{"id":"CVE-2019-3837","aliases":["DEBIAN-CVE-2019-3837","EUVD-2019-13457","GHSA-hx7v-466q-33qj","SUSE-SU-2023:0416-1","UBUNTU-CVE-2019-3837"],"status":"published","title":"It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is...","description":"It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00237,"percentile":0.14797,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362","CWE-401"],"published":"2019-04-11T14:37:26Z","modified":"2026-09-21T07:01:19Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["3.13.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["3.13.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["3.13.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux","fixed_in":["3.13.0-40.69"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.4-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4 LTSS EXTREME CORE","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.138.1"}]}],"bundled":62},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4 LTSS EXTREME CORE","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.138.1"}]}],"bundled":62},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4 LTSS EXTREME CORE","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.138.1"}]}],"bundled":62},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4 LTSS EXTREME CORE","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.138.1"}]}],"bundled":62},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4 LTSS EXTREME CORE","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.138.1"}]}],"bundled":62},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4 LTSS EXTREME CORE","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.138.1"}]}],"bundled":62},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-40.69"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66"]}],"products":[{"vendor":"linux","product":"kernel"},{"vendor":"linux","product":"linux_kernel"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"the linux foundation","product":"kernel"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3837","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3837"},{"url":"https://github.com/advisories/GHSA-hx7v-466q-33qj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-3837","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230416-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1055710","tags":["report"]},{"url":"https://bugzilla.suse.com/1084513","tags":["report"]},{"url":"https://bugzilla.suse.com/1131430","tags":["report"]},{"url":"https://bugzilla.suse.com/1133374","tags":["report"]},{"url":"https://bugzilla.suse.com/1154848","tags":["report"]},{"url":"https://bugzilla.suse.com/1166098","tags":["report"]},{"url":"https://bugzilla.suse.com/1173514","tags":["report"]},{"url":"https://bugzilla.suse.com/1177471","tags":["report"]},{"url":"https://bugzilla.suse.com/1191961","tags":["report"]},{"url":"https://bugzilla.suse.com/1196973","tags":["report"]},{"url":"https://bugzilla.suse.com/1197331","tags":["report"]},{"url":"https://bugzilla.suse.com/1197343","tags":["report"]},{"url":"https://bugzilla.suse.com/1197366","tags":["report"]},{"url":"https://bugzilla.suse.com/1197391","tags":["report"]},{"url":"https://bugzilla.suse.com/1198516","tags":["report"]},{"url":"https://bugzilla.suse.com/1198829","tags":["report"]},{"url":"https://bugzilla.suse.com/1199063","tags":["report"]},{"url":"https://bugzilla.suse.com/1199426","tags":["report"]},{"url":"https://bugzilla.suse.com/1199487","tags":["report"]},{"url":"https://bugzilla.suse.com/1199650","tags":["report"]},{"url":"https://bugzilla.suse.com/1199657","tags":["report"]},{"url":"https://bugzilla.suse.com/1200598","tags":["report"]},{"url":"https://bugzilla.suse.com/1200619","tags":["report"]},{"url":"https://bugzilla.suse.com/1200692","tags":["report"]},{"url":"https://bugzilla.suse.com/1200910","tags":["report"]},{"url":"https://bugzilla.suse.com/1201050","tags":["report"]},{"url":"https://bugzilla.suse.com/1201251","tags":["report"]},{"url":"https://bugzilla.suse.com/1201429","tags":["report"]},{"url":"https://bugzilla.suse.com/1201635","tags":["report"]},{"url":"https://bugzilla.suse.com/1201636","tags":["report"]},{"url":"https://bugzilla.suse.com/1201940","tags":["report"]},{"url":"https://bugzilla.suse.com/1201948","tags":["report"]},{"url":"https://bugzilla.suse.com/1202097","tags":["report"]},{"url":"https://bugzilla.suse.com/1202346","tags":["report"]},{"url":"https://bugzilla.suse.com/1202347","tags":["report"]},{"url":"https://bugzilla.suse.com/1202393","tags":["report"]},{"url":"https://bugzilla.suse.com/1202500","tags":["report"]},{"url":"https://bugzilla.suse.com/1202897","tags":["report"]},{"url":"https://bugzilla.suse.com/1202898","tags":["report"]},{"url":"https://bugzilla.suse.com/1202960","tags":["report"]},{"url":"https://bugzilla.suse.com/1203107","tags":["report"]},{"url":"https://bugzilla.suse.com/1203271","tags":["report"]},{"url":"https://bugzilla.suse.com/1203514","tags":["report"]},{"url":"https://bugzilla.suse.com/1203769","tags":["report"]},{"url":"https://bugzilla.suse.com/1203960","tags":["report"]},{"url":"https://bugzilla.suse.com/1203987","tags":["report"]},{"url":"https://bugzilla.suse.com/1204166","tags":["report"]},{"url":"https://bugzilla.suse.com