{"id":"CVE-2021-47162","aliases":["DEBIAN-CVE-2021-47162","EUVD-2021-33810","GHSA-86fr-x2qv-cxp5","OESA-2024-1483","OESA-2024-1484","SUSE-SU-2024:1643-1","SUSE-SU-2024:1646-1","SUSE-SU-2024:1870-1","SUSE-SU-2024:1979-1","SUSE-SU-2024:1983-1","SUSE-SU-2024:2184-1","SUSE-SU-2024:4367-1","SUSE-SU-2025:0035-1","UBUNTU-CVE-2021-47162"],"status":"published","title":"tipc: skb_linearize the head skb when reassembling msgs","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: skb_linearize the head skb when reassembling msgs\n\nIt's not a good idea to append the frag skb to a skb's frag_list if\nthe frag_list already has skbs from elsewhere, such as this skb was\ncreated by pskb_copy() where the frag_list was cloned (all the skbs\nin it were skb_get'ed) and shared by multiple skbs.\n\nHowever, the new appended frag skb should have been only seen by the\ncurrent skb. Otherwise, it will cause use after free crashes as this\nappended frag skb are seen by multiple skbs but it only got skb_get\ncalled once.\n\nThe same thing happens with a skb updated by pskb_may_pull() with a\nskb_cloned skb. Li Shuang has reported quite a few crashes caused\nby this when doing testing over macvlan devices:\n\n  [] kernel BUG at net/core/skbuff.c:1970!\n  [] Call Trace:\n  []  skb_clone+0x4d/0xb0\n  []  macvlan_broadcast+0xd8/0x160 [macvlan]\n  []  macvlan_process_broadcast+0x148/0x150 [macvlan]\n  []  process_one_work+0x1a7/0x360\n  []  worker_thread+0x30/0x390\n\n  [] kernel BUG at mm/usercopy.c:102!\n  [] Call Trace:\n  []  __check_heap_object+0xd3/0x100\n  []  __check_object_size+0xff/0x16b\n  []  simple_copy_to_iter+0x1c/0x30\n  []  __skb_datagram_iter+0x7d/0x310\n  []  __skb_datagram_iter+0x2a5/0x310\n  []  skb_copy_datagram_iter+0x3b/0x90\n  []  tipc_recvmsg+0x14a/0x3a0 [tipc]\n  []  ____sys_recvmsg+0x91/0x150\n  []  ___sys_recvmsg+0x7b/0xc0\n\n  [] kernel BUG at mm/slub.c:305!\n  [] Call Trace:\n  []  \u003cIRQ\u003e\n  []  kmem_cache_free+0x3ff/0x400\n  []  __netif_receive_skb_core+0x12c/0xc40\n  []  ? kmem_cache_alloc+0x12e/0x270\n  []  netif_receive_skb_internal+0x3d/0xb0\n  []  ? get_rx_page_info+0x8e/0xa0 [be2net]\n  []  be_poll+0x6ef/0xd00 [be2net]\n  []  ? irq_exit+0x4f/0x100\n  []  net_rx_action+0x149/0x3b0\n\n  ...\n\nThis patch is to fix it by linearizing the head skb if it has frag_list\nset in tipc_buf_append(). Note that we choose to do this before calling\nskb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can\nnot just drop the frag_list either as the early time.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00744,"percentile":0.55094,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2024-03-25T09:16:15Z","modified":"2026-11-06T13:49:20Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["5.14.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["5.14.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["5.14.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"linux-azure","fixed_in":["4.15.0-1121.134~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-aws-hwe","fixed_in":["4.15.0-1109.116~16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-azure","fixed_in":["4.15.0-1121.134~16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-gcp","fixed_in":["4.15.0-1106.120~16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-hwe","fixed_in":["4.15.0-151.157~16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-oracle","fixed_in":["4.15.0-1078.86~16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux","fixed_in":["4.15.0-151.157"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws","fixed_in":["4.15.0-1109.116"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.4","fixed_in":["5.4.0-1054.57~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-4.15","fixed_in":["4.15.0-1121.134"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.4","fixed_in":["5.4.0-1055.57~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-4.15","fixed_in":["4.15.0-1106.120"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.4","fixed_in":["5.4.0-1049.53~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-5.4","fixed_in":["5.4.0-80.90~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-kvm","fixed_in":["4.15.0-1097.99"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle","fixed_in":["4.15.0-1078.86"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.4","fixed_in":["5.4.0-1052.56~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-raspi-5.4","fixed_in":["5.4.0-1041.45~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"linux-aws-fips","fixed_in":["4.15.0-2051.53"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"linux-azure-fips","fixed_in":["4.15.0-2033.37"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"linux-fips","fixed_in":["4.15.0-1066.75"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"linux-gcp-fips","fixed_in":["4.15.0-2016.18"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux","fixed_in":["5.4.0-80.90"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws","fixed_in":["5.4.0-1054.57"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure","fixed_in":["5.4.0-1055.57"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-bluefield","fixed_in":["5.4.0-1016.19"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp","fixed_in":["5.4.0-1049.53"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","fixed_in":["5.4.0-1021.22"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-kvm","fixed_in":["5.4.0-1044.46"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle","fixed_in":["5.4.0-1052.56"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi","fixed_in":["5.4.0-1041.45"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-aws-fips","fixed_in":["5.4.0-1069.73+fips2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-azure-fips","fixed_in":["5.4.0-1073.76+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-fips","fixed_in":["5.4.0-1031.36"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-gcp-fips","fixed_in":["5.4.0-1067.71~20.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.6-1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.90-2404.2.0.0246.oe1"}]}],"bundled":46},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.90-2404.2.0.0273.oe2003sp4"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.182.1"}]}],"bundled":201},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.182.1"}]}],"bundled":201},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.182.1"}]}],"bundled":201},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.182.1"}]}],"bundled":201},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.182.1"}]}],"bundled":201},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.182.1"}]}],"bundled":201},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 12 SP5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-10.182.1"}]}],"bundled":187},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 12 SP5","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-10.182.1"}]}],"bundled":187},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 12 SP5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-10.182.1"}]}],"bundled":187},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 12 SP5","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-10.182.1"}]}],"bundled":187},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.216.1"}]}],"bundled":193},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.216.1"}]}],"bundled":193},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12 SP5","package":"kgraft-patch-SLE12-SP5_Update_56","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-8.3.1"}]}],"bundled":193},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.216.1"}]}],"bundled":193},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.216.1"}]}],"bundled":193},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.216.1"}]}],"bundled":193},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.216.1"}]}],"bundled":193},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.216.1"}]}],"bundled":193},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.216.1"}]}],"bundled":193},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.216.1"}]}],"bundled":193},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.216.1"}]}],"bundled":193},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.216.1"}]}],"bundled":193},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.188.1"}]}],"bundled":180},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.188.1"}]}],"bundled":180},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.188.1"}]}],"bundled":180},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.188.1"}]}],"bundled":180},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.188.1"}]}],"bundled":180},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-16.188.1"}]}],"bundled":180},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 12 SP5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-10.188.1"}]}],"bundled":199},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 12 SP5","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-10.188.1"}]}],"bundled":199},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 12 SP5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-10.188.1"}]}],"bundled":199},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 12 SP5","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-10.188.1"}]}],"bundled":199},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.219.1"}]}],"bundled":198},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.219.1"}]}],"bundled":198},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12 SP5","package":"kgraft-patch-SLE12-SP5_Update_57","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-8.3.1"}]}],"bundled":198},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.219.1"}]}],"bundled":198},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.219.1"}]}],"bundled":198},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.219.1"}]}],"bundled":198},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.219.1"}]}],"bundled":198},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.219.1"}]}],"bundled":198},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.219.1"}]}],"bundled":198},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.219.1"}]}],"bundled":198},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.219.1"}]}],"bundled":198},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.219.1"}]}],"bundled":198},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.237.1"}]}],"bundled":75},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12 SP5","package":"kgraft-patch-SLE12-SP5_Update_63","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-8.3.1"}]}],"bundled":75},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.237.1"}]}],"bundled":75},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.237.1"}]}],"bundled":75},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.237.1"}]}],"bundled":75},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.237.1"}]}],"bundled":75},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.237.1"}]}],"bundled":75},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-122.237.1"}]}],"bundled":75},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1121.134~14.04.1"}]}],"versions":["4.15.0-1023.24~14.04.1","4.15.0-1030.31~14.04.1","4.15.0-1031.32~14.04.1","4.15.0-1032.33~14.04.2","4.15.0-1035.36~14.04.2","4.15.0-1036.38~14.04.2","4.15.0-1037.39~14.04.2","4.15.0-1039.41~14.04.2","4.15.0-1040.44~14.04.1","4.15.0-1041.45~14.04.1","4.15.0-1042.46~14.04.1","4.15.0-1045.49~14.04.1","4.15.0-1046.50~14.04.1","4.15.0-1047.51~14.04.1","4.15.0-1049.54~14.04.1","4.15.0-1050.55~14.04.1","4.15.0-1051.56~14.04.1","4.15.0-1052.57~14.04.1","4.15.0-1055.60~14.04.1","4.15.0-1056.61~14.04.1","4.15.0-1057.62~14.04.1","4.15.0-1059.64~14.04.1","4.15.0-1060.65~14.04.1","4.15.0-1061.66~14.04.1","4.15.0-1063.68~14.04.1","4.15.0-1064.69~14.04.1","4.15.0-1066.71~14.04.1","4.15.0-1067.72~14.04.1","4.15.0-1069.74~14.04.1","4.15.0-1071.76~14.04.1","4.15.0-1074.79~14.04.1","4.15.0-1077.82~14.04.1","4.15.0-1082.92~14.04.1","4.15.0-1083.93~14.04.1","4.15.0-1089.99~14.04.1","4.15.0-1091.101~14.04.1","4.15.0-1092.102~14.04.1","4.15.0-1093.103~14.04.1","4.15.0-1095.105~14.04.1","4.15.0-1096.106~14.04.1","4.15.0-1098.109~14.04.1","4.15.0-1100.111~14.04.1","4.15.0-1102.113~14.04.1","4.15.0-1103.114~14.04.1","4.15.0-1106.118~14.04.1","4.15.0-1108.120~14.04.1","4.15.0-1109.121~14.04.1","4.15.0-1110.122~14.04.1","4.15.0-1111.123~14.04.1","4.15.0-1112.124~14.04.1","4.15.0-1113.126~14.04.1","4.15.0-1114.127~14.04.1","4.15.0-1115.128~14.04.1","4.15.0-1118.131~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-1002.2","4.4.0-1003.3","4.4.0-1005.5","4.4.0-1006.6","4.4.0-1009.9","4.4.0-1010.10","4.4.0-1011.11","4.4.0-1012.12","4.4.0-1014.14","4.4.0-1016.16","4.4.0-1017.17","4.4.0-1019.19","4.4.0-1022.22","4.4.0-1023.23","4.4.0-1024.25","4.4.0-1025.26","4.4.0-1027.30","4.4.0-1028.31","4.4.0-1029.32","4.4.0-1031.34","4.4.0-1032.35","4.4.0-1034.37","4.4.0-1036.39","4.4.0-1037.40","4.4.0-1038.41","4.4.0-1039.42","4.4.0-1040.43","4.4.0-1042.45","4.4.0-1044.47","4.4.0-1045.48","4.4.0-1046.50","4.4.0-1048.52","4.4.0-1050.54","4.4.0-1052.56","4.4.0-1054.58","4.4.0-1055.59","4.4.0-1056.60","4.4.0-1058.62","4.4.0-1059.63","4.4.0-1060.64","4.4.0-1061.65","4.4.0-1062.66","4.4.0-1064.68","4.4.0-1065.69","4.4.0-1066.70","4.4.0-1067.71","4.4.0-1073.77","4.4.0-1074.78","4.4.0-1075.79","4.4.0-1076.80","4.4.0-1077.81","4.4.0-1078.82","4.4.0-1081.85","4.4.0-1082.86","4.4.0-1083.87","4.4.0-1085.89","4.4.0-1086.90","4.4.0-1087.91","4.4.0-1088.92","4.4.0-1090.94","4.4.0-1091.95","4.4.0-1092.96","4.4.0-1093.97","4.4.0-1094.99","4.4.0-1095.100","4.4.0-1096.101","4.4.0-1097.102","4.4.0-1098.103","4.4.0-1099.104","4.4.0-1101.106","4.4.0-1102.107","4.4.0-1103.108","4.4.0-1104.109","4.4.0-1107.113","4.4.0-1109.115","4.4.0-1110.116","4.4.0-1111.117","4.4.0-1112.118","4.4.0-1113.119","4.4.0-1114.120","4.4.0-1115.121","4.4.0-1116.122","4.4.0-1117.123","4.4.0-1118.124","4.4.0-1119.125","4.4.0-1120.126","4.4.0-1121.127","4.4.0-1122.128","4.4.0-1123.129","4.4.0-1124.130","4.4.0-1125.131","4.4.0-1127.133","4.4.0-1128.134","4.4.0-1129.135","4.4.0-1130.136","4.4.0-1131.137","4.4.0-1133.139","4.4.0-1134.140","4.4.0-1135.141","4.4.0-1136.142","4.4.0-1137.143","4.4.0-1138.144","4.4.0-1139.145","4.4.0-1140.146","4.4.0-1141.147","4.4.0-1142.148","4.4.0-1143.149","4.4.0-1144.150","4.4.0-1145.151","4.4.0-1146.152","4.4.0-1147.153","4.4.0-1148.154","4.4.0-1149.155","4.4.0-1150.156","4.4.0-1151.157","4.4.0-1152.158","4.4.0-1153.159","4.4.0-1154.160","4.4.0-1155.161","4.4.0-1156.162","4.4.0-1157.163","4.4.0-1158.164","4.4.0-1159.165","4.4.0-1160.166","4.4.0-1161.167","4.4.0-1162.168"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1","4.4.0-36.55~14.04.1","4.4.0-38.57~14.04.1","4.4.0-42.62~14.04.1","4.4.0-45.66~14.04.1","4.4.0-47.68~14.04.1","4.4.0-51.72~14.04.1","4.4.0-53.74~14.04.1","4.4.0-57.78~14.04.1","4.4.0-59.80~14.04.1","4.4.0-62.83~14.04.1","4.4.0-63.84~14.04.2","4.4.0-64.85~14.04.1","4.4.0-66.87~14.04.1","4.4.0-67.88~14.04.1","4.4.0-70.91~14.04.1","4.4.0-71.92~14.04.1","4.4.0-72.93~14.04.1","4.4.0-75.96~14.04.1","4.4.0-78.99~14.04.2","4.4.0-79.100~14.04.1","4.4.0-81.104~14.04.1","4.4.0-83.106~14.04.1","4.4.0-87.110~14.04.1","4.4.0-89.112~14.04.1","4.4.0-91.114~14.04.1","4.4.0-92.115~14.04.1","4.4.0-93.116~14.04.1","4.4.0-96.119~14.04.1","4.4.0-97.120~14.04.1","4.4.0-98.121~14.04.1","4.4.0-101.124~14.04.1","4.4.0-103.126~14.04.1","4.4.0-104.127~14.04.1","4.4.0-108.131~14.04.1","4.4.0-109.132~14.04.1","4.4.0-111.134~14.04.1","4.4.0-112.135~14.04.1","4.4.0-116.140~14.04.1","4.4.0-119.143~14.04.1","4.4.0-121.145~14.04.1","4.4.0-124.148~14.04.1","4.4.0-127.153~14.04.1","4.4.0-128.154~14.04.1","4.4.0-130.156~14.04.1","4.4.0-131.157~14.04.1","4.4.0-133.159~14.04.1","4.4.0-134.160~14.04.1","4.4.0-135.161~14.04.1","4.4.0-137.163~14.04.1","4.4.0-138.164~14.04.1","4.4.0-139.165~14.04.1","4.4.0-140.166~14.04.1","4.4.0-141.167~14.04.1","4.4.0-142.168~14.04.1","4.4.0-143.169~14.04.2","4.4.0-144.170~14.04.1","4.4.0-146.172~14.04.1","4.4.0-148.174~14.04.1","4.4.0-150.176~14.04.1","4.4.0-151.178~14.04.1","4.4.0-154.181~14.04.1","4.4.0-157.185~14.04.1","4.4.0-159.187~14.04.1","4.4.0-161.189~14.04.1","4.4.0-164.192~14.04.1","4.4.0-165.193~14.04.1","4.4.0-166.195~14.04.1","4.4.0-168.197~14.04.1","4.4.0-169.198~14.04.1","4.4.0-170.199~14.04.1","4.4.0-171.200~14.04.1","4.4.0-173.203~14.04.1","4.4.0-174.204~14.04.1","4.4.0-176.206~14.04.1","4.4.0-177.207~14.04.1","4.4.0-178.208~14.04.1","4.4.0-179.209~14.04.1","4.4.0-184.214~14.04.1","4.4.0-185.215~14.04.1","4.4.0-186.216~14.04.1","4.4.0-187.217~14.04.1","4.4.0-189.219~14.04.1","4.4.0-190.220~14.04.1","4.4.0-193.224~14.04.1","4.4.0-194.226~14.04.1","4.4.0-197.229~14.04.1","4.4.0-198.230~14.04.1","4.4.0-200.232~14.04.1","4.4.0-201.233~14.04.1","4.4.0-203.235~14.04.1","4.4.0-204.236~14.04.1","4.4.0-206.238~14.04.1","4.4.0-208.240~14.04.1","4.4.0-209.241~14.04.1","4.4.0-210.242~14.04.1","4.4.0-211.243~14.04.1","4.4.0-212.244~14.04.1","4.4.0-213.245~14.04.1","4.4.0-214.246~14.04.1","4.4.0-215.247~14.04.1","4.4.0-218.251~14.04.1","4.4.0-219.252~14.04.1","4.4.0-221.254~14.04.1","4.4.0-222.255~14.04.1","4.4.0-223.256~14.04.1","4.4.0-224.257~14.04.1","4.4.0-227.261~14.04.1","4.4.0-229.263~14.04.1","4.4.0-230.264~14.04.1","4.4.0-231.265~14.04.1","4.4.0-233.267~14.04.1","4.4.0-234.268~14.04.1","4.4.0-235.269~14.04.1","4.4.0-236.270~14.04.1","4.4.0-237.271~14.04.1","4.4.0-239.273~14.04.1","4.4.0-240.274~14.04.1","4.4.0-241.275~14.04.1","4.4.0-242.276~14.04.1","4.4.0-243.277~14.04.1","4.4.0-244.278~14.04.1","4.4.0-245.279~14.04.1","4.4.0-246.280~14.04.1","4.4.0-248.282~14.04.1","4.4.0-250.284~14.04.1","4.4.0-251.285~14.04.1","4.4.0-252.286~14.04.1","4.4.0-253.287~14.04.1","4.4.0-254.288~14.04.1","4.4.0-256.290~14.04.1","4.4.0-257.291~14.04.1","4.4.0-258.292~14.04.2","4.4.0-259.293~14.04.1","4.4.0-260.294~14.04.1","4.4.0-261.295~14.04.1","4.4.0-262.296~14.04.1","4.4.0-263.297~14.04.1","4.4.0-264.298~14.04.1","4.4.0-266.300~14.04.1","4.4.0-267.301~14.04.1","4.4.0-268.302~14.04.1","4.4.0-269.303~14.04.1","4.4.0-270.304~14.04.1","4.4.0-271.305~14.04.1","4.4.0-272.306~14.04.1","4.4.0-273.307~14.04.1","4.4.0-274.308~14.04.1","4.4.0-276.310~14.04.1","4.4.0-277.311~14.04.1","4.4.0-278.312~14.04.1","4.4.0-279.313~14.04.1","4.4.0-280.314~14.04.1","4.4.0-281.315~14.04.1","4.4.0-283.317~14.04.1","4.4.0-284.318~14.04.1","4.4.0-287.321~14.04.1","4.4.0-288.322~14.04.1","4.4.0-289.323~14.04.1","4.4.0-290.324~14.04.1","4.4.0-291.325~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-aws-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1109.116~16.04.1"}]}],"versions":["4.15.0-1030.31~16.04.1","4.15.0-1031.33~16.04.1","4.15.0-1032.34~16.04.1","4.15.0-1033.35~16.04.1","4.15.0-1035.37~16.04.1","4.15.0-1036.38~16.04.1","4.15.0-1039.41~16.04.1","4.15.0-1040.42~16.04.1","4.15.0-1041.43~16.04.1","4.15.0-1043.45~16.04.1","4.15.0-1044.46~16.04.1","4.15.0-1045.47~16.04.1","4.15.0-1047.49~16.04.1","4.15.0-1048.50~16.04.1","4.15.0-1050.52~16.04.1","4.15.0-1051.53~16.04.1","4.15.0-1052.54~16.04.1","4.15.0-1054.56~16.04.1","4.15.0-1056.58~16.04.1","4.15.0-1057.59~16.04.1","4.15.0-1058.60~16.04.1","4.15.0-1060.62~16.04.1","4.15.0-1063.67~16.04.1","4.15.0-1065.69~16.04.1","4.15.0-1066.70~16.04.1","4.15.0-1067.71~16.04.1","4.15.0-1073.77~16.04.1","4.15.0-1074.78~16.04.1","4.15.0-1079.83~16.04.1","4.15.0-1080.84~16.04.1","4.15.0-1082.86~16.04.1","4.15.0-1083.87~16.04.1","4.15.0-1085.90~16.04.1","4.15.0-1088.93~16.04.1","4.15.0-1090.95~16.04.1","4.15.0-1091.96~16.04.1","4.15.0-1093.99~16.04.1","4.15.0-1094.101~16.04.1","4.15.0-1095.102~16.04.1","4.15.0-1096.103~16.04.1","4.15.0-1097.104~16.04.1","4.15.0-1098.105~16.04.1","4.15.0-1099.106~16.04.1","4.15.0-1102.109~16.04.1","4.15.0-1103.110~16.04.1","4.15.0-1106.113~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1121.134~16.04.1"}]}],"versions":["4.11.0-1009.9","4.11.0-1011.11","4.11.0-1013.13","4.11.0-1014.14","4.11.0-1015.15","4.11.0-1016.16","4.13.0-1005.7","4.13.0-1006.8","4.13.0-1007.9","4.13.0-1009.12","4.13.0-1011.14","4.13.0-1012.15","4.13.0-1014.17","4.13.0-1016.19","4.13.0-1018.21","4.15.0-1013.13~16.04.2","4.15.0-1014.14~16.04.1","4.15.0-1018.18~16.04.1","4.15.0-1019.19~16.04.1","4.15.0-1021.21~16.04.1","4.15.0-1022.22~16.04.1","4.15.0-1023.24~16.04.1","4.15.0-1025.26~16.04.1","4.15.0-1028.29~16.04.1","4.15.0-1030.31~16.04.1","4.15.0-1031.32~16.04.1","4.15.0-1032.33~16.04.1","4.15.0-1035.36~16.04.1","4.15.0-1036.38~16.04.1","4.15.0-1037.39~16.04.1","4.15.0-1039.43","4.15.0-1040.44","4.15.0-1041.45","4.15.0-1042.46","4.15.0-1045.49","4.15.0-1046.50","4.15.0-1047.51","4.15.