193506).\n- net: mana: Allow setting the number of queues while the NIC is down (bsc#1193506).\n- net: mana: Fix spelling mistake 'calledd' -\u003e 'called' (bsc#1193506).\n- net: mana: Fix the netdev_err()'s vPort argument in mana_init_port() (bsc#1193506).\n- net: mana: Improve the HWC error handling (bsc#1193506).\n- net: mana: Support hibernation and kexec (bsc#1193506).\n- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).\n- objtool: Support Clang non-section symbols in ORC generation (bsc#1169514).\n- post.sh: detect /usr mountpoint too\n- recordmcount.pl: fix typo in s390 mcount regex (bsc#1192267).\n- recordmcount.pl: look for jgnop instruction as well as bcrl on s390 (bsc#1192267).\n- rpm/kernel-binary.spec.in: Use kmod-zstd provide. This makes it possible to use kmod with ZSTD support on non-Tumbleweed.\n- rpm/kernel-binary.spec.in: avoid conflicting suse-release suse-release had arbitrary values in staging, we can't use it for dependencies. The filesystem one has to be enough (boo#1184804).\n- rpm/kernel-binary.spec.in: do not strip vmlinux again (bsc#1193306). \n- rpm/kernel-binary.spec: Use only non-empty certificates.\n- rpm/kernel-obs-build.spec.in: make builds reproducible (bsc#1189305).\n- rpm/kernel-source.rpmlintrc: ignore new include/config files. \n- rpm/kernel-source.spec.in: do some more for vanilla_only.\n- rpm: Abolish image suffix (bsc#1189841).\n- rpm: Abolish scritplet templating (bsc#1189841). Outsource kernel-binary and KMP scriptlets to suse-module-tools. \n- rpm: Define $certs as rpm macro (bsc#1189841). \n- rpm: Fold kernel-devel and kernel-source scriptlets into spec files (bsc#1189841). \n- rpm: fix kmp install path\n- rpm: use _rpmmacrodir (boo#1191384)\n- tty: hvc: replace BUG_ON() with negative return value.\n- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).\n- x86/xen: Mark cpu_bringup_and_idle() as dead_end_function (bsc#1169514).\n- xen/blkfront: do not take local copy of a request from the ring page (git-fixes).\n- xen/blkfront: do not trust the backend response data blindly (git-fixes).\n- xen/blkfront: read response from backend only once (git-fixes).\n- xen/netfront: disentangle tx_skb_freelist (git-fixes).\n- xen/netfront: do not read data from request on the ring page (git-fixes).\n- xen/netfront: do not trust the backend response data blindly (git-fixes).\n- xen/netfront: read response from backend only once (git-fixes).\n- xen: sync include/xen/interface/io/ring.h with Xen's newest version (git-fixes).\n- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).\n","status":"published","published":"2022-02-10T16:40:39Z","modified":"2025-05-02T04:29:57.305101Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0367-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).\n- CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).\n- CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).\n- CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).\n- CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861). \n- CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).\n- CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).\n- CVE-2022-0322: Fixed SCTP issue with account stream padding length for reconf chunk (bsc#1194985).\n- CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).\n- CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).\n- CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).\n- CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).\n- CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c (bnc#1194087).\n- CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc (bsc#1193731).\n- CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391) (bsc#1193440).\n- CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391) (bsc#1193440).\n- CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391) (bsc#1193440).\n- CVE-2021-28714: Fixed issue with xen/netback to handle rx queue stall detection (XSA-392) (bsc#1193442).\n- CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392) (bsc#1193442).\n- CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).\n- CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192032).\n- CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device (bsc#1179599).\n- CVE-2021-4002: Fixed incorrect TLBs flush in hugetlbfs after huge_pmd_unshare (bsc#1192946).\n- CVE-2021-43975: hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allowed an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value (bnc#1192845).\n- CVE-2021-33098: Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1192877).\n- CVE-2021-43976: mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allowed an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic) (bnc#1192847).\n- CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices aka 'Kr00k' (bsc#1167162).\n- CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).\n\n\nThe following non-security bugs were fixed:\n\n- Bluetooth: fix the erroneous flush_work() order (git-fixes).\n- Build: Add obsolete_rebuilds_subpackage (boo#1172073 bsc#1191731).\n- ICMPv6: Add ICMPv6 Parameter Problem, code 3 definition (bsc#1191241).\n- IPv6: reply ICMP error if the first fragment do not include all headers (bsc#1191241 bsc#1195166).\n- elfcore: fix building with clang (bsc#1169514).\n- fget: clarify and improve __fget_files() implementation (bsc#1193727).\n- hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit() (bsc#1193506).\n- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).