/1204354","tags":["report"]},{"url":"https://bugzilla.suse.com/1204405","tags":["report"]},{"url":"https://bugzilla.suse.com/1204431","tags":["report"]},{"url":"https://bugzilla.suse.com/1204439","tags":["report"]},{"url":"https://bugzilla.suse.com/1204574","tags":["report"]},{"url":"https://bugzilla.suse.com/1204631","tags":["report"]},{"url":"https://bugzilla.suse.com/1204646","tags":["report"]},{"url":"https://bugzilla.suse.com/1204647","tags":["report"]},{"url":"https://bugzilla.suse.com/1204653","tags":["report"]},{"url":"https://bugzilla.suse.com/1204894","tags":["report"]},{"url":"https://bugzilla.suse.com/1204922","tags":["report"]},{"url":"https://bugzilla.suse.com/1205220","tags":["report"]},{"url":"https://bugzilla.suse.com/1205514","tags":["report"]},{"url":"https://bugzilla.suse.com/1205671","tags":["report"]},{"url":"https://bugzilla.suse.com/1205796","tags":["report"]},{"url":"https://bugzilla.suse.com/1206677","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-20132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-20166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-20368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-20369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-33981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3649","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-39188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-40768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-4095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45934","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-3837","tags":["report"]},{"url":"https://seclists.org/oss-sec/2019/q2/7","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3837","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-3837","description":"It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.","status":"published","published":"2019-04-11T14:37:26Z","modified":"2024-08-04T19:19:18.565Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:20:22.701371Z"}],"euvd":[{"id":"EUVD-2019-13457","description":"It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.","status":"published","published":"2019-04-11T14:37:26Z","modified":"2024-08-04T19:19:18Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-03T03:06:54.939848Z"}],"ghsa":[{"id":"GHSA-hx7v-466q-33qj","title":"It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is...","description":"It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.","status":"published","published":"2022-05-13T01:12:23Z","modified":"2023-02-01T05:03:58Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:50:07.322817Z"}],"nvd":[{"id":"CVE-2019-3837","description":"It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.","status":"published","published":"2019-04-11T15:29:00.447Z","modified":"2026-06-17T02:35:41.64Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"primary"},{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-362","CWE-401"],"updated_at":"2026-11-02T14:05:11.426883Z"}],"osv":[{"id":"CVE-2019-3837","description":"It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.","status":"published","published":"2019-04-11T15:29:00.447Z","modified":"2026-03-14T09:38:10.753078Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-3837","description":"It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.","status":"published","published":"2019-04-11T15:29:00.447Z","modified":"2026-09-21T07:01:19.968123426Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"UBUNTU-CVE-2019-3837","description":"It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.","status":"published","published":"2019-04-11T15:29:00Z","modified":"2026-04-22T11:57:35.829584Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"},{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"SUSE-SU-2023:0416-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2017-13695: Fixed fix acpi operand cache leak in nseval.c (bsc#1055710).\n- CVE-2018-7755: Fixed bypass of kernel security protections such as KASLR using fd_locked_ioctl function in drivers/block/floppy.c (bnc#1084513).\n- CVE-2019-3837: Fixed memory leak due to thread-unsafe implementation of the net_dma code in tcp_recvmsg() (bnc#1131430).\n- CVE-2019-3900: Fixed infinite loop while receiving packets in vhost_net (bnc#1133374).\n- CVE-2020-15393: Fixed memory leak in usbtest_disconnect in drivers/usb/misc/usbtest.c (bnc#1173514).\n- CVE-2020-16119: Fixed use-after-free exploitable by a local attacker due to reuse of a DCCP socket (bnc#1177471).\n- CVE-2020-36557: Fixed race condition in the VT_DISALLOCATE ioctl and closing/opening of ttys which could lead to a use-after-free (bnc#1201429).\n- CVE-2020-36558: Fixed race condition in VT_RESIZEX (bsc#1200910).\n- CVE-2021-26341: Fixed vulnerablity where some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bnc#1201050).\n- CVE-2021-33655: When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds (bnc#1201635).\n- CVE-2021-33656: Fixed memory out of bounds write when setting font with malicous data by ioctl cmd PIO_FONT (bnc#1201636).\n- CVE-2021-34981: Fixed file refcounter in bluetooth cmtp when cmtp_attach_device fails (bsc#1191961).\n- CVE-2021-39713: Fixed race condition in the network scheduling subsystem which could lead to a use-after-free (bsc#1196973).