0-1049.54","4.15.0-1050.55","4.15.0-1051.56","4.15.0-1052.57","4.15.0-1055.60","4.15.0-1056.61","4.15.0-1057.62","4.15.0-1059.64","4.15.0-1060.65","4.15.0-1061.66","4.15.0-1063.68","4.15.0-1064.69","4.15.0-1066.71","4.15.0-1067.72","4.15.0-1069.74","4.15.0-1071.76","4.15.0-1075.80","4.15.0-1077.82","4.15.0-1082.92~16.04.1","4.15.0-1083.93~16.04.1","4.15.0-1089.99~16.04.1","4.15.0-1091.101~16.04.1","4.15.0-1092.102~16.04.1","4.15.0-1093.103~16.04.1","4.15.0-1095.105~16.04.1","4.15.0-1096.106~16.04.1","4.15.0-1098.109~16.04.1","4.15.0-1100.111~16.04.1","4.15.0-1102.113~16.04.1","4.15.0-1103.114~16.04.1","4.15.0-1106.118~16.04.1","4.15.0-1108.120~16.04.1","4.15.0-1109.121~16.04.1","4.15.0-1110.122~16.04.1","4.15.0-1111.123~16.04.1","4.15.0-1112.124~16.04.1","4.15.0-1113.126~16.04.1","4.15.0-1114.127~16.04.1","4.15.0-1115.128~16.04.1","4.15.0-1118.131~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1106.120~16.04.1"}]}],"versions":["4.10.0-1004.4","4.10.0-1006.6","4.10.0-1007.7","4.10.0-1008.8","4.10.0-1009.9","4.13.0-1002.5","4.13.0-1006.9","4.13.0-1007.10","4.13.0-1008.11","4.13.0-1011.15","4.13.0-1012.16","4.13.0-1013.17","4.13.0-1015.19","4.13.0-1017.21","4.13.0-1019.23","4.15.0-1014.14~16.04.1","4.15.0-1015.15~16.04.1","4.15.0-1017.18~16.04.1","4.15.0-1018.19~16.04.2","4.15.0-1019.20~16.04.1","4.15.0-1021.22~16.04.1","4.15.0-1023.24~16.04.1","4.15.0-1024.25~16.04.2","4.15.0-1025.26~16.04.1","4.15.0-1026.27~16.04.1","4.15.0-1027.28~16.04.1","4.15.0-1028.29~16.04.1","4.15.0-1029.31~16.04.1","4.15.0-1030.32~16.04.1","4.15.0-1032.34~16.04.1","4.15.0-1033.35~16.04.1","4.15.0-1034.36~16.04.1","4.15.0-1036.38~16.04.1","4.15.0-1037.39~16.04.1","4.15.0-1040.42~16.04.1","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1046.49","4.15.0-1047.50","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.56","4.15.0-1055.59","4.15.0-1058.62","4.15.0-1060.64","4.15.0-1061.65","4.15.0-1071.81~16.04.1","4.15.0-1077.87~16.04.1","4.15.0-1078.88~16.04.1","4.15.0-1080.90~16.04.1","4.15.0-1081.92~16.04.1","4.15.0-1083.94~16.04.1","4.15.0-1084.95~16.04.1","4.15.0-1086.98~16.04.1","4.15.0-1087.100~16.04.1","4.15.0-1088.101~16.04.1","4.15.0-1090.103~16.04.1","4.15.0-1091.104~16.04.1","4.15.0-1092.105~16.04.1","4.15.0-1093.106~16.04.1","4.15.0-1094.107~16.04.1","4.15.0-1095.108~16.04.1","4.15.0-1096.109~16.04.1","4.15.0-1097.110~16.04.1","4.15.0-1098.111~16.04.1","4.15.0-1099.112~16.04.1","4.15.0-1100.113~16.04.1","4.15.0-1103.116~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-151.157~16.04.1"}]}],"versions":["4.8.0-36.36~16.04.1","4.8.0-39.42~16.04.1","4.8.0-41.44~16.04.1","4.8.0-42.45~16.04.1","4.8.0-44.47~16.04.1","4.8.0-45.48~16.04.1","4.8.0-46.49~16.04.1","4.8.0-49.52~16.04.1","4.8.0-51.54~16.04.1","4.8.0-52.55~16.04.1","4.8.0-53.56~16.04.1","4.8.0-54.57~16.04.1","4.8.0-56.61~16.04.1","4.8.0-58.63~16.04.1","4.10.0-27.30~16.04.2","4.10.0-28.32~16.04.2","4.10.0-30.34~16.04.1","4.10.0-32.36~16.04.1","4.10.0-33.37~16.04.1","4.10.0-35.39~16.04.1","4.10.0-37.41~16.04.1","4.10.0-38.42~16.04.1","4.10.0-40.44~16.04.1","4.10.0-42.46~16.04.1","4.13.0-26.29~16.04.2","4.13.0-31.34~16.04.1","4.13.0-32.35~16.04.1","4.13.0-36.40~16.04.1","4.13.0-37.42~16.04.1","4.13.0-38.43~16.04.1","4.13.0-39.44~16.04.1","4.13.0-41.46~16.04.1","4.13.0-43.48~16.04.1","4.13.0-45.50~16.04.1","4.15.0-24.26~16.04.1","4.15.0-29.31~16.04.1","4.15.0-30.32~16.04.1","4.15.0-32.35~16.04.1","4.15.0-33.36~16.04.1","4.15.0-34.37~16.04.1","4.15.0-36.39~16.04.1","4.15.0-38.41~16.04.1","4.15.0-39.42~16.04.1","4.15.0-42.45~16.04.1","4.15.0-43.46~16.04.1","4.15.0-45.48~16.04.1","4.15.0-46.49~16.04.1","4.15.0-47.50~16.04.1","4.15.0-48.51~16.04.1","4.15.0-50.54~16.04.1","4.15.0-51.55~16.04.1","4.15.0-52.56~16.04.1","4.15.0-54.58~16.04.1","4.15.0-55.60~16.04.2","4.15.0-58.64~16.04.1","4.15.0-60.67~16.04.1","4.15.0-62.69~16.04.1","4.15.0-64.73~16.04.1","4.15.0-65.74~16.04.1","4.15.0-66.75~16.04.1","4.15.0-69.78~16.04.1","4.15.0-70.79~16.04.1","4.15.0-72.81~16.04.1","4.15.0-74.83~16.04.1","4.15.0-76.86~16.04.1","4.15.0-88.88~16.04.1","4.15.0-91.92~16.04.1","4.15.0-96.97~16.04.1","4.15.0-99.100~16.04.1","4.15.0-101.102~16.04.1","4.15.0-106.107~16.04.1","4.15.0-107.108~16.04.1","4.15.0-112.113~16.04.1","4.15.0-115.116~16.04.1","4.15.0-117.118~16.04.1","4.15.0-118.119~16.04.1","4.15.0-120.122~16.04.1","4.15.0-122.124~16.04.1","4.15.0-123.126~16.04.1","4.15.0-126.129~16.04.1","4.15.0-128.131~16.04.1","4.15.0-129.132~16.04.1","4.15.0-132.136~16.04.1","4.15.0-133.137~16.04.1","4.15.0-136.140~16.04.1","4.15.0-137.141~16.04.1","4.15.0-139.143~16.04.1","4.15.0-140.144~16.04.1","4.15.0-142.146~16.04.1","4.15.0-143.147~16.04.3","4.15.0-144.148~16.04.1","4.15.0-147.151~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1078.86~16.04.1"}]}],"versions":["4.15.0-1007.9~16.04.1","4.15.0-1008.10~16.04.1","4.15.0-1009.11~16.04.1","4.15.0-1010.12~16.04.1","4.15.0-1011.13~16.04.1","4.15.0-1013.15~16.04.1","4.15.0-1014.16~16.04.1","4.15.0-1015.17~16.04.1","4.15.0-1017.19~16.04.2","4.15.0-1018.20~16.04.1","4.15.0-1021.23~16.04.1","4.15.0-1022.25~16.04.1","4.15.0-1023.26~16.04.1","4.15.0-1025.28~16.04.1","4.15.0-1026.29~16.04.1","4.15.0-1027.30~16.04.1","4.15.0-1029.32~16.04.1","4.15.0-1030.33~16.04.1","4.15.0-1031.34~16.04.1","4.15.0-1033.36~16.04.1","4.15.0-1035.38~16.04.1","4.15.0-1037.41~16.04.1","4.15.0-1038.42~16.04.1","4.15.0-1039.43~16.04.1","4.15.0-1045.49~16.04.1","4.15.0-1046.50~16.04.1","4.15.0-1050.54~16.04.1","4.15.0-1051.55~16.04.1","4.15.0-1053.57~16.04.1","4.15.0-1054.58~16.04.1","4.15.0-1056.61~16.04.1","4.15.0-1058.64~16.04.1","4.15.0-1059.65~16.04.1","4.15.0-1061.67~16.04.1","4.15.0-1062.68~16.04.1","4.15.0-1064.71~16.04.1","4.15.0-1065.73~16.04.1","4.15.0-1066.74~16.04.1","4.15.0-1067.75~16.04.1","4.15.0-1068.76~16.04.1","4.15.0-1069.77~16.04.1","4.15.0-1070.78~16.04.1","4.15.0-1071.79~16.04.1","4.15.0-1072.80~16.04.1","4.15.0-1075.83~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53","4.4.0-36.55","4.4.0-38.57","4.4.0-42.62","4.4.0-43.63","4.4.0-45.66","4.4.0-47.68","4.4.0-51.72","4.4.0-53.74","4.4.0-57.78","4.4.0-59.80","4.4.0-62.83","4.4.0-63.84","4.4.0-64.85","4.4.0-65.86","4.4.0-66.87","4.4.0-67.88","4.4.0-70.91","4.4.0-71.92","4.4.0-72.93","4.4.0-75.96","4.4.0-77.98","4.4.0-78.99","4.4.0-79.100","4.4.0-81.104","4.4.0-83.106","4.4.0-87.110","4.4.0-89.112","4.4.0-91.114","4.4.0-92.115","4.4.0-93.116","4.4.0-96.119","4.4.0-97.120","4.4.0-98.121","4.4.0-101.124","4.4.0-103.126","4.4.0-104.127","4.4.0-108.131","4.4.0-109.132","4.4.0-112.135","4.4.0-116.140","4.4.0-119.143","4.4.0-121.145","4.4.0-122.146","4.4.0-124.148","4.4.0-127.153","4.4.0-128.154","4.4.0-130.156","4.4.0-131.157","4.4.0-133.159","4.4.0-134.160","4.4.0-135.161","4.4.0-137.163","4.4.0-138.164","4.4.0-139.165","4.4.0-140.166","4.4.0-141.167","4.4.0-142.168","4.4.0-143.169","4.4.0-145.171","4.4.0-146.172","4.4.0-148.174","4.4.0-150.176","4.4.0-151.178","4.4.0-154.181","4.4.0-157.185","4.4.0-159.187","4.4.0-161.189","4.4.0-164.192","4.4.0-165.193","4.4.0-166.195","4.4.0-168.197","4.4.0-169.198","4.4.0-170.199","4.4.0-171.200","4.4.0-173.203","4.4.0-174.204","4.4.0-176.206","4.4.0-177.207","4.4.0-178.208","4.4.0-179.209","4.4.0-184.214","4.4.0-185.215","4.4.0-186.216","4.4.0-187.217","4.4.0-189.219","4.4.0-190.220","4.4.0-193.224","4.4.0-194.226","4.4.0-197.229","4.4.0-198.230","4.4.0-200.232","4.4.0-201.233","4.4.0-203.235","4.4.0-204.236","4.4.0-206.238","4.4.0-208.240","4.4.0-209.241","4.4.0-210.242","4.4.0-211.243","4.4.0-212.244","4.4.0-213.245","4.4.0-214.246","4.4.0-216.249","4.4.0-217.250","4.4.0-218.251","4.4.0-219.252","4.4.0-221.254","4.4.0-222.255","4.4.0-223.256","4.4.0-224.257","4.4.0-227.261","4.4.0-229.263","4.4.0-230.264","4.4.0-231.265","4.4.0-233.267","4.4.0-234.268","4.4.0-235.269","4.4.0-236.270","4.4.0-237.271","4.4.0-239.273","4.4.0-240.274","4.4.0-241.275","4.4.0-242.276","4.4.0-243.277","4.4.0-244.278","4.4.0-245.279","4.4.0-246.280","4.4.0-248.282","4.4.0-250.284","4.4.0-251.285","4.4.0-252.286","4.4.0-253.287","4.4.0-254.288","4.4.0-256.290","4.4.0-257.291","4.4.0-258.292","4.4.0-259.293","4.4.0-260.294","4.4.0-261.295","4.4.0-262.296","4.4.0-263.297","4.4.0-264.298","4.4.0-266.300","4.4.0-267.301","4.4.0-268.302","4.4.0-269.303","4.4.0-270.304","4.4.0-271.305","4.4.0-272.306","4.4.0-273.307","4.4.0-274.308","4.4.0-276.310","4.4.0-277.311","4.4.0-278.312","4.4.0-279.313","4.4.0-280.314","4.4.0-281.315","4.4.0-283.317","4.4.0-284.318","4.4.0-287.321","4.4.0-288.322","4.4.0-289.323","4.4.0-290.324","4.4.0-291.325"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-1001.10","4.4.0-1003.12","4.4.0-1004.13","4.4.0-1007.16","4.4.0-1009.18","4.4.0-1011.20","4.4.0-1012.21","4.4.0-1013.22","4.4.0-1016.25","4.4.0-1017.26","4.4.0-1018.27","4.4.0-1020.29","4.4.0-1022.31","4.4.0-1026.35","4.4.0-1028.37","4.4.0-1030.39","4.4.0-1031.40","4.4.0-1032.41","4.4.0-1035.44","4.4.0-1037.46","4.4.0-1038.47","4.4.0-1039.48","4.4.0-1041.50","4.4.0-1043.52","4.4.0-1044.53","4.4.0-1047.56","4.4.0-1048.57","4.4.0-1049.58","4.4.0-1050.59","4.4.0-1052.61","4.4.0-1054.63","4.4.0-1055.64","4.4.0-1057.66","4.4.0-1060.69","4.4.0-1061.70","4.4.0-1062.71","4.4.0-1063.72","4.4.0-1065.75","4.4.0-1066.76","4.4.0-1067.77","4.4.0-1069.79","4.4.0-1070.80","4.4.0-1072.82","4.4.0-1073.83","4.4.0-1074.84","4.4.0-1075.85","4.4.0-1077.87","4.4.0-1079.89","4.4.0-1081.91","4.4.0-1083.93","4.4.0-1084.94","4.4.0-1085.96","4.4.0-1087.98","4.4.0-1088.99","4.4.0-1090.101","4.4.0-1092.103","4.4.0-1094.105","4.4.0-1095.106","4.4.0-1096.107","4.4.0-1098.109","4.4.0-1099.110","4.4.0-1100.111","4.4.0-1101.112","4.4.0-1102.113","4.4.0-1104.115","4.4.0-1105.116","4.4.0-1106.117","4.4.0-1107.118","4.4.0-1109.120","4.4.0-1110.121","4.4.0-1111.123","4.4.0-1112.124","4.4.0-1113.126","4.4.0-1114.127","4.4.0-1117.131","4.4.0-1118.132","4.4.0-1119.133","4.4.0-1121.135","4.4.0-1122.136","4.4.0-1123.137","4.4.0-1124.138","4.4.0-1126.140","4.4.0-1127.141","4.4.0-1128.142","4.4.0-1129.143","4.4.0-1130.144","4.4.0-1131.145","4.4.0-1132.146","4.4.0-1133.147","4.4.0-1134.148","4.4.0-1135.149","4.4.0-1137.151","4.4.0-1138.152","4.4.0-1139.153","4.4.0-1140.154","4.4.0-1143.158","4.4.0-1145.160","4.4.0-1146.161","4.4.0-1147.162","4.4.0-1148.163","4.4.0-1150.165","4.4.0-1151.166","4.4.0-1152.167","4.4.0-1153.168","4.4.0-1154.169","4.4.0-1155.170","4.4.0-1156.171","4.4.0-1157.172","4.4.0-1158.173","4.4.0-1159.174","4.4.0-1160.175","4.4.0-1161.176","4.4.0-1162.177","4.4.0-1163.178","4.4.0-1164.179","4.4.0-1165.180","4.4.0-1166.181","4.4.0-1167.182","4.4.0-1168.183","4.4.0-1169.184","4.4.0-1171.186","4.4.0-1172.187","4.4.0-1173.188","4.4.0-1174.189","4.4.0-1175.190","4.4.0-1176.191","4.4.0-1177.192","4.4.0-1178.193","4.4.0-1179.194","4.4.0-1180.195","4.4.0-1181.196","4.4.0-1182.197","4.4.0-1183.198","4.4.0-1184.199","4.4.0-1185.200","4.4.0-1186.201","4.4.0-1187.202","4.4.0-1188.203","4.4.0-1189.204","4.4.0-1190.205","4.4.0-1191.206","4.4.0-1192.207","4.4.0-1193.208","4.4.0-1194.209","4.4.0-1195.210","4.4.0-1196.211","4.4.0-1197.212","4.4.0-1198.213","4.4.0-1199.214","4.4.0-1200.215"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-1004.9","4.4.0-1007.12","4.4.0-1008.13","4.4.0-1009.14","4.4.0-1010.15","4.4.0-1012.17","4.4.0-1013.18","4.4.0-1015.20","4.4.0-1017.22","4.4.0-1019.24","4.4.0-1020.25","4.4.0-1021.26","4.4.0-1023.28","4.4.0-1026.31","4.4.0-1027.32","4.4.0-1029.34","4.4.0-1031.37","4.4.0-1032.38","4.4.0-1033.39","4.4.0-1035.41","4.4.0-1036.42","4.4.0-1037.43","4.4.0-1038.44","4.4.0-1039.45","4.4.0-1040.46","4.4.0-1041.47","4.4.0-1043.49","4.4.0-1044.50","4.4.0-1046.52","4.4.0-1047.53","4.4.0-1048.55","4.4.0-1051.58","4.4.0-1052.59","4.4.0-1054.61","4.4.0-1056.63","4.4.0-1058.65","4.4.0-1059.66","4.4.0-1060.67","4.4.0-1062.69","4.4.0-1063.70","4.4.0-1064.71","4.4.0-1065.72","4.4.0-1066.73","4.4.0-1068.75","4.4.0-1069.76","4.4.0-1070.77","4.4.0-1071.78","4.4.0-1075.82","4.4.0-1076.83","4.4.0-1077.84","4.4.0-1078.85","4.4.0-1079.86","4.4.0-1080.87","4.4.0-1082.91","4.4.0-1084.93","4.4.0-1085.94","4.4.0-1087.96","4.4.0-1088.97","4.4.0-1089.98","4.4.0-1090.99","4.4.0-1091.100","4.4.0-1092.101","4.4.0-1093.102","4.4.0-1094.103","4.4.0-1095.104","4.4.0-1096.105","4.4.0-1097.106","4.4.0-1098.107","4.4.0-1099.108","4.4.0-1100.109","4.4.0-1102.111","4.4.0-1103.112","4.4.0-1104.113","4.4.0-1105.114","4.4.0-1108.118","4.4.0-1110.120","4.4.0-1111.121","4.4.0-1112.122","4.4.0-1113.123","4.4.0-1114.124","4.4.0-1115.125","4.4.0-1116.126","4.4.0-1117.127","4.4.0-1118.128","4.4.0-1119.129","4.4.0-1120.130","4.4.0-1121.131","4.4.0-1122.132","4.4.0-1123.133","4.4.0-1124.134","4.4.0-1125.135","4.4.0-1126.136","4.4.0-1128.138","4.4.0-1129.139","4.4.0-1130.140","4.4.0-1131.141","4.4.0-1132.142","4.4.0-1134.144","4.4.0-1135.145","4.4.0-1136.146","4.4.0-1137.147","4.4.0-1138.148","4.4.0-1139.149","4.4.0-1140.151","4.4.0-1141.152","4.4.0-1142.153","4.4.0-1143.154","4.4.0-1144.155","4.4.0-1145.156","4.4.0-1146.157","4.4.0-1147.158","4.4.0-1148.159","4.4.0-1149.160","4.4.0-1150.161","4.4.0-1151.162","4.4.0-1152.163","4.4.0-1153.164","4.4.0-1154.165","4.4.0-1155.166","4.4.0-1156.167","4.4.0-1157.168","4.4.0-1158.169","4.4.0-1159.170","4.4.0-1160.171","4.4.0-1161.172","4.4.0-1162.173","4.4.0-1163.174"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:16.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-1003.3","4.4.0-1005.5","4.4.0-1006.6","4.4.0-1008.10","4.4.0-1010.13","4.4.0-1011.14","4.4.0-1012.16","4.4.0-1013.17","4.4.0-1015.20","4.4.0-1017.22","4.4.0-1019.24","4.4.0-1021.26","4.4.0-1022.27","4.4.0-1023.28","4.4.0-1025.30","4.4.0-1026.31","4.4.0-1027.32","4.4.0-1028.33","4.4.0-1029.34","4.4.0-1031.36","4.4.0-1032.37","4.4.0-1033.38","4.4.0-1034.39","4.4.0-1041.46","4.4.0-1042.47","4.4.0-1043.48","4.4.0-1044.49","4.4.0-1045.50","4.4.0-1046.51","4.4.0-1048.53","4.4.0-1049.55","4.4.0-1051.57","4.4.0-1052.58","4.4.0-1054.60","4.4.0-1055.61","4.4.0-1056.62","4.4.0-1057.63","4.4.0-1058.64","4.4.0-1060.66","4.4.0-1061.67","4.4.0-1062.68","4.4.0-1063.69","4.4.0-1064.70","4.4.0-1065.71","4.4.0-1066.72","4.4.0-1067.73","4.4.0-1068.74","4.4.0-1069.75","4.4.0-1071.77","4.4.0-1072.78","4.4.0-1073.79","4.4.0-1074.80","4.4.0-1077.84","4.4.0-1079.86","4.4.0-1080.87","4.4.0-1081.88","4.4.0-1082.89","4.4.0-1083.90","4.4.0-1084.91","4.4.0-1085.92","4.4.0-1086.93","4.4.0-1088.95","4.4.0-1089.96","4.4.0-1090.97","4.4.0-1091.98","4.4.0-1092.99","4.4.0-1093.100","4.4.0-1094.101","4.4.0-1095.102","4.4.0-1097.104","4.4.0-1099.106","4.4.0-1100.107","4.4.0-1101.108","4.4.0-1102.109","4.4.0-1103.110","4.4.0-1104.111","4.4.0-1105.112","4.4.0-1106.113","4.4.0-1107.114","4.4.0-1108.115","4.4.0-1109.116","4.4.0-1110.117","4.4.0-1111.118","4.4.0-1112.119","4.4.0-1113.120","4.4.0-1114.121","4.4.0-1115.122","4.4.0-1116.123","4.4.0-1117.124","4.4.0-1119.126","4.4.0-1120.127","4.4.0-1121.128","4.4.0-1122.129","4.4.0-1123.130","4.4.0-1124.131","4.4.0-1125.132","4.4.0-1126.133","4.4.0-1127.134","4.4.0-1128.135","4.4.0-1129.136","4.4.0-1130.137","4.4.0-1131.138"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:16.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-1001.1","4.4.0-1002.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-151.157"}]}],"versions":["4.13.0-16.19","4.13.0-17.20","4.13.0-25.29","4.13.0-32.35","4.15.0-10.11","4.15.0-12.13","4.15.0-13.14","4.15.0-15.16","4.15.0-19.20","4.15.0-20.21","4.15.0-22.24","4.15.0-23.25","4.15.0-24.26","4.15.0-29.31","4.15.0-30.32","4.15.0-32.35","4.15.0-33.36","4.15.0-34.37","4.15.0-36.39","4.15.0-38.41","4.15.0-39.42","4.15.0-42.45","4.15.0-43.46","4.15.0-44.47","4.15.0-45.48","4.15.0-46.49","4.15.0-47.50","4.15.0-48.51","4.15.0-50.54","4.15.0-51.55","4.15.0-52.56","4.15.0-54.58","4.15.0-55.60","4.15.0-58.64","4.15.0-60.67","4.15.0-62.69","4.15.0-64.73","4.15.0-65.74","4.15.0-66.75","4.15.0-69.78","4.15.0-70.79","4.15.0-72.81","4.15.0-74.84","4.15.0-76.86","4.15.0-88.88","4.15.0-91.92","4.15.0-96.97","4.15.0-99.100","4.15.0-101.102","4.15.0-106.107","4.15.0-108.109","4.15.0-109.110","4.15.0-111.112","4.15.0-112.113","4.15.0-115.116","4.15.0-117.118","4.15.0-118.119","4.15.0-121.123","4.15.0-122.124","4.15.0-123.126","4.15.0-124.127","4.15.0-126.129","4.15.0-128.131","4.15.0-129.132","4.15.0-130.134","4.15.0-132.136","4.15.0-134.138","4.15.0-135.139","4.15.0-136.140","4.15.0-137.141","4.15.0-139.143","4.15.0-140.144","4.15.0-141.145","4.15.0-142.146","4.15.0-143.147","4.15.0-144.148","4.15.0-147.151"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1109.116"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1007.7","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1011.11","4.15.0-1016.16","4.15.0-1017.17","4.15.0-1019.19","4.15.0-1020.20","4.15.0-1021.21","4.15.0-1023.23","4.15.0-1025.25","4.15.0-1027.27","4.15.0-1029.30","4.15.0-1031.33","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1035.37","4.15.0-1037.39","4.15.0-1039.41","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1043.45","4.15.0-1044.46","4.15.0-1045.47","4.15.0-1047.49","4.15.0-1048.50","4.15.0-1050.52","4.15.0-1051.53","4.15.0-1052.54","4.15.0-1054.56","4.15.0-1056.58","4.15.0-1057.59","4.15.0-1058.60","4.15.0-1060.62","4.15.0-1063.67","4.15.0-1065.69","4.15.0-1066.70","4.15.0-1067.71","4.15.0-1073.77","4.15.0-1076.80","4.15.0-1077.81","4.15.0-1079.83","4.15.0-1080.84","4.15.0-1082.86","4.15.0-1083.87","4.15.0-1086.91","4.15.0-1087.92","4.15.0-1088.93","4.15.0-1090.95","4.15.0-1091.96","4.15.0-1092.98","4.15.0-1093.99","4.15.0-1094.101","4.15.0-1095.102","4.15.0-1096.103","4.15.0-1097.104","4.15.0-1098.105","4.15.0-1099.106","4.15.0-1101.108","4.15.0-1102.109","4.15.0-1103.110","4.15.0-1106.113"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1054.57~18.04.1"}]}],"versions":["5.4.0-1018.18~18.04.1","5.4.0-1020.20~18.04.2","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.30~18.04.1","5.4.0-1030.31~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1038.40~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1041.43~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1045.47~18.04.1","5.4.0-1047.49~18.04.1","5.4.0-1048.50~18.04.1","5.4.0-1049.51~18.04.1","5.4.0-1051.53~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1121.134"}]}],"versions":["4.15.0-1082.92","4.15.0-1083.93","4.15.0-1089.99","4.15.0-1091.101","4.15.0-1092.102","4.15.0-1093.103","4.15.0-1095.105","4.15.0-1096.106","4.15.0-1099.110","4.15.0-1100.111","4.15.0-1102.113","4.15.0-1103.114","4.15.0-1104.116","4.15.0-1106.118","4.15.0-1108.120","4.15.0-1109.121","4.15.0-1110.122","4.15.0-1111.123","4.15.0-1112.125","4.15.0-1113.126","4.15.0-1114.127","4.15.0-1115.128","4.15.0-1118.131"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1055.57~18.04.1"}]}],"versions":["5.4.0-1020.20~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1023.23~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1026.26~18.04.1","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1035.36~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1041.43~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1047.49~18.04.1","5.4.0-1048.50~18.04.1","5.4.0-1049.51~18.04.1","5.4.0-1051.53~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1106.120"}]}],"versions":["4.15.0-1071.81","4.15.0-1077.87","4.15.0-1078.88","4.15.0-1080.90","4.15.0-1081.92","4.15.0-1083.94","4.15.0-1084.95","4.15.0-1086.98","4.15.0-1087.100","4.15.0-1088.101","4.15.0-1090.103","4.15.0-1091.104","4.15.0-1092.105","4.15.0-1093.106","4.15.0-1094.107","4.15.0-1095.108","4.15.0-1096.109","4.15.0-1097.110","4.15.0-1098.111","4.15.0-1099.112","4.15.0-1100.113","4.15.0-1103.116"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1049.53~18.04.1"}]}],"versions":["5.4.0-1019.19~18.04.2","5.4.0-1021.21~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1034.37~18.04.1","5.4.0-1036.39~18.04.1","5.4.0-1037.40~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1040.43~18.04.1","5.4.0-1041.44~18.04.1","5.4.0-1042.45~18.04.1","5.4.0-1043.46~18.04.1","5.4.0-1044.47~18.04.2","5.4.0-1046.49~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-80.90~18.04.1"}]}],"versions":["5.4.0-37.41~18.04.1","5.4.0-39.43~18.04.1","5.4.0-40.44~18.04.1","5.4.0-42.46~18.04.1","5.4.0-45.49~18.04.2","5.4.0-47.51~18.04.1","5.4.0-48.52~18.04.1","5.4.0-51.56~18.04.1","5.4.0-52.57~18.04.1","5.4.0-53.59~18.04.1","5.4.0-54.60~18.04.1","5.4.0-56.62~18.04.1","5.4.0-58.64~18.04.1","5.4.0-59.65~18.04.1","5.4.0-60.67~18.04.1","5.4.0-62.70~18.04.1","5.4.0-64.72~18.04.1","5.4.0-65.73~18.04.1","5.4.0-66.74~18.04.2","5.4.0-67.75~18.04.1","5.4.0-70.78~18.04.1","5.4.0-71.79~18.04.1","5.4.0-72.80~18.04.1","5.4.0-73.82~18.04.1","5.4.0-74.83~18.04.1","5.4.0-77.