\n- ipv6/netfilter: Discard first fragment not including all headers (bsc#1191241 bsc#1195166).\n- kernel-*-subpackage: Add dependency on kernel scriptlets (bsc#1192740).\n- kernel-binary.spec.in: add zstd to BuildRequires if used\n- kernel-binary.spec.in: make sure zstd is supported by kmod if used\n- kernel-binary.spec: Check for no kernel signing certificates. Also remove unused variable.\n- kernel-binary.spec: Define $image as rpm macro (bsc#1189841).\n- kernel-binary.spec: Do not fail silently when KMP is empty (bsc#1190358).\n- kernel-binary.spec: Do not sign kernel when no key provided (bsc#1187167).\n- kernel-binary.spec: Fix kernel-default-base scriptlets after packaging merge.\n- kernel-binary.spec: Require dwarves for kernel-binary-devel when BTF is enabled (jsc#SLE-17288).\n- kernel-binary.spec: suse-kernel-rpm-scriptlets required for uninstall as well.\n- kernel-cert-subpackage: Fix certificate location in scriptlets (bsc#1189841).\n- kernel-source.spec: install-kernel-tools also required on 15.4\n- kernel-spec-macros: Since rpm 4.17 %verbose is unusable (bsc#1191229).\n- kprobes: Limit max data_size of the kretprobe instances (bsc#1193669).\n- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).\n- memstick: rtsx_usb_ms: fix UAF (bsc#1194516).\n- moxart: fix potential use-after-free on remove path (bsc#1194516).\n- net: Using proper atomic helper (bsc#1186222).\n- net: ipv6: Discard next-hop MTU less than minimum link MTU (bsc#1191241 bsc#1195166).\n- net: mana: Add RX fencing (bsc#1193506).\n- net: mana: Add XDP support (bsc#1193506).\n- net: mana: Allow setting the number of queues while the NIC is down (bsc#1193506).\n- net: mana: Fix spelling mistake 'calledd' -\u003e 'called' (bsc#1193506).\n- net: mana: Fix the netdev_err()'s vPort argument in mana_init_port() (bsc#1193506).\n- net: mana: Improve the HWC error handling (bsc#1193506).\n- net: mana: Support hibernation and kexec (bsc#1193506).\n- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).\n- objtool: Support Clang non-section symbols in ORC generation (bsc#1169514).\n- post.sh: detect /usr mountpoint too\n- recordmcount.pl: fix typo in s390 mcount regex (bsc#1192267).\n- recordmcount.pl: look for jgnop instruction as well as bcrl on s390 (bsc#1192267).\n- rpm/kernel-binary.spec.in: Use kmod-zstd provide. This makes it possible to use kmod with ZSTD support on non-Tumbleweed.\n- rpm/kernel-binary.spec.in: avoid conflicting suse-release suse-release had arbitrary values in staging, we can't use it for dependencies. The filesystem one has to be enough (boo#1184804).\n- rpm/kernel-binary.spec.in: do not strip vmlinux again (bsc#1193306) After usrmerge, vmlinux file is not named vmlinux-\u0026lt;version\u003e, but simply vmlinux. And this is not reflected in STRIP_KEEP_SYMTAB we set. So fix this by removing the dash...\n- rpm/kernel-binary.spec: Use only non-empty certificates.\n- rpm/kernel-obs-build.spec.in: make builds reproducible (bsc#1189305)\n- rpm: fix kmp install path\n- rpm: fixup support gz and zst compression methods (bsc#1190428, bsc#1190358).\n- rpm: use _rpmmacrodir (boo#1191384)\n- tty: hvc: replace BUG_ON() with negative return value (git-fixes).\n- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).\n- x86/xen: Mark cpu_bringup_and_idle() as dead_end_function (bsc#1169514).\n- xen/blkfront: do not take local copy of a request from the ring page (git-fixes).\n- xen/blkfront: do not trust the backend response data blindly (git-fixes).\n- xen/blkfront: read response from backend only once (git-fixes).\n- xen/netfront: disentangle tx_skb_freelist (git-fixes).\n- xen/netfront: do not read data from request on the ring page (git-fixes).\n- xen/netfront: do not trust the backend response data blindly (git-fixes).\n- xen/netfront: read response from backend only once (git-fixes).\n- xen: sync include/xen/interface/io/ring.h with Xen's newest version (git-fixes).\n- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).\n","status":"published","published":"2022-02-10T16:42:12Z","modified":"2026-02-04T03:11:56.604464Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0371-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 12 SP4 LTSS kernel was updated to receive various security and bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).\n- CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).\n- CVE-2022-0322: Fixed SCTP issue with account stream padding length for reconf chunk (bsc#1194985).\n- CVE-2021-45486: Fixed information leak inside the IPv4 implementation caused by very small hash table (bnc#1194087).\n- CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).\n- CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).\n- CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)\n- CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)\n- CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).\n- CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).\n- CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).\n- CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).\n- CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).\n- CVE-2021-4002: Fixed a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)\n- CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).\n- CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).\n- CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).\n- CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bsc#1192877)\n- CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392) (bsc#1193442).