\n- CVE-2021-45868: Fixed use-after-free in fs/quota/quota_tree.c (bnc#1197366).\n- CVE-2022-1011: Fixed UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (bsc#1197343).\n- CVE-2022-1048: Fixed potential AB/BA lock with buffer_mutex and mmap_lock (bsc#1197331).\n- CVE-2022-1353: Fixed denial of service in the pfkey_register function in net/key/af_key.c (bnc#1198516).\n- CVE-2022-1462: Fixed out-of-bounds read in the TeleTYpe subsystem allowing local user to crash the system or read unauthorized random data from memory (bnc#1198829).\n- CVE-2022-1652: Fixed use after free in floppy (bsc#1199063).\n- CVE-2022-1679: Fixed use-after-free in the atheros wireless adapter driver (bnc#1199487).\n- CVE-2022-20132: Fixed out of bounds read in lg_probe and related functions of hid-lg.c and other USB HID files (bnc#1200619).\n- CVE-2022-20166: Fixed out of bounds write due to a heap buffer overflow which could lead to local escalation of privilege with System execution privileges needed (bnc#1200598).\n- CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bnc#1202346).\n- CVE-2022-20369: Fixed out of bounds write due to improper input validation in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).\n- CVE-2022-21166, CVE-2022-21127, CVE-2022-21123, CVE-2022-21125, CVE-2022-21180: Fixed stale MMIO data transient information leaks (INTEL-TA-00615) (bnc#1199650).\n- CVE-2022-21385: Fixed warn in rds_message_alloc_sgs (bnc#1202897).\n- CVE-2022-21499: Fixed issue where it was trivial to break out of lockdown using kgdb (bsc#1199426).\n- CVE-2022-2318: Fixed use-after-free caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges (bnc#1201251).\n- CVE-2022-2663: Fixed possible firewall bypass when users are using unencrypted IRC due to message handling confusion in nf_conntrack_irc (bnc#1202097).\n- CVE-2022-28356: Fixed refcount leak bug in net/llc/af_llc.c (bnc#1197391).\n- CVE-2022-29900: Fixed mis-trained branch predictions for return instructions that may have allowed arbitrary speculative code execution under certain microarchitecture-dependent conditions (bnc#1199657).\n- CVE-2022-29901: Fixed vulnerability where an attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions (bnc#1199657).\n- CVE-2022-3028: Fixed a race condition in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously (bnc#1202898).\n- CVE-2022-3303: Fixed race condition in the sound subsystem due to improper locking (bnc#1203769).\n- CVE-2022-33981: Fixed denial of service in drivers/block/floppy.c (bnc#1200692).\n- CVE-2022-3424: Fixed use-after-free in gru_set_context_option leading to kernel panic (bnc#1204166).\n- CVE-2022-3524: Fixed memory leak in ipv6_renew_options of the component IPv6 Handler (bnc#1204354).\n- CVE-2022-3565: Fixed use-after-free in del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth (bnc#1204431).\n- CVE-2022-3566: Fixed race condition in the TCP Handler (bnc#1204405).\n- CVE-2022-3586: Fixed use-after-free in the sch_sfb enqueue function (bnc#1204439).\n- CVE-2022-3621: Fixed null pointer dereference in fs/nilfs2/inode.c of the component nilfs2 (bnc#1204574).\n- CVE-2022-3635: Fixed use-after-free in IPsec (bnc#1204631).\n- CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer of the file fs/nilfs2/segment.c of the component BPF (bnc#1204646).\n- CVE-2022-3649: Fixed use-after-free in nilfs_new_inode of the file fs/nilfs2/inode.c (bnc#1204647).\n- CVE-2022-36879: Fixed double refcount drop in xfrm_expand_policies in net/xfrm/xfrm_policy.c (bnc#1201948).\n- CVE-2022-36946: Fixed denial of service in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (bnc#1201940).\n- CVE-2022-3903: Fixed incorrect read request flaw in the Infrared Transceiver USB driver (bnc#1205220).\n- CVE-2022-39188: Fixed TLB flush for PFNMAP mappings before unlink_file_vma() (bsc#1203107).\n- CVE-2022-40768: Fixed information leak in drivers/scsi/stex.c (bnc#1203514).\n- CVE-2022-4095: Fixed use-after-free in rtl8712 (bsc#1205514).\n- CVE-2022-41218: Fixed use-after-free in drivers/media/dvb-core/dmxdev.c (bnc#1202960).\n- CVE-2022-41848: Fixed use-after-free in drivers/char/pcmcia/synclink_cs.c (bnc#1203987).\n- CVE-2022-41850: Fixed use-after-free in roccat_report_event in drivers/hid/hid-roccat.c (bnc#1203960).\n- CVE-2022-41858: Fixed NULL pointer dereference in drivers/net/slip/slip.c (bnc#1205671).\n- CVE-2022-43750: Fixed memory corruption in drivers/usb/mon/mon_bin.c (bnc#1204653).\n- CVE-2022-44032: Fixed race condition in drivers/char/pcmcia/cm4000_cs.c (bnc#1204894).\n- CVE-2022-44033: Fixed use-after-free in drivers/char/pcmcia/cm4040_cs.c (bnc#1204922).\n- CVE-2022-45934: Fixed integer wraparound in net/bluetooth/l2cap_core.c (bnc#1205796).\n\nThe following non-security bugs were fixed:\n\n- Fail if no bound addresses can be used for a given scope (bsc#1206677).\n- Fixed missing check on handle in net_sched cls_route (bsc#1202393).\n- Trim skb to alloc size to avoid MSG_TRUNC (bsc#1166098).\n- Fixed confusing boot logging with Skylake on RETBLEED kernel (bsc#1202500).\n- Fixed retbleed performance issues (bsc#1203271).\n\n","status":"published","published":"2023-02-15T09:48:18Z","modified":"2026-02-04T03:36:28.138845Z","updated_at":"2026-11-02T15:53:51.853735Z"}]}}