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1097.99"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1010.10","4.15.0-1011.11","4.15.0-1012.12","4.15.0-1016.16","4.15.0-1017.17","4.15.0-1019.19","4.15.0-1020.20","4.15.0-1021.21","4.15.0-1023.23","4.15.0-1025.25","4.15.0-1026.26","4.15.0-1027.27","4.15.0-1028.28","4.15.0-1029.29","4.15.0-1030.30","4.15.0-1031.31","4.15.0-1032.32","4.15.0-1034.34","4.15.0-1035.35","4.15.0-1036.36","4.15.0-1038.38","4.15.0-1039.39","4.15.0-1042.42","4.15.0-1043.43","4.15.0-1044.44","4.15.0-1046.46","4.15.0-1047.47","4.15.0-1048.48","4.15.0-1050.50","4.15.0-1051.51","4.15.0-1052.52","4.15.0-1053.53","4.15.0-1056.57","4.15.0-1058.59","4.15.0-1059.60","4.15.0-1060.61","4.15.0-1067.68","4.15.0-1069.70","4.15.0-1071.72","4.15.0-1072.73","4.15.0-1074.75","4.15.0-1075.76","4.15.0-1077.79","4.15.0-1079.81","4.15.0-1081.83","4.15.0-1082.84","4.15.0-1084.86","4.15.0-1085.87","4.15.0-1086.88","4.15.0-1087.89","4.15.0-1088.90","4.15.0-1089.91","4.15.0-1090.92","4.15.0-1091.93","4.15.0-1092.94","4.15.0-1094.96"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1078.86"}]}],"versions":["4.15.0-1007.9","4.15.0-1008.10","4.15.0-1009.11","4.15.0-1010.12","4.15.0-1011.13","4.15.0-1013.15","4.15.0-1014.16","4.15.0-1015.17","4.15.0-1017.19","4.15.0-1018.20","4.15.0-1021.23","4.15.0-1022.25","4.15.0-1023.26","4.15.0-1025.28","4.15.0-1026.29","4.15.0-1027.30","4.15.0-1029.32","4.15.0-1030.33","4.15.0-1031.34","4.15.0-1033.36","4.15.0-1035.39","4.15.0-1037.41","4.15.0-1038.42","4.15.0-1039.43","4.15.0-1045.49","4.15.0-1047.51","4.15.0-1048.52","4.15.0-1050.54","4.15.0-1051.55","4.15.0-1053.57","4.15.0-1054.58","4.15.0-1057.62","4.15.0-1058.64","4.15.0-1059.65","4.15.0-1061.67","4.15.0-1062.68","4.15.0-1063.70","4.15.0-1064.71","4.15.0-1065.73","4.15.0-1066.74","4.15.0-1067.75","4.15.0-1068.76","4.15.0-1069.77","4.15.0-1070.78","4.15.0-1071.79","4.15.0-1072.80","4.15.0-1075.83"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1052.56~18.04.1"}]}],"versions":["5.4.0-1019.19~18.04.1","5.4.0-1021.21~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1033.35","5.4.0-1034.36~18.04.1","5.4.0-1035.38~18.04.1","5.4.0-1037.40~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1039.42~18.04.1","5.4.0-1041.44~18.04.1","5.4.0-1042.45~18.04.1","5.4.0-1043.46~18.04.1","5.4.0-1044.47~18.04.1","5.4.0-1046.50~18.04.2","5.4.0-1048.52~18.04.1","5.4.0-1049.53~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-raspi-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1041.45~18.04.1"}]}],"versions":["5.4.0-1013.13~18.04.1","5.4.0-1015.15~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.20~18.04.1","5.4.0-1019.21~18.04.1","5.4.0-1021.24~18.04.1","5.4.0-1022.25~18.04.1","5.4.0-1023.26~18.04.1","5.4.0-1025.28~18.04.1","5.4.0-1026.29~18.04.1","5.4.0-1028.31~18.04.1","5.4.0-1029.32~18.04.1","5.4.0-1030.33~18.04.1","5.4.0-1032.35~18.04.1","5.4.0-1033.36~18.04.1","5.4.0-1034.37~18.04.1","5.4.0-1035.38~18.04.1","5.4.0-1036.39~18.04.1","5.4.0-1038.41~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-2051.53"}]}],"versions":["4.15.0-2000.4","4.15.0-2018.18","4.15.0-2021.21","4.15.0-2022.22","4.15.0-2024.24","4.15.0-2025.25","4.15.0-2026.26","4.15.0-2027.27","4.15.0-2030.31","4.15.0-2031.32","4.15.0-2033.34","4.15.0-2034.35","4.15.0-2035.37","4.15.0-2036.38","4.15.0-2037.39","4.15.0-2038.40","4.15.0-2039.41","4.15.0-2040.42","4.15.0-2041.43","4.15.0-2042.44","4.15.0-2044.46","4.15.0-2045.47","4.15.0-2048.50"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-2033.37"}]}],"versions":["4.15.0-1002.2","4.15.0-2006.7","4.15.0-2007.8","4.15.0-2008.9","4.15.0-2009.10","4.15.0-2012.14","4.15.0-2013.15","4.15.0-2015.17","4.15.0-2016.18","4.15.0-2017.20","4.15.0-2018.21","4.15.0-2020.23","4.15.0-2021.24","4.15.0-2022.25","4.15.0-2023.26","4.15.0-2024.27","4.15.0-2025.28","4.15.0-2026.29","4.15.0-2027.30","4.15.0-2030.33"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-1066.75"}]}],"versions":["4.15.0-1027.32","4.15.0-1029.34","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1037.42","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1040.45","4.15.0-1041.46","4.15.0-1044.50","4.15.0-1045.52","4.15.0-1046.53","4.15.0-1048.55","4.15.0-1049.56","4.15.0-1050.58","4.15.0-1051.59","4.15.0-1052.60","4.15.0-1053.61","4.15.0-1054.62","4.15.0-1055.63","4.15.0-1056.64","4.15.0-1057.65","4.15.0-1058.66","4.15.0-1059.67","4.15.0-1060.68","4.15.0-1063.71"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-2016.18"}]}],"versions":["4.15.0-2013.14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-2000.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1011.12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-80.90"}]}],"versions":["5.3.0-18.19","5.3.0-24.26","5.4.0-9.12","5.4.0-18.22","5.4.0-21.25","5.4.0-24.28","5.4.0-25.29","5.4.0-26.30","5.4.0-28.32","5.4.0-29.33","5.4.0-31.35","5.4.0-33.37","5.4.0-37.41","5.4.0-39.43","5.4.0-40.44","5.4.0-42.46","5.4.0-45.49","5.4.0-47.51","5.4.0-48.52","5.4.0-51.56","5.4.0-52.57","5.4.0-53.59","5.4.0-54.60","5.4.0-56.62","5.4.0-58.64","5.4.0-59.65","5.4.0-60.67","5.4.0-62.70","5.4.0-64.72","5.4.0-65.73","5.4.0-66.74","5.4.0-67.75","5.4.0-70.78","5.4.0-71.79","5.4.0-72.80","5.4.0-73.82","5.4.0-74.83","5.4.0-77.86"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1054.57"}]}],"versions":["5.3.0-1003.3","5.3.0-1008.9","5.3.0-1009.10","5.3.0-1010.11","5.4.0-1005.5","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1017.17","5.4.0-1018.18","5.4.0-1020.20","5.4.0-1021.21","5.4.0-1022.22","5.4.0-1024.24","5.4.0-1025.25","5.4.0-1028.29","5.4.0-1029.30","5.4.0-1030.31","5.4.0-1032.33","5.4.0-1034.35","5.4.0-1035.37","5.4.0-1037.39","5.4.0-1038.40","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1043.45","5.4.0-1045.47","5.4.0-1047.49","5.4.0-1048.50","5.4.0-1049.51","5.4.0-1051.53"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1055.57"}]}],"versions":["5.3.0-1003.3","5.3.0-1008.9","5.3.0-1009.10","5.4.0-1006.6","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1010.10","5.4.0-1012.12","5.4.0-1016.16","5.4.0-1019.19","5.4.0-1020.20","5.4.0-1022.22","5.4.0-1023.23","5.4.0-1025.25","5.4.0-1026.26","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1034.35","5.4.0-1035.36","5.4.0-1036.38","5.4.0-1039.41","5.4.0-1040.42","5.4.0-1041.43","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1047.49","5.4.0-1048.50","5.4.0-1049.51","5.4.0-1051.53"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1016.19"}]}],"versions":["5.4.0-1007.10","5.4.0-1011.14","5.4.0-1012.15","5.4.0-1013.16"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1049.53"}]}],"versions":["5.3.0-1004.4","5.3.0-1009.10","5.3.0-1011.12","5.4.0-1005.5","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1018.18","5.4.0-1019.19","5.4.0-1021.21","5.4.0-1022.22","5.4.0-1024.24","5.4.0-1025.25","5.4.0-1028.29","5.4.0-1029.31","5.4.0-1030.32","5.4.0-1032.34","5.4.0-1033.35","5.4.0-1034.37","5.4.0-1036.39","5.4.0-1037.40","5.4.0-1038.41","5.4.0-1040.43","5.4.0-1041.44","5.4.0-1042.45","5.4.0-1043.46","5.4.0-1044.47","5.4.0-1046.49"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1021.22"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1044.46"}]}],"versions":["5.3.0-1003.3","5.3.0-1008.9","5.3.0-1009.10","5.4.0-1004.4","5.4.0-1006.6","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1018.18","5.4.0-1020.20","5.4.0-1021.21","5.4.0-1023.23","5.4.0-1024.24","5.4.0-1026.27","5.4.0-1028.29","5.4.0-1030.31","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1041.42"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1052.56"}]}],"versions":["5.3.0-1002.2","5.3.0-1007.8","5.3.0-1008.9","5.4.0-1005.5","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1018.18","5.4.0-1019.19","5.4.0-1021.21","5.4.0-1022.22","5.4.0-1024.24","5.4.0-1025.25","5.4.0-1028.29","5.4.0-1029.31","5.4.0-1030.32","5.4.0-1032.34","5.4.0-1034.36","5.4.0-1035.38","5.4.0-1037.40","5.4.0-1038.41","5.4.0-1039.42","5.4.0-1041.44","5.4.0-1042.45","5.4.0-1043.46","5.4.0-1045.49","5.4.0-1046.50","5.4.0-1048.52","5.4.0-1049.53"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1041.45"}]}],"versions":["5.4.0-1007.7","5.4.0-1008.8","5.4.0-1011.11","5.4.0-1012.12","5.4.0-1013.13","5.4.0-1015.15","5.4.0-1016.17","5.4.0-1018.20","5.4.0-1019.21","5.4.0-1021.24","5.4.0-1022.25","5.4.0-1023.26","5.4.0-1025.28","5.4.0-1026.29","5.4.0-1028.31","5.4.0-1029.32","5.4.0-1030.33","5.4.0-1032.35","5.4.0-1033.36","5.4.0-1034.37","5.4.0-1035.38","5.4.0-1036.39","5.4.0-1038.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1069.73+fips2"}]}],"versions":["5.4.0-1021.21+fips2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1073.76+fips1"}]}],"versions":["5.4.0-1022.22+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1031.36"}]}],"versions":["5.4.0-1026.30","5.4.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1067.71~20.04.1"}]}],"versions":["5.4.0-1021.21+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1021.21+fips2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1022.22+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1007.8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1021.21+fips1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/b2c8d28c34b3070407cb1741f9ba3f15d0284b8b","tags":["x_transferred","Patch","fix","report"]},{"url":"https://git.kernel.org/stable/c/5489f30bb78ff0dafb4229a69632afc2ba20765c","tags":["x_transferred","Patch","fix","report"]},{"url":"https://git.kernel.org/stable/c/436d650d374329a591c30339a91fa5078052ed1e","tags":["x_transferred","Patch","fix","report"]},{"url":"https://git.kernel.org/stable/c/4b1761898861117c97066aea6c58f68a7787f0bf","tags":["x_transferred","Patch","fix","report"]},{"url":"https://git.kernel.org/stable/c/64d17ec9f1ded042c4b188d15734f33486ed9966","tags":["x_transferred","Patch","fix","report"]},{"url":"https://git.kernel.org/stable/c/6da24cfc83ba4f97ea44fc7ae9999a006101755c","tags":["x_transferred","Patch","fix","report"]},{"url":"https://git.kernel.org/stable/c/ace300eecbccaa698e2b472843c74a5f33f7dce8","tags":["x_transferred","Patch","fix","report"]},{"url":"https://git.kernel.org/stable/c/b7df21cf1b79ab7026f545e7bf837bd5750ac026","tags":["x_transferred","Patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47162","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-86fr-x2qv-cxp5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-47162","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1483","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46984","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47054","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47056","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47060","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47061","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47063","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47071","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47074","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47077","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47078","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47101","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47142","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47144","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47146","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47159","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47161","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47163","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47170","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47171","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47173","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52475","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52500","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52507","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52510","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52515","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52522","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52530","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52566","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52578","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52583","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52587","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52594","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52595","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52597","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52598","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52622","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1484","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241643-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1084332","tags":["report"]},{"url":"https://bugzilla.suse.com/1141539","tags":["report"]},{"url":"https://bugzilla.suse.com/1184509","tags":["report"]},{"url":"https://bugzilla.suse.com/1186060","tags":["report"]},{"url":"https://bugzilla.suse.com/1190317","tags":["report"]},{"url":"https://bugzilla.suse.com/1190576","tags":["report"]},{"url":"https://bugzilla.suse.com/1192145","tags":["report"]},{"url":"https://bugzilla.suse.com/1194516","tags":["report"]},{"url":"https://bugzilla.suse.com/1197894","tags":["report"]},{"url":"https://bugzilla.suse.com/1203935","tags":["report"]},{"url":"https://bugzilla.suse.com/1209657","tags":["report"]},{"url":"https://bugzilla.suse.com/1211592","tags":["report"]},{"url":"https://bugzilla.suse.com/1212514","tags":["report"]},{"url":"https://bugzilla.suse.com/1213456","tags":["report"]},{"url":"https://bugzilla.suse.com/1215221","tags":["report"]},{"url":"https://bugzilla.suse.com/1217339","tags":["report"]},{"url":"https://bugzilla.suse.com/1217987","tags":["report"]},{"url":"https://bugzilla.suse.com/1217988","tags":["report"]},{"url":"https://bugzilla.suse.com/1217989","tags":["report"]},{"url":"https://bugzilla.suse.com/1218220","tags":["report"]},{"url":"https://bugzilla.suse.com/1218336","tags":["report"]},{"url":"https://bugzilla.suse.com/1218479","tags":["report"]},{"url":"https://bugzilla.suse.com/1218562","tags":["report"]},{"url":"https://bugzilla.suse.com/1218917","tags":["report"]},{"url":"https://bugzilla.suse.com/1219104","tags":["report"]},{"url":"https://bugzilla.suse.com/1219169","tags":["report"]},{"url":"https://bugzilla.suse.com/1219170","tags":["report"]},{"url":"https://bugzilla.suse.com/1219618","tags":["report"]},{"url":"https://bugzilla.suse.com/1219623","tags":["report"]},{"url":"https://bugzilla.suse.com/1219847","tags":["report"]},{"url":"https://bugzilla.suse.com/1220320","tags":["report"]},{"url":"https://bugzilla.suse.com/1220366","tags":["report"]},{"url":"https://bugzilla.suse.com/1220394","tags":["report"]},{"url":"https://bugzilla.suse.com/1220411","tags":["report"]},{"url":"https://bugzilla.suse.com/1220413","tags":["report"]},{"url":"https://bugzilla.suse.com/1220416","tags":["report"]},{"url":"https://bugzilla.suse.com/1220418","tags":["report"]},{"url":"https://bugzilla.suse.com/1220442","tags":["report"]},{"url":"https://bugzilla.suse.com/1220445","tags":["report"]},{"url":"https://bugzilla.suse.com/1220513","tags":["report"]},{"url":"https://bugzilla.suse.com/1220521","tags":["report"]},{"url":"https://bugzilla.suse.com/1220528","tags":["report"]},{"url":"https://bugzilla.suse.com/1220536","tags":["report"]},{"url":"https://bugzilla.suse.com/1220538","tags":["report"]},{"url":"https://bugzilla.suse.com/1220554","tags":["report"]},{"url":"https://bugzilla.suse.com/1220572","tags":["report"]},{"url":"https://bugzilla.suse.com/1220580","tags":["report"]},{"url":"https://bugzilla.suse.com/1220611","tags":["report"]},{"url":"https://bugzilla.suse.com/1220625","tags":["report"]},{"url":"https://bugzilla.suse.com/1220628","tags":["report"]},{"url":"https://bugzilla.suse.com/1220637","tags":["report"]},{"url":"https://bugzilla.suse.com/1220640","tags":["report"]},{"url":"https://bugzilla.suse.com/1220662","tags":["report"]},{"url":"https://bugzilla.suse.com/1220687","tags":["report"]},{"url":"https://bugzilla.suse.com/1220692","tags":["report"]},{"url":"https://bugzilla.suse.com/1220703","tags":["report"]},{"url":"https://bugzilla.suse.com/1220706","tags":["report"]},{"url":"https://bugzilla.suse.com/1220739","tags":["report"]},{"url":"https://bugzilla.suse.com/1220742","tags":["report"]},{"url":"https://bugzilla.suse.com/1220743","tags":["report"]},{"url":"https://bugzilla.suse.com/1220745","tags":["report"]},{"url":"https://bugzilla.suse.com/1220751","tags":["report"]},{"url":"https://bugzilla.suse.com/1220768","tags":["report"]},{"url":"https://bugzilla.suse.com/1220769","tags":["report"]},{"url":"https://bugzilla.suse.com/1220777","tags":["report"]},{"url":"https://bugzilla.suse.com/1220790","tags":["report"]},{"url":"https://bugzilla.suse.com/1220794","tags":["report"]},{"url":"https://bugzilla.suse.com/1220829","tags":["report"]},{"url":"https://bugzilla.suse.com/1220836","tags":["report"]},{"url":"https://bugzilla.suse.com/1220843","tags":["report"]},{"url":"https://bugzilla.suse.com/1220846","tags":["report"]},{"url":"https://bugzilla.suse.com/1220850","tags":["report"]},{"url":"https://bugzilla.suse.com/1220871","tags":["report"]},{"url":"https://bugzilla.suse.com/1220927","tags":["report"]},{"url":"https://bugzilla.suse.com/1220960","tags":["report"]},{"url":"https://bugzilla.suse.com/1220985","tags":["report"]},{"url":"https://bugzilla.suse.com/1220987","tags":["report"]},{"url":"https://bugzilla.suse.com/1221044","tags":["report"]},{"url":"https://bugzilla.suse.com/1221046","tags":["report"]},{"url":"https://bugzilla.suse.com/1221048","tags":["report"]},{"url":"https://bugzilla.suse.com/1221058","tags":["report"]},{"url":"https://bugzilla.suse.com/1221060","tags":["report"]},{"url":"https://bugzilla.suse.com/1221061","tags":["report"]},{"url":"https://bugzilla.suse.com/1221077","tags":["report"]},{"url":"https://bugzilla.suse.com/1221082","tags":["report"]},{"url":"https://bugzilla.suse.com/1221088","tags":["report"]},{"url":"https://bugzilla.suse.com/1221162","tags":["report"]},{"url":"https://bugzilla.suse.com/1221277","tags":["report"]},{"url":"https://bugzilla.suse.com/1221293","tags":["report"]},{"url":"https://bugzilla.suse.com/1221337","tags":["report"]},{"url":"https://bugzilla.suse.com/1221532","tags":["report"]},{"url":"https://bugzilla.suse.com/1221541","tags":["report"]},{"url":"https://bugzilla.suse.com/1221543","tags":["report"]},{"url":"https://bugzilla.suse.com/1221545","tags":["report"]},{"url":"https://bugzilla.suse.com/1221548","tags":["report"]},{"url":"https://bugzilla.suse.com/1221575","tags":["report"]},{"url":"https://bugzilla.suse.com/1221605","tags":["report"]},{"url":"https://bugzilla.suse.com/1221608","tags":["report"]},{"url":"https://bugzilla.suse.com/1221617","tags":["report"]},{"url":"https://bugzilla.suse.com/1221791","tags":["report"]},{"url":"https://bugzilla.suse.com/1221816","tags":["report"]},{"url":"https://bugzilla.suse.com/1221825","tags":["report"]},{"url":"https://bugzilla.suse.com/1221830","tags":["report"]},{"url":"https://bugzilla.suse.com/1221862","tags":["report"]},{"url":"https://bugzilla.suse.com/1221934","tags":["report"]},{"url":"https://bugzilla.suse.com/1221949","tags":["report"]},{"url":"https://bugzilla.suse.com/1221952","tags":["report"]},{"url":"https://bugzilla.suse.com/1221953","tags":["report"]},{"url":"https://bugzilla.suse.com/1221965","tags":["report"]},{"url":"https://bugzilla.suse.com/1221966","tags":["report"]},{"url":"https://bugzilla.suse.com/1221967","tags":["report"]},{"url":"https://bugzilla.suse.com/1221969","tags":["report"]},{"url":"https://bugzilla.suse.com/1221972","tags":["report"]},{"url":"https://bugzilla.suse.com/1221973","tags":["report"]},{"url":"https://bugzilla.suse.com/1221977","tags":["report"]},{"url":"https://bugzilla.suse.com/1221979","tags":["report"]},{"url":"https://bugzilla.suse.com/1221988","tags":["report"]},{"url":"https://bugzilla.suse.com/1221991","tags":["report"]},{"url":"https://bugzilla.suse.com/1221993","tags":["report"]},{"url":"https://bugzilla.suse.com/1221994","tags":["report"]},{"url":"https://bugzilla.suse.com/1221997","tags":["report"]},{"url":"https://bugzilla.suse.com/1221998","tags":["report"]},{"url":"https://bugzilla.suse.com/1221999","tags":["report"]},{"url":"https://bugzilla.suse.com/1222000","tags":["report"]},{"url":"https://bugzilla.suse.com/1222001","tags":["report"]},{"url":"https://bugzilla.suse.com/1222002","tags":["report"]},{"url":"https://bugzilla.suse.com/1222117","tags":["report"]},{"url":"https://bugzilla.suse.com/1222294","tags":["report"]},{"url":"https://bugzilla.suse.com/1222300","tags":["report"]},{"url":"https://bugzilla.suse.com/1222357","tags":["report"]},{"url":"https://bugzilla.suse.com/1222379","tags