\n- CVE-2021-28714: Fixed issue with xen/netback to add rx queue stall detection (XSA-392) (bsc#1193442).\n- CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391) (bsc#1193440).\n- CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391) (bsc#1193440).\n- CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391) (bsc#1193440).\n- CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192032).\n- CVE-2021-0920: Fixed use after free bug due to a race condition in unix_scm_to_skb of af_unix.c. This could have led to local escalation of privilege with System execution privileges needed (bnc#1193731).\n- CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bsc#1179599)\n- CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices aka 'Kr00k'. (bsc#1167162)\n- CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).\n\n\nThe following non-security bugs were fixed:\n\n- Bluetooth: fix the erroneous flush_work() order (git-fixes).\n- Build: Add obsolete_rebuilds_subpackage (boo#1172073 bsc#1191731).\n- elfcore: fix building with clang (bsc#1169514).\n- fget: clarify and improve __fget_files() implementation (bsc#1193727).\n- hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit() (bsc#1193507).\n- hv_netvsc: Set needed_headroom according to VF (bsc#1193507).\n- kernel-*-subpackage: Add dependency on kernel scriptlets (bsc#1192740).\n- kernel-binary.spec: Check for no kernel signing certificates. Also remove unused variable.\n- kernel-binary.spec: Define $image as rpm macro (bsc#1189841).\n- kernel-binary.spec: Do not sign kernel when no key provided (bsc#1187167).\n- kernel-binary.spec: Fix kernel-default-base scriptlets after packaging merge.\n- kernel-binary.spec: suse-kernel-rpm-scriptlets required for uninstall as well (bsc#1189841).\n- kernel-cert-subpackage: Fix certificate location in scriptlets (bsc#1189841).\n- kernel-source.spec: install-kernel-tools also required on 15.4\n- kernel-spec-macros: Since rpm 4.17 %verbose is unusable (bsc#1191229). \n- kprobes: Limit max data_size of the kretprobe instances (bsc#1193669).\n- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).\n- memstick: rtsx_usb_ms: fix UAF (bsc#1194516).\n- moxart: fix potential use-after-free on remove path (bsc#1194516).\n- net: Using proper atomic helper (bsc#1186222).\n- net: mana: Add RX fencing (bsc#1193507).\n- net: mana: Add XDP support (bsc#1193507).\n- net: mana: Allow setting the number of queues while the NIC is down (bsc#1193507).\n- net: mana: Fix spelling mistake 'calledd' -\u003e 'called' (bsc#1193507).\n- net: mana: Fix the netdev_err()'s vPort argument in mana_init_port() (bsc#1193507).\n- net: mana: Improve the HWC error handling (bsc#1193507).\n- net: mana: Support hibernation and kexec (bsc#1193507).\n- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193507).\n- objtool: Support Clang non-section symbols in ORC generation (bsc#1169514).\n- post.sh: detect /usr mountpoint too\n- recordmcount.pl: fix typo in s390 mcount regex (bsc#1192267).\n- recordmcount.pl: look for jgnop instruction as well as bcrl on s390 (bsc#1192267).\n- rpm/kernel-binary.spec.in: Use kmod-zstd provide. This makes it possible to use kmod with ZSTD support on non-Tumbleweed.\n- rpm/kernel-binary.spec.in: avoid conflicting suse-release suse-release had arbitrary values in staging, we can't use it for dependencies. The filesystem one has to be enough (boo#1184804).\n- rpm/kernel-binary.spec.in: do not strip vmlinux again (bsc#1193306) After usrmerge, vmlinux file is not named vmlinux-\u0026lt;version\u003e, but simply vmlinux. And this is not reflected in STRIP_KEEP_SYMTAB we set. So fix this by removing the dash...\n- rpm/kernel-binary.spec: Use only non-empty certificates.\n- rpm/kernel-obs-build.spec.in: make builds reproducible (bsc#1189305)\n- rpm/kernel-source.rpmlintrc: ignore new include/config files In 5.13, since 0e0345b77ac4, config files have no longer .h suffix. Adapt the zero-length check. Based on Martin Liska's change.\n- rpm/kernel-source.spec.in: do some more for vanilla_only Make sure: * sources are NOT executable * env is not used as interpreter * timestamps are correct We do all this for normal kernel builds, but not for vanilla_only kernels (linux-next and vanilla).\n- rpm: fixup support gz and zst compression methods (bsc#1190428, bsc#1190358). \n- rpm: use _rpmmacrodir (boo#1191384)\n- tty: hvc: replace BUG_ON() with negative return value (git-fixes).\n- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).\n- watchdog: iTCO_wdt: Export vendorsupport (bsc#1177101).\n- watchdog: iTCO_wdt: Make ICH_RES_IO_SMI optional (bsc#1177101).\n- x86/xen: Mark cpu_bringup_and_idle() as dead_end_function (bsc#1169514).\n- xen/blkfront: do not take local copy of a request from the ring page (git-fixes).\n- xen/blkfront: do not trust the backend response data blindly (git-fixes).\n- xen/blkfront: read response from backend only once (git-fixes).\n- xen/netfront: disentangle tx_skb_freelist (git-fixes).\n- xen/netfront: do not read data from request on the ring page (git-fixes).\n- xen/netfront: do not trust the backend response data blindly (git-fixes).\n- xen/netfront: read response from backend only once (git-fixes).\n- xen: sync include/xen/interface/io/ring.h with Xen's newest version (git-fixes).\n- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).\n","status":"published","published":"2022-02-11T07:37:14Z","modified":"2026-02-04T02:44:17.668105Z","updated_at":"2026-11-02T15:53:50.066806Z"}]}}