":["report"]},{"url":"https://bugzilla.suse.com/1222422","tags":["report"]},{"url":"https://bugzilla.suse.com/1222428","tags":["report"]},{"url":"https://bugzilla.suse.com/1222449","tags":["report"]},{"url":"https://bugzilla.suse.com/1222503","tags":["report"]},{"url":"https://bugzilla.suse.com/1222559","tags":["report"]},{"url":"https://bugzilla.suse.com/1222585","tags":["report"]},{"url":"https://bugzilla.suse.com/1222609","tags":["report"]},{"url":"https://bugzilla.suse.com/1222610","tags":["report"]},{"url":"https://bugzilla.suse.com/1222613","tags":["report"]},{"url":"https://bugzilla.suse.com/1222618","tags":["report"]},{"url":"https://bugzilla.suse.com/1222619","tags":["report"]},{"url":"https://bugzilla.suse.com/1222624","tags":["report"]},{"url":"https://bugzilla.suse.com/1222630","tags":["report"]},{"url":"https://bugzilla.suse.com/1222632","tags":["report"]},{"url":"https://bugzilla.suse.com/1222660","tags":["report"]},{"url":"https://bugzilla.suse.com/1222662","tags":["report"]},{"url":"https://bugzilla.suse.com/1222664","tags":["report"]},{"url":"https://bugzilla.suse.com/1222666","tags":["report"]},{"url":"https://bugzilla.suse.com/1222669","tags":["report"]},{"url":"https://bugzilla.suse.com/1222671","tags":["report"]},{"url":"https://bugzilla.suse.com/1222677","tags":["report"]},{"url":"https://bugzilla.suse.com/1222706","tags":["report"]},{"url":"https://bugzilla.suse.com/1222720","tags":["report"]},{"url":"https://bugzilla.suse.com/1222765","tags":["report"]},{"url":"https://bugzilla.suse.com/1222770","tags":["report"]},{"url":"https://bugzilla.suse.com/1222772","tags":["report"]},{"url":"https://bugzilla.suse.com/1222787","tags":["report"]},{"url":"https://bugzilla.suse.com/1222790","tags":["report"]},{"url":"https://bugzilla.suse.com/1222793","tags":["report"]},{"url":"https://bugzilla.suse.com/1222812","tags":["report"]},{"url":"https://bugzilla.suse.com/1222836","tags":["report"]},{"url":"https://bugzilla.suse.com/1222869","tags":["report"]},{"url":"https://bugzilla.suse.com/1222876","tags":["report"]},{"url":"https://bugzilla.suse.com/1222878","tags":["report"]},{"url":"https://bugzilla.suse.com/1222881","tags":["report"]},{"url":"https://bugzilla.suse.com/1222883","tags":["report"]},{"url":"https://bugzilla.suse.com/1222888","tags":["report"]},{"url":"https://bugzilla.suse.com/1222952","tags":["report"]},{"url":"https://bugzilla.suse.com/1222961","tags":["report"]},{"url":"https://bugzilla.suse.com/1222975","tags":["report"]},{"url":"https://bugzilla.suse.com/1222976","tags":["report"]},{"url":"https://bugzilla.suse.com/1223016","tags":["report"]},{"url":"https://bugzilla.suse.com/1223035","tags":["report"]},{"url":"https://bugzilla.suse.com/1223049","tags":["report"]},{"url":"https://bugzilla.suse.com/1223051","tags":["report"]},{"url":"https://bugzilla.suse.com/1223057","tags":["report"]},{"url":"https://bugzilla.suse.com/1223058","tags":["report"]},{"url":"https://bugzilla.suse.com/1223060","tags":["report"]},{"url":"https://bugzilla.suse.com/1223119","tags":["report"]},{"url":"https://bugzilla.suse.com/1223187","tags":["report"]},{"url":"https://bugzilla.suse.com/1223189","tags":["report"]},{"url":"https://bugzilla.suse.com/1223198","tags":["report"]},{"url":"https://bugzilla.suse.com/1223203","tags":["report"]},{"url":"https://bugzilla.suse.com/1223315","tags":["report"]},{"url":"https://bugzilla.suse.com/1223432","tags":["report"]},{"url":"https://bugzilla.suse.com/1223509","tags":["report"]},{"url":"https://bugzilla.suse.com/1223512","tags":["report"]},{"url":"https://bugzilla.suse.com/1223513","tags":["report"]},{"url":"https://bugzilla.suse.com/1223516","tags":["report"]},{"url":"https://bugzilla.suse.com/1223518","tags":["report"]},{"url":"https://bugzilla.suse.com/1223539","tags":["report"]},{"url":"https://bugzilla.suse.com/1223540","tags":["report"]},{"url":"https://bugzilla.suse.com/1223626","tags":["report"]},{"url":"https://bugzilla.suse.com/1223627","tags":["report"]},{"url":"https://bugzilla.suse.com/1223664","tags":["report"]},{"url":"https://bugzilla.suse.com/1223686","tags":["report"]},{"url":"https://bugzilla.suse.com/1223693","tags":["report"]},{"url":"https://bugzilla.suse.com/1223712","tags":["report"]},{"url":"https://bugzilla.suse.com/1223715","tags":["report"]},{"url":"https://bugzilla.suse.com/1223735","tags":["report"]},{"url":"https://bugzilla.suse.com/1223744","tags":["report"]},{"url":"https://bugzilla.suse.com/1223745","tags":["report"]},{"url":"https://bugzilla.suse.com/1223770","tags":["report"]},{"url":"https://bugzilla.suse.com/1223781","tags":["report"]},{"url":"https://bugzilla.suse.com/1223802","tags":["report"]},{"url":"https://bugzilla.suse.com/1223819","tags":["report"]},{"url":"https://bugzilla.suse.com/1223824","tags":["report"]},{"url":"https://bugzilla.suse.com/1223827","tags":["report"]},{"url":"https://bugzilla.suse.com/1223837","tags":["report"]},{"url":"https://bugzilla.suse.com/1223842","tags":["report"]},{"url":"https://bugzilla.suse.com/1223843","tags":["report"]},{"url":"https://bugzilla.suse.com/1223844","tags":["report"]},{"url":"https://bugzilla.suse.com/1223883","tags":["report"]},{"url":"https://bugzilla.suse.com/1223885","tags":["report"]},{"url":"https://bugzilla.suse.com/1223921","tags":["report"]},{"url":"https://bugzilla.suse.com/1223923","tags":["report"]},{"url":"https://bugzilla.suse.com/1223931","tags":["report"]},{"url":"https://bugzilla.suse.com/1223941","tags":["report"]},{"url":"https://bugzilla.suse.com/1223952","tags":["report"]},{"url":"https://bugzilla.suse.com/1223953","tags":["report"]},{"url":"https://bugzilla.suse.com/1223954","tags":["report"]},{"url":"https://bugzilla.suse.com/1223969","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-0160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-35827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-4881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-7042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-7192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27388","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241646-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241870-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220422","tags":["report"]},{"url":"https://bugzilla.suse.com/1220505","tags":["report"]},{"url":"https://bugzilla.suse.com/1224785","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46975","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241979-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1065729","tags":["report"]},{"url":"https://bugzilla.suse.com/1101816","tags":["report"]},{"url":"https://bugzilla.suse.com/1181674","tags":["report"]},{"url":"https://bugzilla.suse.com/1185902","tags":["report"]},{"url":"https://bugzilla.suse.com/1187716","tags":["report"]},{"url":"https://bugzilla.suse.com/1188616","tags":["report"]},{"url":"https://bugzilla.suse.com/1190795","tags":["report"]},{"url":"https://bugzilla.suse.com/1191452","tags":["report"]},{"url":"https://bugzilla.suse.com/1194591","tags":["report"]},{"url":"https://bugzilla.suse.com/1197760","tags":["report"]},{"url":"https://bugzilla.suse.com/1206213","tags":["report"]},{"url":"https://bugzilla.suse.com/1206646","tags":["report"]},{"url":"https://bugzilla.suse.com/1207186","tags":["report"]},{"url":"https://bugzilla.suse.com/1210335","tags":["report"]},{"url":"https://bugzilla.suse.com/1215702","tags":["report"]},{"url":"https://bugzilla.suse.com/1216702","tags":["report"]},{"url":"https://bugzilla.suse.com/1217169","tags":["report"]},{"url":"https://bugzilla.suse.com/1217519","tags":["report"]},{"url":"https://bugzilla.suse.com/1220487","tags":["report"]},{"url":"https://bugzilla.suse.com/1220854","tags":["report"]},{"url":"https://bugzilla.suse.com/1220928","tags":["report"]},{"url":"https://bugzilla.suse.com/1221081","tags":["report"]},{"url":"https://bugzilla.suse.com/1221086","tags":["report"]},{"url":"https://bugzilla.suse.com/1222627","tags":["report"]},{"url":"https://bugzilla.suse.com/1222667","tags":["report"]},{"url":"https://bugzilla.suse.com/1222893","tags":["report"]},{"url":"https://bugzilla.suse.com/1222894","tags":["report"]},{"url":"https://bugzilla.suse.com/1223023","tags":["report"]},{"url":"https://bugzilla.suse.com/1223046","tags":["report"]},{"url":"https://bugzilla.suse.com/1223048","tags":["report"]},{"url":"https://bugzilla.suse.com/1223084","tags":["report"]},{"url":"https://bugzilla.suse.com/1223138","tags":["report"]},{"url":"https://bugzilla.suse.com/1223207","tags":["report"]},{"url":"https://bugzilla.suse.com/1223360","tags":["report"]},{"url":"https://bugzilla.suse.com/1223384","tags":["report"]},{"url":"https://bugzilla.suse.com/1223633","tags":["report"]},{"url":"https://bugzilla.suse.com/1223653","tags":["report"]},{"url":"https://bugzilla.suse.com/1223666","tags":["report"]},{"url":"https://bugzilla.suse.com/1223671","tags":["report"]},{"url":"https://bugzilla.suse.com/1223738","tags":["report"]},{"url":"https://bugzilla.suse.com/1223752","tags":["report"]},{"url":"https://bugzilla.suse.com/1223834","tags":["report"]},{"url":"https://bugzilla.suse.com/1223922","tags":["report"]},{"url":"https://bugzilla.suse.com/1223932","tags":["report"]},{"url":"https://bugzilla.suse.com/1223948","tags":["report"]},{"url":"https://bugzilla.suse.com/1224096","tags":["report"]},{"url":"https://bugzilla.suse.com/1224174","tags":["report"]},{"url":"https://bugzilla.suse.com/1224181","tags":["report"]},{"url":"https://bugzilla.suse.com/1224347","tags":["report"]},{"url":"https://bugzilla.suse.com/1224482","tags":["report"]},{"url":"https://bugzilla.suse.com/1224511","tags":["report"]},{"url":"https://bugzilla.suse.com/1224525","tags":["report"]},{"url":"https://bugzilla.suse.com/1224566","tags":["report"]},{"url":"https://bugzilla.suse.com/1224580","tags":["report"]},{"url":"https://bugzilla.suse.com/1224592","tags":["report"]},{"url":"https://bugzilla.suse.com/1224601","tags":["report"]},{"url":"https://bugzilla.suse.com/1224607","tags":["report"]},{"url":"https://bugzilla.suse.com/1224621","tags":["report"]},{"url":"https://bugzilla.suse.com/1224644","tags":["report"]},{"url":"https://bugzilla.suse.com/1224645","tags":["report"]},{"url":"https://bugzilla.suse.com/1224648","tags":["report"]},{"url":"https://bugzilla.suse.com/1224650","tags":["report"]},{"url":"https://bugzilla.suse.com/1224663","tags":["report"]},{"url":"https://bugzilla.suse.com/1224671","tags":["report"]},{"url":"https://bugzilla.suse.com/1224676","tags":["report"]},{"url":"https://bugzilla.suse.com/1224680","tags":["report"]},{"url":"https://bugzilla.suse.com/1224682","tags":["report"]},{"url":"https://bugzilla.suse.com/1224725","tags":["report"]},{"url":"https://bugzilla.suse.com/1224728","tags":["report"]},{"url":"https://bugzilla.suse.com/1224733","tags":["report"]},{"url":"https://bugzilla.suse.com/1224738","tags":["report"]},{"url":"https://bugzilla.suse.com/1224747","tags":["report"]},{"url":"https://bugzilla.suse.com/1224749","tags":["report"]},{"url":"https://bugzilla.suse.com/1224759","tags":["report"]},{"url":"https://bugzilla.suse.com/1224803","tags":["report"]},{"url":"https://bugzilla.suse.com/1224827","tags":["report"]},{"url":"https://bugzilla.suse.com/1224830","tags":["report"]},{"url":"https://bugzilla.suse.com/1224831","tags":["report"]},{"url":"https://bugzilla.suse.com/1224834","tags":["report"]},{"url":"https://bugzilla.suse.com/1224838","tags":["report"]},{"url":"https://bugzilla.suse.com/1224841","tags":["report"]},{"url":"https://bugzilla.suse.com/1224844","tags":["report"]},{"url":"https://bugzilla.suse.com/1224846","tags":["report"]},{"url":"https://bugzilla.suse.com/1224847","tags":["report"]},{"url":"https://bugzilla.suse.com/1224849","tags":["report"]},{"url":"https://bugzilla.suse.com/1224854","tags":["report"]},{"url":"https://bugzilla.suse.com/1224859","tags":["report"]},{"url":"https://bugzilla.suse.com/1224867","tags":["report"]},{"url":"https://bugzilla.suse.com/1224880","tags":["report"]},{"url":"https://bugzilla.suse.com/1224882","tags":["report"]},{"url":"https://bugzilla.suse.com/1224888","tags":["report"]},{"url":"https://bugzilla.suse.com/1224889","tags":["report"]},{"url":"https://bugzilla.suse.com/1224892","tags":["report"]},{"url":"https://bugzilla.suse.com/1224893","tags":["report"]},{"url":"https://bugzilla.suse.com/1224899","tags":["report"]},{"url":"https://bugzilla.suse.com/1224904","tags":["report"]},{"url":"https://bugzilla.suse.com/1224907","tags":["report"]},{"url":"https://bugzilla.suse.com/1224916","tags":["report"]},{"url":"https://bugzilla.suse.com/1224917","tags":["report"]},{"url":"https://bugzilla.suse.com/1224922","tags":["report"]},{"url":"https://bugzilla.suse.com/1224926","tags":["report"]},{"url":"https://bugzilla.suse.com/1224930","tags":["report"]},{"url":"https://bugzilla.suse.com/1224931","tags":["report"]},{"url":"https://bugzilla.suse.com/1224942","tags":["report"]},{"url":"https://bugzilla.suse.com/1224954","tags":["report"]},{"url":"https://bugzilla.suse.com/1224957","tags":["report"]},{"url":"https://bugzilla.suse.com/1224959","tags":["report"]},{"url":"https://bugzilla.suse.com/1224960","tags":["report"]},{"url":"https://bugzilla.suse.com/1224961","tags":["report"]},{"url":"https://bugzilla.suse.com/1224963","tags":["report"]},{"url":"https://bugzilla.suse.com/1224966","tags":["report"]},{"url":"https://bugzilla.suse.com/1224968","tags":["report"]},{"url":"https://bugzilla.suse.com/1224981","tags":["report"]},{"url":"https://bugzilla.suse.com/1224982","tags":["report"]},{"url":"https://bugzilla.suse.com/1224983","tags":["report"]},{"url":"https://bugzilla.suse.com/1224987","tags":["report"]},{"url":"https://bugzilla.suse.com/1224990","tags":["report"]},{"url":"https://bugzilla.suse.com/1224996","tags":["report"]},{"url":"https://bugzilla.suse.com/1225008","tags":["report"]},{"url":"https://bugzilla.suse.com/1225009","tags":["report"]},{"url":"https://bugzilla.suse.com/1225010","tags":["report"]},{"url":"https://bugzilla.suse.com/1225022","tags":["report"]},{"url":"https://bugzilla.suse.com/1225026","tags":["report"]},{"url":"https://bugzilla.suse.com/1225030","tags":["report"]},{"url":"https://bugzilla.suse.com/1225054","tags":["report"]},{"url":"https://bugzilla.suse.com/1225058","tags":["report"]},{"url":"https://bugzilla.suse.com/1225059","tags":["report"]},{"url":"https://bugzilla.suse.com/1225060","tags":["report"]},{"url":"https://bugzilla.suse.com/1225062","tags":["report"]},{"url":"https://bugzilla.suse.com/1225082","tags":["report"]},{"url":"https://bugzilla.suse.com/1225084","tags":["report"]},{"url":"https://bugzilla.suse.com/1225086","tags":["report"]},{"url":"https://bugzilla.suse.com/1225092","tags":["report"]},{"url":"https://bugzilla.suse.com/1225096","tags":["report"]},{"url":"https://bugzilla.suse.com/1225112","tags":["report"]},{"url":"https://bugzilla.suse.com/1225124","tags":["report"]},{"url":"https://bugzilla.suse.com/1225128","tags":["report"]},{"url":"https://bugzilla.suse.com/1225132","tags":["report"]},{"url":"https://bugzilla.suse.com/1225141","tags":["report"]},{"url":"https://bugzilla.suse.com/1225143","tags":["report"]},{"url":"https://bugzilla.suse.com/1225144","tags":["report"]},{"url":"https://bugzilla.suse.com/1225151","tags":["report"]},{"url":"https://bugzilla.suse.com/1225153","tags":["report"]},{"url":"https://bugzilla.suse.com/1225155","tags":["report"]},{"url":"https://bugzilla.suse.com/1225157","tags":["report"]},{"url":"https://bugzilla.suse.com/1225164","tags":["report"]},{"url":"https://bugzilla.suse.com/1225177","tags":["report"]},{"url":"https://bugzilla.suse.com/1225189","tags":["report"]},{"url":"https://bugzilla.suse.com/1225192","tags":["report"]},{"url":"https://bugzilla.suse.com/1225193","tags":["report"]},{"url":"https://bugzilla.suse.com/1225198","tags":["report"]},{"url":"https://bugzilla.suse.com/1225201","tags":["report"]},{"url":"https://bugzilla.suse.com/1225207","tags":["report"]},{"url":"https://bugzilla.suse.com/1225208","tags":["report"]},{"url":"https://bugzilla.suse.com/1225222","tags":["report"]},{"url":"https://bugzilla.suse.com/1225230","tags":["report"]},{"url":"https://bugzilla.suse.com/1225242","tags":["report"]},{"url":"https://bugzilla.suse.com/1225244","tags":["report"]},{"url":"https://bugzilla.suse.com/1225247","tags":["report"]},{"url":"https://bugzilla.suse.com/1225251","tags":["report"]},{"url":"https://bugzilla.suse.com/1225252","tags":["report"]},{"url":"https://bugzilla.suse.com/1225256","tags":["report"]},{"url":"https://bugzilla.suse.com/1225303","tags":["report"]},{"url":"https://bugzilla.suse.com/1225318","tags":["report"]},{"url":"https://bugzilla.suse.com/1225322","tags":["report"]},{"url":"https://bugzilla.suse.com/1225329","tags":["report"]},{"url":"https://bugzilla.suse.com/1225330","tags":["report"]},{"url":"https://bugzilla.suse.com/1225336","tags":["report"]},{"url":"https://bugzilla.suse.com/1225347","tags":["report"]},{"url":"https://bugzilla.suse.com/1225351","tags":["report"]},{"url":"https://bugzilla.suse.com/1225354","tags":["report"]},{"url":"https://bugzilla.suse.com/1225355","tags":["report"]},{"url":"https://bugzilla.suse.com/1225360","tags":["report"]},{"url":"https://bugzilla.suse.com/1225366","tags":["report"]},{"url":"https://bugzilla.suse.com/1225367","tags":["report"]},{"url":"https://bugzilla.suse.com/1225384","tags":["report"]},{"url":"https://bugzilla.suse.com/1225390","tags":["report"]},{"url":"https://bugzilla.suse.com/1225404","tags":["report"]},{"url":"https://bugzilla.suse.com/1225409","tags":["report"]},{"url":"https://bugzilla.suse.com/1225411","tags":["report"]},{"url":"https://bugzilla.suse.com/1225438","tags":["report"]},{"url":"https://bugzilla.suse.com/1225453","tags":["report"]},{"url":"https://bugzilla.suse.com/1225479","tags":["report"]},{"url":"https://bugzilla.suse.com/1225482","tags":["report"]},{"url":"https://bugzilla.suse.com/1225506","tags":["report"]},{"url":"https://bugzilla.suse.com/1225549","tags":["report"]},{"url":"https://bugzilla.suse.com/1225560","tags":["report"]},{"url":"https://bugzilla.suse.com/1225572","tags":["report"]},{"url":"https://bugzilla.suse.com/1225640","tags":["report"]},{"url":"https://bugzilla.suse.com/1225708","tags":["report"]},{"url":"https://bugzilla.suse.com/1225764","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36954","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224956","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242184-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223062","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244367-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082555","tags":["report"]},{"url":"https://bugzilla.suse.com/1157160","tags":["report"]},{"url":"https://bugzilla.suse.com/1218644","tags":["report"]},{"url":"https://bugzilla.suse.com/1222364","tags":["report"]},{"url":"https://bugzilla.suse.com/1222413","tags":["report"]},{"url":"https://bugzilla.suse.com/1223044","tags":["report"]},{"url":"https://bugzilla.suse.com/1223769","tags":["report"]},{"url":"https://bugzilla.suse.com/1224526","tags":["report"]},{"url":"https://bugzilla.suse.com/1225730","tags":["report"]},{"url":"https://bugzilla.suse.com/1225742","tags":["report"]},{"url":"https://bugzilla.suse.com/1228015","tags":["report"]},{"url":"https://bugzilla.suse.com/1228650","tags":["report"]},{"url":"https://bugzilla.suse.com/1228708","tags":["report"]},{"url":"https://bugzilla.suse.com/1228779","tags":["report"]},{"url":"https://bugzilla.suse.com/1230231","tags":["report"]},{"url":"https://bugzilla.suse.com/1230429","tags":["report"]},{"url":"https://bugzilla.suse.com/1230766","tags":["report"]},{"url":"https://bugzilla.suse.com/1230773","tags":["report"]},{"url":"https://bugzilla.suse.com/1230784","tags":["report"]},{"url":"https://bugzilla.suse.com/1230827","tags":["report"]},{"url":"https://bugzilla.suse.com/1231184","tags":["report"]},{"url":"https://bugzilla.suse.com/1231439","tags":["report"]},{"url":"https://bugzilla.suse.com/1231904","tags":["report"]},{"url":"https://bugzilla.suse.com/1231920","tags":["report"]},{"url":"https://bugzilla.suse.com/1231930","tags":["report"]},{"url":"https://bugzilla.suse.com/1232157","tags":["report"]},{"url":"https://bugzilla.suse.com/1232159","tags":["report"]},{"url":"https://bugzilla.suse.com/1232165","tags":["report"]},{"url":"https://bugzilla.suse.com/1232198","tags":["report"]},{"url":"https://bugzilla.suse.com/1232201","tags":["report"]},{"url":"https://bugzilla.suse.com/1232224","tags":["report"]},{"url":"https://bugzilla.suse.com/1232251","tags":["report"]},{"url":"https://bugzilla.suse.com/1232272","tags":["report"]},{"url":"https://bugzilla.suse.com/1232329","tags":["report"]},{"url":"https://bugzilla.suse.com/1232371","tags":["report"]},{"url":"https://bugzilla.suse.com/1232436","tags":["report"]},{"url":"https://bugzilla.suse.com/1232507","tags":["report"]},{"url":"https://bugzilla.suse.com/1232520","tags":["report"]},{"url":"https://bugzilla.suse.com/1232552","tags":["report"]},{"url":"https://bugzilla.suse.com/1232873","tags":["report"]},{"url":"https://bugzilla.suse.com/1232887","tags":["report"]},{"url":"https://bugzilla.suse.com/1232888","tags":["report"]},{"url":"https://bugzilla.suse.com/1232897","tags":["report"]},{"url":"https://bugzilla.suse.com/1232919","tags":["report"]},{"url":"https://bugzilla.suse.com/1232928","tags":["report"]},{"url":"https://bugzilla.suse.com/1233049","tags":["report"]},{"url":"https://bugzilla.suse.com/1233051","tags":["report"]},{"url":"https://bugzilla.suse.com/1233057","tags":["report"]},{"url":"https://bugzilla.suse.com/1233063","tags":["report"]},{"url":"https://bugzilla.suse.com/1233070","tags":["report"]},{"url":"https://bugzilla.suse.com/1233097","tags":["report"]},{"url":"https://bugzilla.suse.com/1233103","tags":["report"]},{"url":"https://bugzilla.suse.com/1233108","tags":["report"]},{"url":"https://bugzilla.suse.com/1233111","tags":["report"]},{"url":"https://bugzilla.suse.com/1233123","tags":["report"]},{"url":"https://bugzilla.suse.com/1233130","tags":["report"]},{"url":"https://bugzilla.suse.com/1233191","tags":["report"]},{"url":"https://bugzilla.suse.com/1233211","tags":["report"]},{"url":"https://bugzilla.suse.com/1233212","tags":["report"]},{"url":"https://bugzilla.suse.com/1233216","tags":["report"]},{"url":"https://bugzilla.suse.com/1233453","tags":["report"]},{"url":"https://bugzilla.suse.com/1233454","tags":["report"]},{"url":"https://bugzilla.suse.com/1233456","tags":["report"]},{"url":"https://bugzilla.suse.com/1233462","tags":["report"]},{"url":"https://bugzilla.suse.com/1233467","tags":["report"]},{"url":"https://bugzilla.suse.com/1233468","tags":["report"]},{"url":"https://bugzilla.suse.com/1233478","tags":["report"]},{"url":"https://bugzilla.suse.com/1233479","tags":["report"]},{"url":"https://bugzilla.suse.com/1233485","tags":["report"]},{"url":"https://bugzilla.suse.com/1233490","tags":["report"]},{"url":"https://bugzilla.suse.com/1233491","tags":["report"]},{"url":"https://bugzilla.suse.com/1233552","tags":["report"]},{"url":"https://bugzilla.suse.com/1233555","tags":["report"]},{"url":"https://bugzilla.suse.com/1233557","tags":["report"]},{"url":"https://bugzilla.suse.com/1233560","tags":["report"]},{"url":"https://bugzilla.suse.com/1233577","tags":["report"]},{"url":"https://bugzilla.suse.com/1233580","tags":["report"]},{"url":"https://bugzilla.suse.com/1234025","tags":["report"]},{"url":"https://bugzilla.suse.com/1234072","tags":["report"]},{"url":"https://bugzilla.suse.com/1234087","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53142","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250035-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-47162","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-47162","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-47162","title":"tipc: skb_linearize the head skb when reassembling msgs","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: skb_linearize the head skb when reassembling msgs\n\nIt's not a good idea to append the frag skb to a skb's frag_list if\nthe frag_list already has skbs from elsewhere, such as this skb was\ncreated by pskb_copy() where the frag_list was cloned (all the skbs\nin it were skb_get'ed) and shared by multiple skbs.\n\nHowever, the new appended frag skb should have been only seen by the\ncurrent skb. Otherwise, it will cause use after free crashes as this\nappended frag skb are seen by multiple skbs but it only got skb_get\ncalled once.\n\nThe same thing happens with a skb updated by pskb_may_pull() with a\nskb_cloned skb. Li Shuang has reported quite a few crashes caused\nby this when doing testing over macvlan devices:\n\n  [] kernel BUG at net/core/skbuff.c:1970!\n  [] Call Trace:\n  []  skb_clone+0x4d/0xb0\n  []  macvlan_broadcast+0xd8/0x160 [macvlan]\n  []  macvlan_process_broadcast+0x148/0x150 [macvlan]\n  []  process_one_work+0x1a7/0x360\n  []  worker_thread+0x30/0x390\n\n  [] kernel BUG at mm/usercopy.c:102!\n  [] Call Trace:\n  []  __check_heap_object+0xd3/0x100\n  []  __check_object_size+0xff/0x16b\n  []  simple_copy_to_iter+0x1c/0x30\n  []  __skb_datagram_iter+0x7d/0x310\n  []  __skb_datagram_iter+0x2a5/0x310\n  []  skb_copy_datagram_iter+0x3b/0x90\n  []  tipc_recvmsg+0x14a/0x3a0 [tipc]\n  []  ____sys_recvmsg+0x91/0x150\n  []  ___sys_recvmsg+0x7b/0xc0\n\n  [] kernel BUG at mm/slub.c:305!\n  [] Call Trace:\n  []  \u003cIRQ\u003e\n  []  kmem_cache_free+0x3ff/0x400\n  []  __netif_receive_skb_core+0x12c/0xc40\n  []  ? kmem_cache_alloc+0x12e/0x270\n  []  netif_receive_skb_internal+0x3d/0xb0\n  []  ? get_rx_page_info+0x8e/0xa0 [be2net]\n  []  be_poll+0x6ef/0xd00 [be2net]\n  []  ? irq_exit+0x4f/0x100\n  []  net_rx_action+0x149/0x3b0\n\n  ...\n\nThis patch is to fix it by linearizing the head skb if it has frag_list\nset in tipc_buf_append(). Note that we choose to do this before calling\nskb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can\nnot just drop the frag_list either as the early time.","status":"published","published":"2024-03-25T09:16:15.857Z","modified":"2026-08-05T08:46:26.121Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"updated_at":"2026-11-02T14:32:56.308189Z"}],"euvd":[{"id":"EUVD-2021-33810","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: skb_linearize the head skb when reassembling msgs\n\nIt's not a good idea to append the frag skb to a skb's frag_list if\nthe frag_list already has skbs from elsewhere, such as this skb was\ncreated by pskb_copy() where the frag_list was cloned (all the skbs\nin it were skb_get'ed) and shared by multiple skbs.\n\nHowever, the new appended frag skb should have been only seen by the\ncurrent skb. Otherwise, it will cause use after free crashes as this\nappended frag skb are seen by multiple skbs but it only got skb_get\ncalled once.\n\nThe same thing happens with a skb updated by pskb_may_pull() with a\nskb_cloned skb. Li Shuang has reported quite a few crashes caused\nby this when doing testing over macvlan devices:\n\n  [] kernel BUG at net/core/skbuff.c:1970!\n  [] Call Trace:\n  []  skb_clone+0x4d/0xb0\n  []  macvlan_broadcast+0xd8/0x160 [macvlan]\n  []  macvlan_process_broadcast+0x148/0x150 [macvlan]\n  []  process_one_work+0x1a7/0x360\n  []  worker_thread+0x30/0x390\n\n  [] kernel BUG at mm/usercopy.c:102!\n  [] Call Trace:\n  []  __check_heap_object+0xd3/0x100\n  []  __check_object_size+0xff/0x16b\n  []  simple_copy_to_iter+0x1c/0x30\n  []  __skb_datagram_iter+0x7d/0x310\n  []  __skb_datagram_iter+0x2a5/0x310\n  []  skb_copy_datagram_iter+0x3b/0x90\n  []  tipc_recvmsg+0x14a/0x3a0 [tipc]\n  []  ____sys_recvmsg+0x91/0x150\n  []  ___sys_recvmsg+0x7b/0xc0\n\n  [] kernel BUG at mm/slub.c:305!\n  [] Call Trace:\n  []  \u003cIRQ\u003e\n  []  kmem_cache_free+0x3ff/0x400\n  []  __netif_receive_skb_core+0x12c/0xc40\n  []  ? kmem_cache_alloc+0x12e/0x270\n  []  netif_receive_skb_internal+0x3d/0xb0\n  []  ? get_rx_page_info+0x8e/0xa0 [be2net]\n  []  be_poll+0x6ef/0xd00 [be2net]\n  []  ? irq_exit+0x4f/0x100\n  []  net_rx_action+0x149/0x3b0\n\n  ...\n\nThis patch is to fix it by linearizing the head skb if it has frag_list\nset in tipc_buf_append(). Note that we choose to do this before calling\nskb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can\nnot just drop the frag_list either as the early time.","status":"published","published":"2024-03-25T09:16:15Z","modified":"2026-08-05T08:46:26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:02:21.767149Z"}],"ghsa":[{"id":"GHSA-86fr-x2qv-cxp5","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: skb_linearize the head...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: skb_linearize the head skb when reassembling msgs\n\nIt's not a good idea to append the frag skb to a skb's frag_list if\nthe frag_list already has skbs from elsewhere, such as this skb was\ncreated by pskb_copy() where the frag_list was cloned (all the skbs\nin it were skb_get'ed) and shared by multiple skbs.\n\nHowever, the new appended frag skb should have been only seen by the\ncurrent skb. Otherwise, it will cause use after free crashes as this\nappended frag skb are seen by multiple skbs but it only got skb_get\ncalled once.\n\nThe same thing happens with a skb updated by pskb_may_pull() with a\nskb_cloned skb. Li Shuang has reported quite a few crashes caused\nby this when doing testing over macvlan devices:\n\n  [] kernel BUG at net/core/skbuff.c:1970!\n  [] Call Trace:\n  []  skb_clone+0x4d/0xb0\n  []  macvlan_broadcast+0xd8/0x160 [macvlan]\n  []  macvlan_process_broadcast+0x148/0x150 [macvlan]\n  []  process_one_work+0x1a7/0x360\n  []  worker_thread+0x30/0x390\n\n  [] kernel BUG at mm/usercopy.c:102!\n  [] Call Trace:\n  []  __check_heap_object+0xd3/0x100\n  []  __check_object_size+0xff/0x16b\n  []  simple_copy_to_iter+0x1c/0x30\n  []  __skb_datagram_iter+0x7d/0x310\n  []  __skb_datagram_iter+0x2a5/0x310\n  []  skb_copy_datagram_iter+0x3b/0x90\n  []  tipc_recvmsg+0x14a/0x3a0 [tipc]\n  []  ____sys_recvmsg+0x91/0x150\n  []  ___sys_recvmsg+0x7b/0xc0\n\n  [] kernel BUG at mm/slub.c:305!\n  [] Call Trace:\n  []  \u003cIRQ\u003e\n  []  kmem_cache_free+0x3ff/0x400\n  []  __netif_receive_skb_core+0x12c/0xc40\n  []  ? kmem_cache_alloc+0x12e/0x270\n  []  netif_receive_skb_internal+0x3d/0xb0\n  []  ? get_rx_page_info+0x8e/0xa0 [be2net]\n  []  be_poll+0x6ef/0xd00 [be2net]\n  []  ? irq_exit+0x4f/0x100\n  []  net_rx_action+0x149/0x3b0\n\n  ...\n\nThis patch is to fix it by linearizing the head skb if it has frag_list\nset in tipc_buf_append(). Note that we choose to do this before calling\nskb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can\nnot just drop the frag_list either as the early time.","status":"published","published":"2024-03-25T12:30:51Z","modified":"2025-03-13T21:32:05Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:00:16.694376Z"}],"nvd":[{"id":"CVE-2021-47162","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: skb_linearize the head skb when reassembling msgs\n\nIt's not a good idea to append the frag skb to a skb's frag_list if\nthe frag_list already has skbs from elsewhere, such as this skb was\ncreated by pskb_copy() where the frag_list was cloned (all the skbs\nin it were skb_get'ed) and shared by multiple skbs.\n\nHowever, the new appended frag skb should have been only seen by the\ncurrent skb. Otherwise, it will cause use after free crashes as this\nappended frag skb are seen by multiple skbs but it only got skb_get\ncalled once.\n\nThe same thing happens with a skb updated by pskb_may_pull() with a\nskb_cloned skb. Li Shuang has reported quite a few crashes caused\nby this when doing testing over macvlan devices:\n\n  [] kernel BUG at net/core/skbuff.c:1970!\n  [] Call Trace:\n  []  skb_clone+0x4d/0xb0\n  []  macvlan_broadcast+0xd8/0x160 [macvlan]\n  []  macvlan_process_broadcast+0x148/0x150 [macvlan]\n  []  process_one_work+0x1a7/0x360\n  []  worker_thread+0x30/0x390\n\n  [] kernel BUG at mm/usercopy.c:102!\n  [] Call Trace:\n  []  __check_heap_object+0xd3/0x100\n  []  __check_object_size+0xff/0x16b\n  []  simple_copy_to_iter+0x1c/0x30\n  []  __skb_datagram_iter+0x7d/0x310\n  []  __skb_datagram_iter+0x2a5/0x310\n  []  skb_copy_datagram_iter+0x3b/0x90\n  []  tipc_recvmsg+0x14a/0x3a0 [tipc]\n  []  ____sys_recvmsg+0x91/0x150\n  []  ___sys_recvmsg+0x7b/0xc0\n\n  [] kernel BUG at mm/slub.c:305!\n  [] Call Trace:\n  []  \u003cIRQ\u003e\n  []  kmem_cache_free+0x3ff/0x400\n  []  __netif_receive_skb_core+0x12c/0xc40\n  []  ? kmem_cache_alloc+0x12e/0x270\n  []  netif_receive_skb_internal+0x3d/0xb0\n  []  ? get_rx_page_info+0x8e/0xa0 [be2net]\n  []  be_poll+0x6ef/0xd00 [be2net]\n  []  ? irq_exit+0x4f/0x100\n  []  net_rx_action+0x149/0x3b0\n\n  ...\n\nThis patch is to fix it by linearizing the head skb if it has frag_list\nset in tipc_buf_append(). Note that we choose to do this before calling\nskb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can\nnot just drop the frag_list either as the early time.","status":"published","published":"2024-03-25T10:15:08.48Z","modified":"2026-08-04T10:16:49.79Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:07:08.163458Z"}],"osv":[{"id":"CVE-2021-47162","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: skb_linearize the head skb when reassembling msgs\n\nIt's not a good idea to append the frag skb to a skb's frag_list if\nthe frag_list already has skbs from elsewhere, such as this skb was\ncreated by pskb_copy() where the frag_list was cloned (all the skbs\nin it were skb_get'ed) and shared by multiple skbs.\n\nHowever, the new appended frag skb should have been only seen by the\ncurrent skb. Otherwise, it will cause use after free crashes as this\nappended frag skb are seen by multiple skbs but it only got skb_get\ncalled once.\n\nThe same thing happens with a skb updated by pskb_may_pull() with a\nskb_cloned skb. Li Shuang has reported quite a few crashes caused\nby this when doing testing over macvlan devices:\n\n  [] kernel BUG at net/core/skbuff.c:1970!\n  [] Call Trace:\n  []  skb_clone+0x4d/0xb0\n  []  macvlan_broadcast+0xd8/0x160 [macvlan]\n  []  macvlan_process_broadcast+0x148/0x150 [macvlan]\n  []  process_one_work+0x1a7/0x360\n  []  worker_thread+0x30/0x390\n\n  [] kernel BUG at mm/usercopy.c:102!\n  [] Call Trace:\n  []  __check_heap_object+0xd3/0x100\n  []  __check_object_size+0xff/0x16b\n  []  simple_copy_to_iter+0x1c/0x30\n  []  __skb_datagram_iter+0x7d/0x310\n  []  __skb_datagram_iter+0x2a5/0x310\n  []  skb_copy_datagram_iter+0x3b/0x90\n  []  tipc_recvmsg+0x14a/0x3a0 [tipc]\n  []  ____sys_recvmsg+0x91/0x150\n  []  ___sys_recvmsg+0x7b/0xc0\n\n  [] kernel BUG at mm/slub.c:305!\n  [] Call Trace:\n  []  \u003cIRQ\u003e\n  []  kmem_cache_free+0x3ff/0x400\n  []  __netif_receive_skb_core+0x12c/0xc40\n  []  ? kmem_cache_alloc+0x12e/0x270\n  []  netif_receive_skb_internal+0x3d/0xb0\n  []  ? get_rx_page_info+0x8e/0xa0 [be2net]\n  []  be_poll+0x6ef/0xd00 [be2net]\n  []  ? irq_exit+0x4f/0x100\n  []  net_rx_action+0x149/0x3b0\n\n  ...\n\nThis patch is to fix it by linearizing the head skb if it has frag_list\nset in tipc_buf_append(). Note that we choose to do this before calling\nskb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can\nnot just drop the frag_list either as the early time.","status":"published","published":"2024-03-25T10:15:08.48Z","modified":"2026-03-15T14:45:43.178889Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:22.470367Z"},{"id":"DEBIAN-CVE-2021-47162","description":"In the Linux kernel, the following vulnerability has been resolved:  tipc: skb_linearize the head skb when reassembling msgs  It's not a good idea to append the frag skb to a skb's frag_list if the frag_list already has skbs from elsewhere, such as this skb was created by pskb_copy() where the frag_list was cloned (all the skbs in it were skb_get'ed) and shared by multiple skbs.  However, the new appended frag skb should have been only seen by the current skb. Otherwise, it will cause use after free crashes as this appended frag skb are seen by multiple skbs but it only got skb_get called once.  The same thing happens with a skb updated by pskb_may_pull() with a skb_cloned skb. Li Shuang has reported quite a few crashes caused by this when doing testing over macvlan devices:    [] kernel BUG at net/core/skbuff.c:1970!   [] Call Trace:   []  skb_clone+0x4d/0xb0   []  macvlan_broadcast+0xd8/0x160 [macvlan]   []  macvlan_process_broadcast+0x148/0x150 [macvlan]   []  process_one_work+0x1a7/0x360   []  worker_thread+0x30/0x390    [] kernel BUG at mm/usercopy.c:102!   [] Call Trace:   []  __check_heap_object+0xd3/0x100   []  __check_object_size+0xff/0x16b   []  simple_copy_to_iter+0x1c/0x30   []  __skb_datagram_iter+0x7d/0x310   []  __skb_datagram_iter+0x2a5/0x310   []  skb_copy_datagram_iter+0x3b/0x90   []  tipc_recvmsg+0x14a/0x3a0 [tipc]   []  ____sys_recvmsg+0x91/0x150   []  ___sys_recvmsg+0x7b/0xc0    [] kernel BUG at mm/slub.c:305!   [] Call Trace:   []  \u003cIRQ\u003e   []  kmem_cache_free+0x3ff/0x400   []  __netif_receive_skb_core+0x12c/0xc40   []  ? kmem_cache_alloc+0x12e/0x270   []  netif_receive_skb_internal+0x3d/0xb0   []  ? get_rx_page_info+0x8e/0xa0 [be2net]   []  be_poll+0x6ef/0xd00 [be2net]   []  ? irq_exit+0x4f/0x100   []  net_rx_action+0x149/0x3b0    ...  This patch is to fix it by linearizing the head skb if it has frag_list set in tipc_buf_append(). Note that we choose to do this before calling skb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can not just drop the frag_list either as the early time.","status":"published","published":"2024-03-25T10:15:08.48Z","modified":"2026-10-23T18:05:23.524278628Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:36.081807Z"},{"id":"OESA-2024-1483","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ni2c: img-scb: fix reference leak when pm_runtime_get_sync fails\r\n\r\nThe PM reference count is not expected to be incremented on\nreturn in functions img_i2c_xfer and img_i2c_init.\r\n\r\nHowever, pm_runtime_get_sync will increment the PM reference\ncount even failed. Forgetting to putting operation will result\nin a reference leak here.\r\n\r\nReplace it with pm_runtime_resume_and_get to keep usage\ncounter balanced.(CVE-2020-36783)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nkyber: fix out of bounds access when preempted\r\n\r\n__blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and\npasses the hctx to -\u0026gt;bio_merge(). kyber_bio_merge() then gets the ctx\nfor the current CPU again and uses that to get the corresponding Kyber\ncontext in the passed hctx. However, the thread may be preempted between\nthe two calls to blk_mq_get_ctx(), and the ctx returned the second time\nmay no longer correspond to the passed hctx. This \u0026quot;works\u0026quot; accidentally\nmost of the time, but it can cause us to read garbage if the second ctx\ncame from an hctx with more ctx\u0026apos;s than the first one (i.e., if\nctx-\u0026gt;index_hw[hctx-\u0026gt;type] \u0026gt; hctx-\u0026gt;nr_ctx).\r\n\r\nThis manifested as this UBSAN array index out of bounds error reported\nby Jakub:\r\n\r\nUBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9\nindex 13106 is out of range for type \u0026apos;long unsigned int [128]\u0026apos;\nCall Trace:\n dump_stack+0xa4/0xe5\n ubsan_epilogue+0x5/0x40\n __ubsan_handle_out_of_bounds.cold.13+0x2a/0x34\n queued_spin_lock_slowpath+0x476/0x480\n do_raw_spin_lock+0x1c2/0x1d0\n kyber_bio_merge+0x112/0x180\n blk_mq_submit_bio+0x1f5/0x1100\n submit_bio_noacct+0x7b0/0x870\n submit_bio+0xc2/0x3a0\n btrfs_map_bio+0x4f0/0x9d0\n btrfs_submit_data_bio+0x24e/0x310\n submit_one_bio+0x7f/0xb0\n submit_extent_page+0xc4/0x440\n __extent_writepage_io+0x2b8/0x5e0\n __extent_writepage+0x28d/0x6e0\n extent_write_cache_pages+0x4d7/0x7a0\n extent_writepages+0xa2/0x110\n do_writepages+0x8f/0x180\n __writeback_single_inode+0x99/0x7f0\n writeback_sb_inodes+0x34e/0x790\n __writeback_inodes_wb+0x9e/0x120\n wb_writeback+0x4d2/0x660\n wb_workfn+0x64d/0xa10\n process_one_work+0x53a/0xa80\n worker_thread+0x69/0x5b0\n kthread+0x20b/0x240\n ret_from_fork+0x1f/0x30\r\n\r\nOnly Kyber uses the hctx, so fix it by passing the request_queue to\n-\u0026gt;bio_merge() instead. BFQ and mq-deadline just use that, and Kyber can\nmap the queues itself to avoid the mismatch.(CVE-2021-46984)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbus: qcom: Put child node before return\r\n\r\nPut child node before return to fix potential reference count leak.\nGenerally, the reference count of child is incremented and decremented\nautomatically in the macro for_each_available_child_of_node() and should\nbe decremented manually if the loop is broken in loop body.(CVE-2021-47054)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncrypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init\r\n\r\nADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown()\nbefore calling adf_iov_putmsg()-\u0026gt;mutex_lock(vf2pf_lock), however the\nvf2pf_lock is initialized in adf_dev_init(), which can fail and when it\nfail, the vf2pf_lock is either not initialized or destroyed, a subsequent\nuse of vf2pf_lock will cause issue.\nTo fix this issue, only set this flag if adf_dev_init() returns 0.\r\n\r\n[    7.178404] BUG: KASAN: user-memory-access in __mutex_lock.isra.0+0x1ac/0x7c0\n[    7.180345] Call Trace:\n[    7.182576]  mutex_lock+0xc9/0xd0\n[    7.183257]  adf_iov_putmsg+0x118/0x1a0 [intel_qat]\n[    7.183541]  adf_vf2pf_shutdown+0x4d/0x7b [intel_qat]\n[    7.183834]  adf_dev_shutdown+0x172/0x2b0 [intel_qat]\n[    7.184127]  adf_probe+0x5e9/0x600 [qat_dh895xccvf](CVE-2021-47056)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nKVM: Stop looking for coalesced MMIO zones if the bus is destroyed\r\n\r\nAbort the walk of coalesced MMIO zones if kvm_io_bus_unregister_dev()\nfails to allocate memory for the new instance of the bus.  If it can\u0026apos;t\ninstantiate a new bus, unregister_dev() destroys all devices _except_ the\ntarget device.   But, it doesn\u0026apos;t tell the caller that it obliterated the\nbus and invoked the destructor for all devices that were on the bus.  In\nthe coalesced MMIO case, this can result in a deleted list entry\ndereference due to attempting to continue iterating on coalesced_zones\nafter future entries (in the walk) have been deleted.\r\n\r\nOpportunistically add curly braces to the for-loop, which encompasses\nmany lines but sneaks by without braces due to the guts being a single\nif statement.(CVE-2021-47060)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nKVM: Destroy I/O bus devices on unregister failure _after_ sync\u0026apos;ing SRCU\r\n\r\nIf allocating a new instance of an I/O bus fails when unregistering a\ndevice, wait to destroy the device until after all readers are guaranteed\nto see the new null bus.  Destroying devices before the bus is nullified\ncould lead to use-after-free since readers expect the devices on their\nreference of the bus to remain valid.(CVE-2021-47061)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm: bridge/panel: Cleanup connector on bridge detach\r\n\r\nIf we don\u0026apos;t call drm_connector_cleanup() manually in\npanel_bridge_detach(), the connector will be cleaned up with the other\nDRM objects in the call to drm_mode_config_cleanup(). However, since our\ndrm_connector is devm-allocated, by the time drm_mode_config_cleanup()\nwill be called, our connector will be long gone. Therefore, the\nconnector must be cleaned up when the bridge is detached to avoid\nuse-after-free conditions.\r\n\r\nv2: Cleanup connector only if it was created\r\n\r\nv3: Add FIXME\r\n\r\nv4: (Use connector-\u0026gt;dev) directly in if() block(CVE-2021-47063)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nuio_hv_generic: Fix a memory leak in error handling paths\r\n\r\nIf \u0026apos;vmbus_establish_gpadl()\u0026apos; fails, the (recv|send)_gpadl will not be\nupdated and \u0026apos;hv_uio_cleanup()\u0026apos; in the error handling path will not be\nable to free the corresponding buffer.\r\n\r\nIn such a case, we need to free the buffer explicitly.(CVE-2021-47071)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnvme-loop: fix memory leak in nvme_loop_create_ctrl()\r\n\r\nWhen creating loop ctrl in nvme_loop_create_ctrl(), if nvme_init_ctrl()\nfails, the loop ctrl should be freed before jumping to the \u0026quot;out\u0026quot; label.(CVE-2021-47074)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nscsi: qedf: Add pointer checks in qedf_update_link_speed()\r\n\r\nThe following trace was observed:\r\n\r\n [   14.042059] Call Trace:\n [   14.042061]  \u0026lt;IRQ\u0026gt;\n [   14.042068]  qedf_link_update+0x144/0x1f0 [qedf]\n [   14.042117]  qed_link_update+0x5c/0x80 [qed]\n [   14.042135]  qed_mcp_handle_link_change+0x2d2/0x410 [qed]\n [   14.042155]  ? qed_set_ptt+0x70/0x80 [qed]\n [   14.042170]  ? qed_set_ptt+0x70/0x80 [qed]\n [   14.042186]  ? qed_rd+0x13/0x40 [qed]\n [   14.042205]  qed_mcp_handle_events+0x437/0x690 [qed]\n [   14.042221]  ? qed_set_ptt+0x70/0x80 [qed]\n [   14.042239]  qed_int_sp_dpc+0x3a6/0x3e0 [qed]\n [   14.042245]  tasklet_action_common.isra.14+0x5a/0x100\n [   14.042250]  __do_softirq+0xe4/0x2f8\n [   14.042253]  irq_exit+0xf7/0x100\n [   14.042255]  do_IRQ+0x7f/0xd0\n [   14.042257]  common_interrupt+0xf/0xf\n [   14.042259]  \u0026lt;/IRQ\u0026gt;\r\n\r\nAPI qedf_link_update() is getting called from QED but by that time\nshost_data is not initialised. This results in a NULL pointer dereference\nwhen we try to dereference shost_data while updating supported_speeds.\r\n\r\nAdd a NULL pointer check before dereferencing shost_data.(CVE-2021-47077)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/rxe: Clear all QP fields if creation failed\r\n\r\nrxe_qp_do_cleanup() relies on valid pointer values in QP for the properly\ncreated ones, but in case rxe_qp_from_init() failed it was filled with\ngarbage and caused tot the following error.\r\n\r\n  refcount_t: underflow; use-after-free.\n  WARNING: CPU: 1 PID: 12560 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28\n  Modules linked in:\n  CPU: 1 PID: 12560 Comm: syz-executor.4 Not tainted 5.12.0-syzkaller #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n  RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28\n  Code: e9 db fe ff ff 48 89 df e8 2c c2 ea fd e9 8a fe ff ff e8 72 6a a7 fd 48 c7 c7 e0 b2 c1 89 c6 05 dc 3a e6 09 01 e8 ee 74 fb 04 \u0026lt;0f\u0026gt; 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55\n  RSP: 0018:ffffc900097ceba8 EFLAGS: 00010286\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n  RDX: 0000000000040000 RSI: ffffffff815bb075 RDI: fffff520012f9d67\n  RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000\n  R10: ffffffff815b4eae R11: 0000000000000000 R12: ffff8880322a4800\n  R13: ffff8880322a4940 R14: ffff888033044e00 R15: 0000000000000000\n  FS:  00007f6eb2be3700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007fdbe5d41000 CR3: 000000001d181000 CR4: 00000000001506e0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  Call Trace:\n   __refcount_sub_and_test include/linux/refcount.h:283 [inline]\n   __refcount_dec_and_test include/linux/refcount.h:315 [inline]\n   refcount_dec_and_test include/linux/refcount.h:333 [inline]\n   kref_put include/linux/kref.h:64 [inline]\n   rxe_qp_do_cleanup+0x96f/0xaf0 drivers/infiniband/sw/rxe/rxe_qp.c:805\n   execute_in_process_context+0x37/0x150 kernel/workqueue.c:3327\n   rxe_elem_release+0x9f/0x180 drivers/infiniband/sw/rxe/rxe_pool.c:391\n   kref_put include/linux/kref.h:65 [inline]\n   rxe_create_qp+0x2cd/0x310 drivers/infiniband/sw/rxe/rxe_verbs.c:425\n   _ib_create_qp drivers/infiniband/core/core_priv.h:331 [inline]\n   ib_create_named_qp+0x2ad/0x1370 drivers/infiniband/core/verbs.c:1231\n   ib_create_qp include/rdma/ib_verbs.h:3644 [inline]\n   create_mad_qp+0x177/0x2d0 drivers/infiniband/core/mad.c:2920\n   ib_mad_port_open drivers/infiniband/core/mad.c:3001 [inline]\n   ib_mad_init_device+0xd6f/0x1400 drivers/infiniband/core/mad.c:3092\n   add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:717\n   enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1331\n   ib_register_device drivers/infiniband/core/device.c:1413 [inline]\n   ib_register_device+0x7c7/0xa50 drivers/infiniband/core/device.c:1365\n   rxe_register_device+0x3d5/0x4a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1147\n   rxe_add+0x12fe/0x16d0 drivers/infiniband/sw/rxe/rxe.c:247\n   rxe_net_add+0x8c/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:503\n   rxe_newlink drivers/infiniband/sw/rxe/rxe.c:269 [inline]\n   rxe_newlink+0xb7/0xe0 drivers/infiniband/sw/rxe/rxe.c:250\n   nldev_newlink+0x30e/0x550 drivers/infiniband/core/nldev.c:1555\n   rdma_nl_rcv_msg+0x36d/0x690 drivers/infiniband/core/netlink.c:195\n   rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]\n   rdma_nl_rcv+0x2ee/0x430 drivers/infiniband/core/netlink.c:259\n   netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]\n   netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338\n   netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927\n   sock_sendmsg_nosec net/socket.c:654 [inline]\n   sock_sendmsg+0xcf/0x120 net/socket.c:674\n   ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350\n   ___sys_sendmsg+0xf3/0x170 net/socket.c:2404\n   __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433\n   do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47\n   entry_SYSCALL_64_after_hwframe+0\n---truncated---(CVE-2021-47078)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nasix: fix uninit-value in asix_mdio_read()\r\n\r\nasix_read_cmd() may read less than sizeof(smsr) bytes and in this case\nsmsr will be uninitialized.\r\n\r\nFail log:\nBUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline]\nBUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497\nBUG: KMSAN: uninit-value in asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497\n asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline]\n asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497\n asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497(CVE-2021-47101)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/tls: Fix use-after-free after the TLS device goes down and up\r\n\r\nWhen a netdev with active TLS offload goes down, tls_device_down is\ncalled to stop the offload and tear down the TLS context. However, the\nsocket stays alive, and it still points to the TLS context, which is now\ndeallocated. If a netdev goes up, while the connection is still active,\nand the data flow resumes after a number of TCP retransmissions, it will\nlead to a use-after-free of the TLS context.\r\n\r\nThis commit addresses this bug by keeping the context alive until its\nnormal destruction, and implements the necessary fallbacks, so that the\nconnection can resume in software (non-offloaded) kTLS mode.\r\n\r\nOn the TX side tls_sw_fallback is used to encrypt all packets. The RX\nside already has all the necessary fallbacks, because receiving\nnon-decrypted packets is supported. The thing needed on the RX side is\nto block resync requests, which are normally produced after receiving\nnon-decrypted packets.\r\n\r\nThe necessary synchronization is implemented for a graceful teardown:\nfirst the fallbacks are deployed, then the driver resources are released\n(it used to be possible to have a tls_dev_resync after tls_dev_del).\r\n\r\nA new flag called TLS_RX_DEV_DEGRADED is added to indicate the fallback\nmode. It\u0026apos;s used to skip the RX resync logic completely, as it becomes\nuseless, and some objects may be released (for example, resync_async,\nwhich is allocated and freed by the driver).(CVE-2021-47131)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amdgpu: Fix a use-after-free\r\n\r\nlooks like we forget to set ttm-\u0026gt;sg to NULL.\nHit panic below\r\n\r\n[ 1235.844104] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI\n[ 1235.989074] Call Trace:\n[ 1235.991751]  sg_free_table+0x17/0x20\n[ 1235.995667]  amdgpu_ttm_backend_unbind.cold+0x4d/0xf7 [amdgpu]\n[ 1236.002288]  amdgpu_ttm_backend_destroy+0x29/0x130 [amdgpu]\n[ 1236.008464]  ttm_tt_destroy+0x1e/0x30 [ttm]\n[ 1236.013066]  ttm_bo_cleanup_memtype_use+0x51/0xa0 [ttm]\n[ 1236.018783]  ttm_bo_release+0x262/0xa50 [ttm]\n[ 1236.023547]  ttm_bo_put+0x82/0xd0 [ttm]\n[ 1236.027766]  amdgpu_bo_unref+0x26/0x50 [amdgpu]\n[ 1236.032809]  amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x7aa/0xd90 [amdgpu]\n[ 1236.040400]  kfd_ioctl_alloc_memory_of_gpu+0xe2/0x330 [amdgpu]\n[ 1236.046912]  kfd_ioctl+0x463/0x690 [amdgpu](CVE-2021-47142)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/smc: remove device from smcd_dev_list after failed device_add()\r\n\r\nIf the device_add() for a smcd_dev fails, there\u0026apos;s no cleanup step that\nrolls back the earlier list_add(). The device subsequently gets freed,\nand we end up with a corrupted list.\r\n\r\nAdd some error handling that removes the device from the list.(CVE-2021-47143)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/amdgpu: fix refcount leak\r\n\r\n[Why]\nthe gem object rfb-\u0026gt;base.obj[0] is get according to num_planes\nin amdgpufb_create, but is not put according to num_planes\r\n\r\n[How]\nput rfb-\u0026gt;base.obj[0] in amdgpu_fbdev_destroy according to num_planes(CVE-2021-47144)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: do not BUG_ON in link_to_fixup_dir\r\n\r\nWhile doing error injection testing I got the following panic\r\n\r\n  kernel BUG at fs/btrfs/tree-log.c:1862!\n  invalid opcode: 0000 [#1] SMP NOPTI\n  CPU: 1 PID: 7836 Comm: mount Not tainted 5.13.0-rc1+ #305\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014\n  RIP: 0010:link_to_fixup_dir+0xd5/0xe0\n  RSP: 0018:ffffb5800180fa30 EFLAGS: 00010216\n  RAX: fffffffffffffffb RBX: 00000000fffffffb RCX: ffff8f595287faf0\n  RDX: ffffb5800180fa37 RSI: ffff8f5954978800 RDI: 0000000000000000\n  RBP: ffff8f5953af9450 R08: 0000000000000019 R09: 0000000000000001\n  R10: 000151f408682970 R11: 0000000120021001 R12: ffff8f5954978800\n  R13: ffff8f595287faf0 R14: ffff8f5953c77dd0 R15: 0000000000000065\n  FS:  00007fc5284c8c40(0000) GS:ffff8f59bbd00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007fc5287f47c0 CR3: 000000011275e002 CR4: 0000000000370ee0\n  Call Trace:\n   replay_one_buffer+0x409/0x470\n   ? btree_read_extent_buffer_pages+0xd0/0x110\n   walk_up_log_tree+0x157/0x1e0\n   walk_log_tree+0xa6/0x1d0\n   btrfs_recover_log_trees+0x1da/0x360\n   ? replay_one_extent+0x7b0/0x7b0\n   open_ctree+0x1486/0x1720\n   btrfs_mount_root.cold+0x12/0xea\n   ? __kmalloc_track_caller+0x12f/0x240\n   legacy_get_tree+0x24/0x40\n   vfs_get_tree+0x22/0xb0\n   vfs_kern_mount.part.0+0x71/0xb0\n   btrfs_mount+0x10d/0x380\n   ? vfs_parse_fs_string+0x4d/0x90\n   legacy_get_tree+0x24/0x40\n   vfs_get_tree+0x22/0xb0\n   path_mount+0x433/0xa10\n   __x64_sys_mount+0xe3/0x120\n   do_syscall_64+0x3d/0x80\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\r\n\r\nWe can get -EIO or any number of legitimate errors from\nbtrfs_search_slot(), panicing here is not the appropriate response.  The\nerror path for this code handles errors properly, simply return the\nerror.(CVE-2021-47145)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmld: fix panic in mld_newpack()\r\n\r\nmld_newpack() doesn\u0026apos;t allow to allocate high order page,\nonly order-0 allocation is allowed.\nIf headroom size is too large, a kernel panic could occur in skb_put().\r\n\r\nTest commands:\n    ip netns del A\n    ip netns del B\n    ip netns add A\n    ip netns add B\n    ip link add veth0 type veth peer name veth1\n    ip link set veth0 netns A\n    ip link set veth1 netns B\r\n\r\n    ip netns exec A ip link set lo up\n    ip netns exec A ip link set veth0 up\n    ip netns exec A ip -6 a a 2001:db8:0::1/64 dev veth0\n    ip netns exec B ip link set lo up\n    ip netns exec B ip link set veth1 up\n    ip netns exec B ip -6 a a 2001:db8:0::2/64 dev veth1\n    for i in {1..99}\n    do\n        let A=$i-1\n        ip netns exec A ip link add ip6gre$i type ip6gre \\\n\tlocal 2001:db8:$A::1 remote 2001:db8:$A::2 encaplimit 100\n        ip netns exec A ip -6 a a 2001:db8:$i::1/64 dev ip6gre$i\n        ip netns exec A ip link set ip6gre$i up\r\n\r\n        ip netns exec B ip link add ip6gre$i type ip6gre \\\n\tlocal 2001:db8:$A::2 remote 2001:db8:$A::1 encaplimit 100\n        ip netns exec B ip -6 a a 2001:db8:$i::2/64 dev ip6gre$i\n        ip netns exec B ip link set ip6gre$i up\n    done\r\n\r\nSplat looks like:\nkernel BUG at net/core/skbuff.c:110!\ninvalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI\nCPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.12.0+ #891\nWorkqueue: ipv6_addrconf addrconf_dad_work\nRIP: 0010:skb_panic+0x15d/0x15f\nCode: 92 fe 4c 8b 4c 24 10 53 8b 4d 70 45 89 e0 48 c7 c7 00 ae 79 83\n41 57 41 56 41 55 48 8b 54 24 a6 26 f9 ff \u0026lt;0f\u0026gt; 0b 48 8b 6c 24 20 89\n34 24 e8 4a 4e 92 fe 8b 34 24 48 c7 c1 20\nRSP: 0018:ffff88810091f820 EFLAGS: 00010282\nRAX: 0000000000000089 RBX: ffff8881086e9000 RCX: 0000000000000000\nRDX: 0000000000000089 RSI: 0000000000000008 RDI: ffffed1020123efb\nRBP: ffff888005f6eac0 R08: ffffed1022fc0031 R09: ffffed1022fc0031\nR10: ffff888117e00187 R11: ffffed1022fc0030 R12: 0000000000000028\nR13: ffff888008284eb0 R14: 0000000000000ed8 R15: 0000000000000ec0\nFS:  0000000000000000(0000) GS:ffff888117c00000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f8b801c5640 CR3: 0000000033c2c006 CR4: 00000000003706f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n ? ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600\n ? ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600\n skb_put.cold.104+0x22/0x22\n ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600\n ? rcu_read_lock_sched_held+0x91/0xc0\n mld_newpack+0x398/0x8f0\n ? ip6_mc_hdr.isra.26.constprop.46+0x600/0x600\n ? lock_contended+0xc40/0xc40\n add_grhead.isra.33+0x280/0x380\n add_grec+0x5ca/0xff0\n ? mld_sendpack+0xf40/0xf40\n ? lock_downgrade+0x690/0x690\n mld_send_initial_cr.part.34+0xb9/0x180\n ipv6_mc_dad_complete+0x15d/0x1b0\n addrconf_dad_completed+0x8d2/0xbb0\n ? lock_downgrade+0x690/0x690\n ? addrconf_rs_timer+0x660/0x660\n ? addrconf_dad_work+0x73c/0x10e0\n addrconf_dad_work+0x73c/0x10e0\r\n\r\nAllowing high order page allocation could fix this problem.(CVE-2021-47146)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ni2c: i801: Don\u0026apos;t generate an interrupt on bus reset\r\n\r\nNow that the i2c-i801 driver supports interrupts, setting the KILL bit\nin a attempt to recover from a timed out transaction triggers an\ninterrupt. Unfortunately, the interrupt handler (i801_isr) is not\nprepared for this situation and will try to process the interrupt as\nif it was signaling the end of a successful transaction. In the case\nof a block transaction, this can result in an out-of-range memory\naccess.\r\n\r\nThis condition was reproduced several times by syzbot:\nhttps://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e\nhttps://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e\nhttps://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e\nhttps://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb\nhttps://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a\nhttps://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79\r\n\r\nSo disable interrupts while trying to reset the bus. Interrupts will\nbe enabled again for the following transaction.(CVE-2021-47153)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: dsa: fix a crash if -\u0026gt;get_sset_count() fails\r\n\r\nIf ds-\u0026gt;ops-\u0026gt;get_sset_count() fails then it \u0026quot;count\u0026quot; is a negative error\ncode such as -EOPNOTSUPP.  Because \u0026quot;i\u0026quot; is an unsigned int, the negative\nerror code is type promoted to a very high value and the loop will\ncorrupt memory until the system crashes.\r\n\r\nFix this by checking for error codes and changing the type of \u0026quot;i\u0026quot; to\njust int.(CVE-2021-47159)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: dsa: mt7530: fix VLAN traffic leaks\r\n\r\nPCR_MATRIX field was set to all 1\u0026apos;s when VLAN filtering is enabled, but\nwas not reset when it is disabled, which may cause traffic leaks:\r\n\r\n\tip link add br0 type bridge vlan_filtering 1\n\tip link add br1 type bridge vlan_filtering 1\n\tip link set swp0 master br0\n\tip link set swp1 master br1\n\tip link set br0 type bridge vlan_filtering 0\n\tip link set br1 type bridge vlan_filtering 0\n\t# traffic in br0 and br1 will start leaking to each other\r\n\r\nAs port_bridge_{add,del} have set up PCR_MATRIX properly, remove the\nPCR_MATRIX write from mt7530_port_set_vlan_aware.(CVE-2021-47160)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nspi: spi-fsl-dspi: Fix a resource leak in an error handling path\r\n\r\n\u0026apos;dspi_request_dma()\u0026apos; should be undone by a \u0026apos;dspi_release_dma()\u0026apos; call in the\nerror handling path of the probe function, as already done in the remove\nfunction(CVE-2021-47161)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntipc: skb_linearize the head skb when reassembling msgs\r\n\r\nIt\u0026apos;s not a good idea to append the frag skb to a skb\u0026apos;s frag_list if\nthe frag_list already has skbs from elsewhere, such as this skb was\ncreated by pskb_copy() where the frag_list was cloned (all the skbs\nin it were skb_get\u0026apos;ed) and shared by multiple skbs.\r\n\r\nHowever, the new appended frag skb should have been only seen by the\ncurrent skb. Otherwise, it will cause use after free crashes as this\nappended frag skb are seen by multiple skbs but it only got skb_get\ncalled once.\r\n\r\nThe same thing happens with a skb updated by pskb_may_pull() with a\nskb_cloned skb. Li Shuang has reported quite a few crashes caused\nby this when doing testing over macvlan devices:\r\n\r\n  [] kernel BUG at net/core/skbuff.c:1970!\n  [] Call Trace:\n  []  skb_clone+0x4d/0xb0\n  []  macvlan_broadcast+0xd8/0x160 [macvlan]\n  []  macvlan_process_broadcast+0x148/0x150 [macvlan]\n  []  process_one_work+0x1a7/0x360\n  []  worker_thread+0x30/0x390\r\n\r\n  [] kernel BUG at mm/usercopy.c:102!\n  [] Call Trace:\n  []  __check_heap_object+0xd3/0x100\n  []  __check_object_size+0xff/0x16b\n  []  simple_copy_to_iter+0x1c/0x30\n  []  __skb_datagram_iter+0x7d/0x310\n  []  __skb_datagram_iter+0x2a5/0x310\n  []  skb_copy_datagram_iter+0x3b/0x90\n  []  tipc_recvmsg+0x14a/0x3a0 [tipc]\n  []  ____sys_recvmsg+0x91/0x150\n  []  ___sys_recvmsg+0x7b/0xc0\r\n\r\n  [] kernel BUG at mm/slub.c:305!\n  [] Call Trace:\n  []  \u0026lt;IRQ\u0026gt;\n  []  kmem_cache_free+0x3ff/0x400\n  []  __netif_receive_skb_core+0x12c/0xc40\n  []  ? kmem_cache_alloc+0x12e/0x270\n  []  netif_receive_skb_internal+0x3d/0xb0\n  []  ? get_rx_page_info+0x8e/0xa0 [be2net]\n  []  be_poll+0x6ef/0xd00 [be2net]\n  []  ? irq_exit+0x4f/0x100\n  []  net_rx_action+0x149/0x3b0\r\n\r\n  ...\r\n\r\nThis patch is to fix it by linearizing the head skb if it has frag_list\nset in tipc_buf_append(). Note that we choose to do this before calling\nskb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can\nnot just drop the frag_list either as the early time.(CVE-2021-47162)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntipc: wait and exit until all work queues are done\r\n\r\nOn some host, a crash could be triggered simply by repeating these\ncommands several times:\r\n\r\n  # modprobe tipc\n  # tipc bearer enable media udp name UDP1 localip 127.0.0.1\n  # rmmod tipc\r\n\r\n  [] BUG: unable to handle kernel paging request at ffffffffc096bb00\n  [] Workqueue: events 0xffffffffc096bb00\n  [] Call Trace:\n  []  ? process_one_work+0x1a7/0x360\n  []  ? worker_thread+0x30/0x390\n  []  ? create_worker+0x1a0/0x1a0\n  []  ? kthread+0x116/0x130\n  []  ? kthread_flush_work_fn+0x10/0x10\n  []  ? ret_from_fork+0x35/0x40\r\n\r\nWhen removing the TIPC module, the UDP tunnel sock will be delayed to\nrelease in a work queue as sock_release() can\u0026apos;t be done in rtnl_lock().\nIf the work queue is schedule to run after the TIPC module is removed,\nkernel will crash as the work queue function cleanup_beareri() code no\nlonger exists when trying to invoke it.\r\n\r\nTo fix it, this patch introduce a member wq_count in tipc_net to track\nthe numbers of work queues in schedule, and  wait and exit until all\nwork queues are done in tipc_exit_net().(CVE-2021-47163)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nNFS: Fix an Oopsable condition in __nfs_pageio_add_request()\r\n\r\nEnsure that nfs_pageio_error_cleanup() resets the mirror array contents,\nso that the structure reflects the fact that it is now empty.\nAlso change the test in nfs_pageio_do_add_request() to be more robust by\nchecking whether or not the list is empty rather than relying on the\nvalue of pg_count.(CVE-2021-47167)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nUSB: usbfs: Don\u0026apos;t WARN about excessively large memory allocations\r\n\r\nSyzbot found that the kernel generates a WARNing if the user tries to\nsubmit a bulk transfer through usbfs with a buffer that is way too\nlarge.  This isn\u0026apos;t a bug in the kernel; it\u0026apos;s merely an invalid request\nfrom the user and the usbfs code does handle it correctly.\r\n\r\nIn theory the same thing can happen with async transfers, or with the\npacket descriptor table for isochronous transfers.\r\n\r\nTo prevent the MM subsystem from complaining about these bad\nallocation requests, add the __GFP_NOWARN flag to the kmalloc calls\nfor these buffers.(CVE-2021-47170)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: usb: fix memory leak in smsc75xx_bind\r\n\r\nSyzbot reported memory leak in smsc75xx_bind().\nThe problem was is non-freed memory in case of\nerrors after memory allocation.\r\n\r\nbacktrace:\n  [\u0026lt;ffffffff84245b62\u0026gt;] kmalloc include/linux/slab.h:556 [inline]\n  [\u0026lt;ffffffff84245b62\u0026gt;] kzalloc include/linux/slab.h:686 [inline]\n  [\u0026lt;ffffffff84245b62\u0026gt;] smsc75xx_bind+0x7a/0x334 drivers/net/usb/smsc75xx.c:1460\n  [\u0026lt;ffffffff82b5b2e6\u0026gt;] usbnet_probe+0x3b6/0xc30 drivers/net/usb/usbnet.c:1728(CVE-2021-47171)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmisc/uss720: fix memory leak in uss720_probe\r\n\r\nuss720_probe forgets to decrease the refcount of usbdev in uss720_probe.\nFix this by decreasing the refcount of usbdev by usb_put_dev.\r\n\r\nBUG: memory leak\nunreferenced object 0xffff888101113800 (size 2048):\n  comm \u0026quot;kworker/0:1\u0026quot;, pid 7, jiffies 4294956777 (age 28.870s)\n  hex dump (first 32 bytes):\n    ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00  ....1...........\n    00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00  ................\n  backtrace:\n    [\u0026lt;ffffffff82b8e822\u0026gt;] kmalloc include/linux/slab.h:554 [inline]\n    [\u0026lt;ffffffff82b8e822\u0026gt;] kzalloc include/linux/slab.h:684 [inline]\n    [\u0026lt;ffffffff82b8e822\u0026gt;] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582\n    [\u0026lt;ffffffff82b98441\u0026gt;] hub_port_connect drivers/usb/core/hub.c:5129 [inline]\n    [\u0026lt;ffffffff82b98441\u0026gt;] hub_port_connect_change drivers/usb/core/hub.c:5363 [inline]\n    [\u0026lt;ffffffff82b98441\u0026gt;] port_event drivers/usb/core/hub.c:5509 [inline]\n    [\u0026lt;ffffffff82b98441\u0026gt;] hub_event+0x1171/0x20c0 drivers/usb/core/hub.c:5591\n    [\u0026lt;ffffffff81259229\u0026gt;] process_one_work+0x2c9/0x600 kernel/workqueue.c:2275\n    [\u0026lt;ffffffff81259b19\u0026gt;] worker_thread+0x59/0x5d0 kernel/workqueue.c:2421\n    [\u0026lt;ffffffff81261228\u0026gt;] kthread+0x178/0x1b0 kernel/kthread.c:292\n    [\u0026lt;ffffffff8100227f\u0026gt;] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294(CVE-2021-47173)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nNFC: nci: fix memory leak in nci_allocate_device\r\n\r\nnfcmrvl_disconnect fails to free the hci_dev field in struct nci_dev.\nFix this by freeing hci_dev in nci_free_device.\r\n\r\nBUG: memory leak\nunreferenced object 0xffff888111ea6800 (size 1024):\n  comm \u0026quot;kworker/1:0\u0026quot;, pid 19, jiffies 4294942308 (age 13.580s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 60 fd 0c 81 88 ff ff  .........`......\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u0026lt;000000004bc25d43\u0026gt;] kmalloc include/linux/slab.h:552 [inline]\n    [\u0026lt;000000004bc25d43\u0026gt;] kzalloc include/linux/slab.h:682 [inline]\n    [\u0026lt;000000004bc25d43\u0026gt;] nci_hci_allocate+0x21/0xd0 net/nfc/nci/hci.c:784\n    [\u0026lt;00000000c59cff92\u0026gt;] nci_allocate_device net/nfc/nci/core.c:1170 [inline]\n    [\u0026lt;00000000c59cff92\u0026gt;] nci_allocate_device+0x10b/0x160 net/nfc/nci/core.c:1132\n    [\u0026lt;00000000006e0a8e\u0026gt;] nfcmrvl_nci_register_dev+0x10a/0x1c0 drivers/nfc/nfcmrvl/main.c:153\n    [\u0026lt;000000004da1b57e\u0026gt;] nfcmrvl_probe+0x223/0x290 drivers/nfc/nfcmrvl/usb.c:345\n    [\u0026lt;00000000d506aed9\u0026gt;] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n    [\u0026lt;00000000bc632c92\u0026gt;] really_probe+0x159/0x4a0 drivers/base/dd.c:554\n    [\u0026lt;00000000f5009125\u0026gt;] driver_probe_device+0x84/0x100 drivers/base/dd.c:740\n    [\u0026lt;000000000ce658ca\u0026gt;] __device_attach_driver+0xee/0x110 drivers/base/dd.c:846\n    [\u0026lt;000000007067d05f\u0026gt;] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431\n    [\u0026lt;00000000f8e13372\u0026gt;] __device_attach+0x122/0x250 drivers/base/dd.c:914\n    [\u0026lt;000000009cf68860\u0026gt;] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491\n    [\u0026lt;00000000359c965a\u0026gt;] device_add+0x5be/0xc30 drivers/base/core.c:3109\n    [\u0026lt;00000000086e4bd3\u0026gt;] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164\n    [\u0026lt;00000000ca036872\u0026gt;] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238\n    [\u0026lt;00000000d40d36f6\u0026gt;] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293\n    [\u0026lt;00000000bc632c92\u0026gt;] really_probe+0x159/0x4a0 drivers/base/dd.c:554(CVE-2021-47180)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nEDAC/thunderx: Fix possible out-of-bounds string access\r\n\r\nEnabling -Wstringop-overflow globally exposes a warning for a common bug\nin the usage of strncat():\r\n\r\n  drivers/edac/thunderx_edac.c: In function \u0026apos;thunderx_ocx_com_threaded_isr\u0026apos;:\n  drivers/edac/thunderx_edac.c:1136:17: error: \u0026apos;strncat\u0026apos; specified bound 1024 equals destination size [-Werror=stringop-overflow=]\n   1136 |                 strncat(msg, other, OCX_MESSAGE_SIZE);\n        |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n   ...\n   1145 |                                 strncat(msg, other, OCX_MESSAGE_SIZE);\n   ...\n   1150 |                                 strncat(msg, other, OCX_MESSAGE_SIZE);\r\n\r\n   ...\r\n\r\nApparently the author of this driver expected strncat() to behave the\nway that strlcat() does, which uses the size of the destination buffer\nas its third argument rather than the length of the source buffer. The\nresult is that there is no check on the size of the allocated buffer.\r\n\r\nChange it to strlcat().\r\n\r\n  [ bp: Trim compiler output, fixup commit message. ](CVE-2023-52464)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nInput: powermate - fix use-after-free in powermate_config_complete\r\n\r\nsyzbot has found a use-after-free bug [1] in the powermate driver. This\nhappens when the device is disconnected, which leads to a memory free from\nthe powermate_device struct.  When an asynchronous control message\ncompletes after the kfree and its callback is invoked, the lock does not\nexist anymore and hence the bug.\r\n\r\nUse usb_kill_urb() on pm-\u0026gt;config to cancel any in-progress requests upon\ndevice disconnection.\r\n\r\n[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e(CVE-2023-52475)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nscsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command\r\n\r\nTags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed\nwhen we receive the response.(CVE-2023-52500)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnfc: nci: assert requested protocol is valid\r\n\r\nThe protocol is used in a bit mask to determine if the protocol is\nsupported. Assert the provided protocol is less than the maximum\ndefined so it doesn\u0026apos;t potentially perform a shift-out-of-bounds and\nprovide a clearer error for undefined protocols vs unsupported ones.(CVE-2023-52507)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nieee802154: ca8210: Fix a potential UAF in ca8210_probe\r\n\r\nIf of_clk_add_provider() fails in ca8210_register_ext_clock(),\nit calls clk_unregister() to release priv-\u0026gt;clk and returns an\nerror. However, the caller ca8210_probe() then calls ca8210_remove(),\nwhere priv-\u0026gt;clk is freed again in ca8210_unregister_ext_clock(). In\nthis case, a use-after-free may happen in the second time we call\nclk_unregister().\r\n\r\nFix this by removing the first clk_unregister(). Also, priv-\u0026gt;clk could\nbe an error code on failure of clk_register_fixed_rate(). Use\nIS_ERR_OR_NULL to catch this case in ca8210_unregister_ext_clock().(CVE-2023-52510)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/srp: Do not call scsi_done() from srp_abort()\r\n\r\nAfter scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler\ncallback, it performs one of the following actions:\n* Call scsi_queue_insert().\n* Call scsi_finish_command().\n* Call scsi_eh_scmd_add().\nHence, SCSI abort handlers must not call scsi_done(). Otherwise all\nthe above actions would trigger a use-after-free. Hence remove the\nscsi_done() call from srp_abort(). Keep the srp_free_req() call\nbefore returning SUCCESS because we may not see the command again if\nSUCCESS is returned.(CVE-2023-52515)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: fix possible store tearing in neigh_periodic_work()\r\n\r\nWhile looking at a related syzbot report involving neigh_periodic_work(),\nI found that I forgot to add an annotation when deleting an\nRCU protected item from a list.\r\n\r\nReaders use rcu_deference(*np), we need to use either\nrcu_assign_pointer() or WRITE_ONCE() on writer side\nto prevent store tearing.\r\n\r\nI use rcu_assign_pointer() to have lockdep support,\nthis was the choice made in neigh_flush_dev().(CVE-2023-52522)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: mac80211: fix potential key use-after-free\r\n\r\nWhen ieee80211_key_link() is called by ieee80211_gtk_rekey_add()\nbut returns 0 due to KRACK protection (identical key reinstall),\nieee80211_gtk_rekey_add() will still return a pointer into the\nkey, in a potential use-after-free. This normally doesn\u0026apos;t happen\nsince it\u0026apos;s only called by iwlwifi in case of WoWLAN rekey offload\nwhich has its own KRACK protection, but still better to fix, do\nthat by returning an error code and converting that to success on\nthe cfg80211 boundary only, leaving the error for bad callers of\nieee80211_gtk_rekey_add().(CVE-2023-52530)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix potential use after free in nilfs_gccache_submit_read_data()\r\n\r\nIn nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the\nreference count of bh when the call to nilfs_dat_translate() fails.  If\nthe reference count hits 0 and its owner page gets unlocked, bh may be\nfreed.  However, bh-\u0026gt;b_page is dereferenced to put the page after that,\nwhich may result in a use-after-free bug.  This patch moves the release\noperation after unlocking and putting the page.\r\n\r\nNOTE: The function in question is only called in GC, and in combination\nwith current userland tools, address translation using DAT does not occur\nin that function, so the code path that causes this issue will not be\nexecuted.  However, it is possible to run that code path by intentionally\nmodifying the userland GC library or by calling the GC ioctl directly.\r\n\r\n[konishi.ryusuke@gmail.com: NOTE added to the commit log](CVE-2023-52566)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: bridge: use DEV_STATS_INC()\r\n\r\nsyzbot/KCSAN reported data-races in br_handle_frame_finish() [1]\nThis function can run from multiple cpus without mutual exclusion.\r\n\r\nAdopt SMP safe DEV_STATS_INC() to update dev-\u0026gt;stats fields.\r\n\r\nHandles updates to dev-\u0026gt;stats.tx_dropped while we are at it.\r\n\r\n[1]\nBUG: KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish\r\n\r\nread-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 1:\nbr_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189\nbr_nf_hook_thresh+0x1ed/0x220\nbr_nf_pre_routing_finish_ipv6+0x50f/0x540\nNF_HOOK include/linux/netfilter.h:304 [inline]\nbr_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178\nbr_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508\nnf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]\nnf_hook_bridge_pre net/bridge/br_input.c:272 [inline]\nbr_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417\n__netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417\n__netif_receive_skb_one_core net/core/dev.c:5521 [inline]\n__netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637\nprocess_backlog+0x21f/0x380 net/core/dev.c:5965\n__napi_poll+0x60/0x3b0 net/core/dev.c:6527\nnapi_poll net/core/dev.c:6594 [inline]\nnet_rx_action+0x32b/0x750 net/core/dev.c:6727\n__do_softirq+0xc1/0x265 kernel/softirq.c:553\nrun_ksoftirqd+0x17/0x20 kernel/softirq.c:921\nsmpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164\nkthread+0x1d7/0x210 kernel/kthread.c:388\nret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147\nret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304\r\n\r\nread-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 0:\nbr_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189\nbr_nf_hook_thresh+0x1ed/0x220\nbr_nf_pre_routing_finish_ipv6+0x50f/0x540\nNF_HOOK include/linux/netfilter.h:304 [inline]\nbr_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178\nbr_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508\nnf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]\nnf_hook_bridge_pre net/bridge/br_input.c:272 [inline]\nbr_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417\n__netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417\n__netif_receive_skb_one_core net/core/dev.c:5521 [inline]\n__netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637\nprocess_backlog+0x21f/0x380 net/core/dev.c:5965\n__napi_poll+0x60/0x3b0 net/core/dev.c:6527\nnapi_poll net/core/dev.c:6594 [inline]\nnet_rx_action+0x32b/0x750 net/core/dev.c:6727\n__do_softirq+0xc1/0x265 kernel/softirq.c:553\ndo_softirq+0x5e/0x90 kernel/softirq.c:454\n__local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381\n__raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]\n_raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210\nspin_unlock_bh include/linux/spinlock.h:396 [inline]\nbatadv_tt_local_purge+0x1a8/0x1f0 net/batman-adv/translation-table.c:1356\nbatadv_tt_purge+0x2b/0x630 net/batman-adv/translation-table.c:3560\nprocess_one_work kernel/workqueue.c:2630 [inline]\nprocess_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2703\nworker_thread+0x525/0x730 kernel/workqueue.c:2784\nkthread+0x1d7/0x210 kernel/kthread.c:388\nret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147\nret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304\r\n\r\nvalue changed: 0x00000000000d7190 -\u0026gt; 0x00000000000d7191\r\n\r\nReported by Kernel Concurrency Sanitizer on:\nCPU: 0 PID: 14848 Comm: kworker/u4:11 Not tainted 6.6.0-rc1-syzkaller-00236-gad8a69f361b9 #0(CVE-2023-52578)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nceph: fix deadlock or deadcode of misusing dget()\r\n\r\nThe lock order is incorrect between denty and its parent, we should\nalways make sure that the parent get the lock first.\r\n\r\nBut since this deadcode is never used and the parent dir will always\nbe set from the callers, let\u0026apos;s just remove it.(CVE-2023-52583)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nIB/ipoib: Fix mcast list locking\r\n\r\nReleasing the `priv-\u0026gt;lock` while iterating the `priv-\u0026gt;multicast_list` in\n`ipoib_mcast_join_task()` opens a window for `ipoib_mcast_dev_flush()` to\nremove the items while in the middle of iteration. If the mcast is removed\nwhile the lock was dropped, the for loop spins forever resulting in a hard\nlockup (as was reported on RHEL 4.18.0-372.75.1.el8_6 kernel):\r\n\r\n    Task A (kworker/u72:2 below)       | Task B (kworker/u72:0 below)\n    -----------------------------------+-----------------------------------\n    ipoib_mcast_join_task(work)        | ipoib_ib_dev_flush_light(work)\n      spin_lock_irq(\u0026amp;priv-\u0026gt;lock)       | __ipoib_ib_dev_flush(priv, ...)\n      list_for_each_entry(mcast,       | ipoib_mcast_dev_flush(dev = priv-\u0026gt;dev)\n          \u0026amp;priv-\u0026gt;multicast_list, list) |\n        ipoib_mcast_join(dev, mcast)   |\n          spin_unlock_irq(\u0026amp;priv-\u0026gt;lock) |\n                                       |   spin_lock_irqsave(\u0026amp;priv-\u0026gt;lock, flags)\n                                       |   list_for_each_entry_safe(mcast, tmcast,\n                                       |                  \u0026amp;priv-\u0026gt;multicast_list, list)\n                                       |     list_del(\u0026amp;mcast-\u0026gt;list);\n                                       |     list_add_tail(\u0026amp;mcast-\u0026gt;list, \u0026amp;remove_list)\n                                       |   spin_unlock_irqrestore(\u0026amp;priv-\u0026gt;lock, flags)\n          spin_lock_irq(\u0026amp;priv-\u0026gt;lock)   |\n                                       |   ipoib_mcast_remove_list(\u0026amp;remove_list)\n   (Here, `mcast` is no longer on the  |     list_for_each_entry_safe(mcast, tmcast,\n    `priv-\u0026gt;multicast_list` and we keep |                            remove_list, list)\n    spinning on the `remove_list` of   |  \u0026gt;\u0026gt;\u0026gt;  wait_for_completion(\u0026amp;mcast-\u0026gt;done)\n    the other thread which is blocked  |\n    and the list is still valid on     |\n    it\u0026apos;s stack.)\r\n\r\nFix this by keeping the lock held and changing to GFP_ATOMIC to prevent\neventual sleeps.\nUnfortunately we could not reproduce the lockup and confirm this fix but\nbased on the code review I think this fix should address such lockups.\r\n\r\ncrash\u0026gt; bc 31\nPID: 747      TASK: ff1c6a1a007e8000  CPU: 31   COMMAND: \u0026quot;kworker/u72:2\u0026quot;\n--\n    [exception RIP: ipoib_mcast_join_task+0x1b1]\n    RIP: ffffffffc0944ac1  RSP: ff646f199a8c7e00  RFLAGS: 00000002\n    RAX: 0000000000000000  RBX: ff1c6a1a04dc82f8  RCX: 0000000000000000\n                                  work (\u0026amp;priv-\u0026gt;mcast_task{,.work})\n    RDX: ff1c6a192d60ac68  RSI: 0000000000000286  RDI: ff1c6a1a04dc8000\n           \u0026amp;mcast-\u0026gt;list\n    RBP: ff646f199a8c7e90   R8: ff1c699980019420   R9: ff1c6a1920c9a000\n    R10: ff646f199a8c7e00  R11: ff1c6a191a7d9800  R12: ff1c6a192d60ac00\n                                                         mcast\n    R13: ff1c6a1d82200000  R14: ff1c6a1a04dc8000  R15: ff1c6a1a04dc82d8\n           dev                    priv (\u0026amp;priv-\u0026gt;lock)     \u0026amp;priv-\u0026gt;multicast_list (aka head)\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\n--- \u0026lt;NMI exception stack\u0026gt; ---\n #5 [ff646f199a8c7e00] ipoib_mcast_join_task+0x1b1 at ffffffffc0944ac1 [ib_ipoib]\n #6 [ff646f199a8c7e98] process_one_work+0x1a7 at ffffffff9bf10967\r\n\r\ncrash\u0026gt; rx ff646f199a8c7e68\nff646f199a8c7e68:  ff1c6a1a04dc82f8 \u0026lt;\u0026lt;\u0026lt; work = \u0026amp;priv-\u0026gt;mcast_task.work\r\n\r\ncrash\u0026gt; list -hO ipoib_dev_priv.multicast_list ff1c6a1a04dc8000\n(empty)\r\n\r\ncrash\u0026gt; ipoib_dev_priv.mcast_task.work.func,mcast_mutex.owner.counter ff1c6a1a04dc8000\n  mcast_task.work.func = 0xffffffffc0944910 \u0026lt;ipoib_mcast_join_task\u0026gt;,\n  mcast_mutex.owner.counter = 0xff1c69998efec000\r\n\r\ncrash\u0026gt; b 8\nPID: 8        TASK: ff1c69998efec000  CPU: 33   COMMAND: \u0026quot;kworker/u72:0\u0026quot;\n--\n #3 [ff646f1980153d50] wait_for_completion+0x96 at ffffffff9c7d7646\n #4 [ff646f1980153d90] ipoib_mcast_remove_list+0x56 at ffffffffc0944dc6 [ib_ipoib]\n #5 [ff646f1980153de8] ipoib_mcast_dev_flush+0x1a7 at ffffffffc09455a7 [ib_ipoib]\n #6 [ff646f1980153e58] __ipoib_ib_dev_flush+0x1a4 at ffffffffc09431a4 [ib_ipoib]\n #7 [ff\n---truncated---(CVE-2023-52587)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()\r\n\r\nFix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug\noccurs when txs-\u0026gt;cnt, data from a URB provided by a USB device, is\nbigger than the size of the array txs-\u0026gt;txstatus, which is\nHTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bug\nhandling code after the check. Make the function return if that is the\ncase.\r\n\r\nFound by a modified version of syzkaller.\r\n\r\nUBSAN: array-index-out-of-bounds in htc_drv_txrx.c\nindex 13 is out of range for type \u0026apos;__wmi_event_txstatus [12]\u0026apos;\nCall Trace:\n ath9k_htc_txstatus\n ath9k_wmi_event_tasklet\n tasklet_action_common\n __do_softirq\n irq_exit_rxu\n sysvec_apic_timer_interrupt(CVE-2023-52594)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: rt2x00: restart beacon queue when hardware reset\r\n\r\nWhen a hardware reset is triggered, all registers are reset, so all\nqueues are forced to stop in hardware interface. However, mac80211\nwill not automatically stop the queue. If we don\u0026apos;t manually stop the\nbeacon queue, the queue will be deadlocked and unable to start again.\nThis patch fixes the issue where Apple devices cannot connect to the\nAP after calling ieee80211_restart_hw().(CVE-2023-52595)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nKVM: s390: fix setting of fpc register\r\n\r\nkvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control\n(fpc) register of a guest cpu. The new value is tested for validity by\ntemporarily loading it into the fpc register.\r\n\r\nThis may lead to corruption of the fpc register of the host process:\nif an interrupt happens while the value is temporarily loaded into the fpc\nregister, and within interrupt context floating point or vector registers\nare used, the current fp/vx registers are saved with save_fpu_regs()\nassuming they belong to user space and will be loaded into fp/vx registers\nwhen returning to user space.\r\n\r\ntest_fp_ctl() restores the original user space / host process fpc register\nvalue, however it will be discarded, when returning to user space.\r\n\r\nIn result the host process will incorrectly continue to run with the value\nthat was supposed to be used for a guest cpu.\r\n\r\nFix this by simply removing the test. There is another test right before\nthe SIE context is entered which will handles invalid values.\r\n\r\nThis results in a change of behaviour: invalid values will now be accepted\ninstead of that the ioctl fails with -EINVAL. This seems to be acceptable,\ngiven that this interface is most likely not used anymore, and this is in\naddition the same behaviour implemented with the memory mapped interface\n(replace invalid values with zero) - see sync_regs() in kvm-s390.c.(CVE-2023-52597)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ns390/ptrace: handle setting of fpc register correctly\r\n\r\nIf the content of the floating point control (fpc) register of a traced\nprocess is modified with the ptrace interface the new value is tested for\nvalidity by temporarily loading it into the fpc register.\r\n\r\nThis may lead to corruption of the fpc register of the tracing process:\nif an interrupt happens while the value is temporarily loaded into the\nfpc register, and within interrupt context floating point or vector\nregisters are used, the current fp/vx registers are saved with\nsave_fpu_regs() assuming they belong to user space and will be loaded into\nfp/vx registers when returning to user space.\r\n\r\ntest_fp_ctl() restores the original user space fpc register value, however\nit will be discarded, when returning to user space.\r\n\r\nIn result the tracer will incorrectly continue to run with the value that\nwas supposed to be used for the traced process.\r\n\r\nFix this by saving fpu register contents with save_fpu_regs() before using\ntest_fp_ctl().(CVE-2023-52598)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\next4: avoid online resizing failures due to oversized flex bg\r\n\r\nWhen we online resize an ext4 filesystem with a oversized flexbg_size,\r\n\r\n     mkfs.ext4 -F -G 67108864 $dev -b 4096 100M\n     mount $dev $dir\n     resize2fs $dev 16G\r\n\r\nthe following WARN_ON is triggered:\n==================================================================\nWARNING: CPU: 0 PID: 427 at mm/page_alloc.c:4402 __alloc_pages+0x411/0x550\nModules linked in: sg(E)\nCPU: 0 PID: 427 Comm: resize2fs Tainted: G  E  6.6.0-rc5+ #314\nRIP: 0010:__alloc_pages+0x411/0x550\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __kmalloc_large_node+0xa2/0x200\n __kmalloc+0x16e/0x290\n ext4_resize_fs+0x481/0xd80\n __ext4_ioctl+0x1616/0x1d90\n ext4_ioctl+0x12/0x20\n __x64_sys_ioctl+0xf0/0x150\n do_syscall_64+0x3b/0x90\n==================================================================\r\n\r\nThis is because flexbg_size is too large and the size of the new_group_data\narray to be allocated exceeds MAX_ORDER. Currently, the minimum value of\nMAX_ORDER is 8, the minimum value of PAGE_SIZE is 4096, the corresponding\nmaximum number of groups that can be allocated is:\r\n\r\n (PAGE_SIZE \u0026lt;\u0026lt; MAX_ORDER) / sizeof(struct ext4_new_group_data) ≈ 21845\r\n\r\nAnd the value that is down-aligned to the power of 2 is 16384. Therefore,\nthis value is defined as MAX_RESIZE_BG, and the number of groups added\neach time does not exceed this value during resizing, and is added multiple\ntimes to complete the online resizing. The difference is that the metadata\nin a flex_bg may be more dispersed.(CVE-2023-52622)","status":"published","published":"2024-04-19T11:06:55Z","modified":"2026-08-18T01:17:17.136339012Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1484","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ni2c: img-scb: fix reference leak when pm_runtime_get_sync fails\r\n\r\nThe PM reference count is not expected to be incremented on\nreturn in functions img_i2c_xfer and img_i2c_init.\r\n\r\nHowever, pm_runtime_get_sync will increment the PM reference\ncount even failed. Forgetting to putting operation will result\nin a reference leak here.\r\n\r\nReplace it with pm_runtime_resume_and_get to keep usage\ncounter balanced.(CVE-2020-36783)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nkyber: fix out of bounds access when preempted\r\n\r\n__blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and\npasses the hctx to -\u0026gt;bio_merge(). kyber_bio_merge() then gets the ctx\nfor the current CPU again and uses that to get the corresponding Kyber\ncontext in the passed hctx. However, the thread may be preempted between\nthe two calls to blk_mq_get_ctx(), and the ctx returned the second time\nmay no longer correspond to the passed hctx. This \u0026quot;works\u0026quot; accidentally\nmost of the time, but it can cause us to read garbage if the second ctx\ncame from an hctx with more ctx\u0026apos;s than the first one (i.e., if\nctx-\u0026gt;index_hw[hctx-\u0026gt;type] \u0026gt; hctx-\u0026gt;nr_ctx).\r\n\r\nThis manifested as this UBSAN array index out of bounds error reported\nby Jakub:\r\n\r\nUBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9\nindex 13106 is out of range for type \u0026apos;long unsigned int [128]\u0026apos;\nCall Trace:\n dump_stack+0xa4/0xe5\n ubsan_epilogue+0x5/0x40\n __ubsan_handle_out_of_bounds.cold.13+0x2a/0x34\n queued_spin_lock_slowpath+0x476/0x480\n do_raw_spin_lock+0x1c2/0x1d0\n kyber_bio_merge+0x112/0x180\n blk_mq_submit_bio+0x1f5/0x1100\n submit_bio_noacct+0x7b0/0x870\n submit_bio+0xc2/0x3a0\n btrfs_map_bio+0x4f0/0x9d0\n btrfs_submit_data_bio+0x24e/0x310\n submit_one_bio+0x7f/0xb0\n submit_extent_page+0xc4/0x440\n __extent_writepage_io+0x2b8/0x5e0\n __extent_writepage+0x28d/0x6e0\n extent_write_cache_pages+0x4d7/0x7a0\n extent_writepages+0xa2/0x110\n do_writepages+0x8f/0x180\n __writeback_single_inode+0x99/0x7f0\n writeback_sb_inodes+0x34e/0x790\n __writeback_inodes_wb+0x9e/0x120\n wb_writeback+0x4d2/0x660\n wb_workfn+0x64d/0xa10\n process_one_work+0x53a/0xa80\n worker_thread+0x69/0x5b0\n kthread+0x20b/0x240\n ret_from_fork+0x1f/0x30\r\n\r\nOnly Kyber uses the hctx, so fix it by passing the request_queue to\n-\u0026gt;bio_merge() instead. BFQ and mq-deadline just use that, and Kyber can\nmap the queues itself to avoid the mismatch.(CVE-2021-46984)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbus: qcom: Put child node before return\r\n\r\nPut child node before return to fix potential reference count leak.\nGenerally, the reference count of child is incremented and decremented\nautomatically in the macro for_each_available_child_of_node() and should\nbe decremented manually if the loop is broken in loop body.(CVE-2021-47054)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncrypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init\r\n\r\nADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown()\nbefore calling adf_iov_putmsg()-\u0026gt;mutex_lock(vf2pf_lock), however the\nvf2pf_lock is initialized in adf_dev_init(), which can fail and when it\nfail, the vf2pf_lock is either not initialized or destroyed, a subsequent\nuse of vf2pf_lock will cause issue.\nTo fix this issue, only set this flag if adf_dev_init() returns 0.\r\n\r\n[    7.178404] BUG: KASAN: user-memory-access in __mutex_lock.isra.0+0x1ac/0x7c0\n[    7.180345] Call Trace:\n[    7.182576]  mutex_lock+0xc9/0xd0\n[    7.183257]  adf_iov_putmsg+0x118/0x1a0 [intel_qat]\n[    7.183541]  adf_vf2pf_shutdown+0x4d/0x7b [intel_qat]\n[    7.183834]  adf_dev_shutdown+0x172/0x2b0 [intel_qat]\n[    7.184127]  adf_probe+0x5e9/0x600 [qat_dh895xccvf](CVE-2021-47056)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nKVM: Stop looking for coalesced MMIO zones if the bus is destroyed\r\n\r\nAbort the walk of coalesced MMIO zones if kvm_io_bus_unregister_dev()\nfails to allocate memory for the new instance of the bus.  If it can\u0026apos;t\ninstantiate a new bus, unregister_dev() destroys all devices _except_ the\ntarget device.   But, it doesn\u0026apos;t tell the caller that it obliterated the\nbus and invoked the destructor for all devices that were on the bus.  In\nthe coalesced MMIO case, this can result in a deleted list entry\ndereference due to attempting to continue iterating on coalesced_zones\nafter future entries (in the walk) have been deleted.\r\n\r\nOpportunistically add curly braces to the for-loop, which encompasses\nmany lines but sneaks by without braces due to the guts being a single\nif statement.(CVE-2021-47060)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nKVM: Destroy I/O bus devices on unregister failure _after_ sync\u0026apos;ing SRCU\r\n\r\nIf allocating a new instance of an I/O bus fails when unregistering a\ndevice, wait to destroy the device until after all readers are guaranteed\nto see the new null bus.  Destroying devices before the bus is nullified\ncould lead to use-after-free since readers expect the devices on their\nreference of the bus to remain valid.(CVE-2021-47061)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm: bridge/panel: Cleanup connector on bridge detach\r\n\r\nIf we don\u0026apos;t call drm_connector_cleanup() manually in\npanel_bridge_detach(), the connector will be cleaned up with the other\nDRM objects in the call to drm_mode_config_cleanup(). However, since our\ndrm_connector is devm-allocated, by the time drm_mode_config_cleanup()\nwill be called, our connector will be long gone. Therefore, the\nconnector must be cleaned up when the bridge is detached to avoid\nuse-after-free conditions.\r\n\r\nv2: Cleanup connector only if it was created\r\n\r\nv3: Add FIXME\r\n\r\nv4: (Use connector-\u0026gt;dev) directly in if() block(CVE-2021-47063)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nuio_hv_generic: Fix a memory leak in error handling paths\r\n\r\nIf \u0026apos;vmbus_establish_gpadl()\u0026apos; fails, the (recv|send)_gpadl will not be\nupdated and \u0026apos;hv_uio_cleanup()\u0026apos; in the error handling path will not be\nable to free the corresponding buffer.\r\n\r\nIn such a case, we need to free the buffer explicitly.(CVE-2021-47071)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnvme-loop: fix memory leak in nvme_loop_create_ctrl()\r\n\r\nWhen creating loop ctrl in nvme_loop_create_ctrl(), if nvme_init_ctrl()\nfails, the loop ctrl should be freed before jumping to the \u0026quot;out\u0026quot; label.(CVE-2021-47074)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nscsi: qedf: Add pointer checks in qedf_update_link_speed()\r\n\r\nThe following trace was observed:\r\n\r\n [   14.042059] Call Trace:\n [   14.042061]  \u0026lt;IRQ\u0026gt;\n [   14.042068]  qedf_link_update+0x144/0x1f0 [qedf]\n [   14.042117]  qed_link_update+0x5c/0x80 [qed]\n [   14.042135]  qed_mcp_handle_link_change+0x2d2/0x410 [qed]\n [   14.042155]  ? qed_set_ptt+0x70/0x80 [qed]\n [   14.042170]  ? qed_set_ptt+0x70/0x80 [qed]\n [   14.042186]  ? qed_rd+0x13/0x40 [qed]\n [   14.042205]  qed_mcp_handle_events+0x437/0x690 [qed]\n [   14.042221]  ? qed_set_ptt+0x70/0x80 [qed]\n [   14.042239]  qed_int_sp_dpc+0x3a6/0x3e0 [qed]\n [   14.042245]  tasklet_action_common.isra.14+0x5a/0x100\n [   14.042250]  __do_softirq+0xe4/0x2f8\n [   14.042253]  irq_exit+0xf7/0x100\n [   14.042255]  do_IRQ+0x7f/0xd0\n [   14.042257]  common_interrupt+0xf/0xf\n [   14.042259]  \u0026lt;/IRQ\u0026gt;\r\n\r\nAPI qedf_link_update() is getting called from QED but by that time\nshost_data is not initialised. This results in a NULL pointer dereference\nwhen we try to dereference shost_data while updating supported_speeds.\r\n\r\nAdd a NULL pointer check before dereferencing shost_data.(CVE-2021-47077)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/rxe: Clear all QP fields if creation failed\r\n\r\nrxe_qp_do_cleanup() relies on valid pointer values in QP for the properly\ncreated ones, but in case rxe_qp_from_init() failed it was filled with\ngarbage and caused tot the following error.\r\n\r\n  refcount_t: underflow; use-after-free.\n  WARNING: CPU: 1 PID: 12560 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28\n  Modules linked in:\n  CPU: 1 PID: 12560 Comm: syz-executor.4 Not tainted 5.12.0-syzkaller #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n  RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28\n  Code: e9 db fe ff ff 48 89 df e8 2c c2 ea fd e9 8a fe ff ff e8 72 6a a7 fd 48 c7 c7 e0 b2 c1 89 c6 05 dc 3a e6 09 01 e8 ee 74 fb 04 \u0026lt;0f\u0026gt; 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55\n  RSP: 0018:ffffc900097ceba8 EFLAGS: 00010286\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n  RDX: 0000000000040000 RSI: ffffffff815bb075 RDI: fffff520012f9d67\n  RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000\n  R10: ffffffff815b4eae R11: 0000000000000000 R12: ffff8880322a4800\n  R13: ffff8880322a4940 R14: ffff888033044e00 R15: 0000000000000000\n  FS:  00007f6eb2be3700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007fdbe5d41000 CR3: 000000001d181000 CR4: 00000000001506e0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  Call Trace:\n   __refcount_sub_and_test include/linux/refcount.h:283 [inline]\n   __refcount_dec_and_test include/linux/refcount.h:315 [inline]\n   refcount_dec_and_test include/linux/refcount.h:333 [inline]\n   kref_put include/linux/kref.h:64 [inline]\n   rxe_qp_do_cleanup+0x96f/0xaf0 drivers/infiniband/sw/rxe/rxe_qp.c:805\n   execute_in_process_context+0x37/0x150 kernel/workqueue.c:3327\n   rxe_elem_release+0x9f/0x180 drivers/infiniband/sw/rxe/rxe_pool.c:391\n   kref_put include/linux/kref.h:65 [inline]\n   rxe_create_qp+0x2cd/0x310 drivers/infiniband/sw/rxe/rxe_verbs.c:425\n   _ib_create_qp drivers/infiniband/core/core_priv.h:331 [inline]\n   ib_create_named_qp+0x2ad/0x1370 drivers/infiniband/core/verbs.c:1231\n   ib_create_qp include/rdma/ib_verbs.h:3644 [inline]\n   create_mad_qp+0x177/0x2d0 drivers/infiniband/core/mad.c:2920\n   ib_mad_port_open drivers/infiniband/core/mad.c:3001 [inline]\n   ib_mad_init_device+0xd6f/0x1400 drivers/infiniband/core/mad.c:3092\n   add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:717\n   enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1331\n   ib_register_device drivers/infiniband/core/device.c:1413 [inline]\n   ib_register_device+0x7c7/0xa50 drivers/infiniband/core/device.c:1365\n   rxe_register_device+0x3d5/0x4a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1147\n   rxe_add+0x12fe/0x16d0 drivers/infiniband/sw/rxe/rxe.c:247\n   rxe_net_add+0x8c/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:503\n   rxe_newlink drivers/infiniband/sw/rxe/rxe.c:269 [inline]\n   rxe_newlink+0xb7/0xe0 drivers/infiniband/sw/rxe/rxe.c:250\n   nldev_newlink+0x30e/0x550 drivers/infiniband/core/nldev.c:1555\n   rdma_nl_rcv_msg+0x36d/0x690 drivers/infiniband/core/netlink.c:195\n   rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]\n   rdma_nl_rcv+0x2ee/0x430 drivers/infiniband/core/netlink.c:259\n   netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]\n   netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338\n   netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927\n   sock_sendmsg_nosec net/socket.c:654 [inline]\n   sock_sendmsg+0xcf/0x120 net/socket.c:674\n   ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350\n   ___sys_sendmsg+0xf3/0x170 net/socket.c:2404\n   __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433\n   do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47\n   entry_SYSCALL_64_after_hwframe+0\n---truncated---(CVE-2021-47078)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nasix: fix uninit-value in asix_mdio_read()\r\n\r\nasix_read_cmd() may read less than sizeof(smsr) bytes and in this case\nsmsr will be uninitialized.\r\n\r\nFail log:\nBUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline]\nBUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497\nBUG: KMSAN: uninit-value in asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497\n asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline]\n asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497\n asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497(CVE-2021-47101)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/tls: Fix use-after-free after the TLS device goes down and up\r\n\r\nWhen a netdev with active TLS offload goes down, tls_device_down is\ncalled to stop the offload and tear down the TLS context. However, the\nsocket stays alive, and it still points to the TLS context, which is now\ndeallocated. If a netdev goes up, while the connection is still active,\nand the data flow resumes after a number of TCP retransmissions, it will\nlead to a use-after-free of the TLS context.\r\n\r\nThis commit addresses this bug by keeping the context alive until its\nnormal destruction, and implements the necessary fallbacks, so that the\nconnection can resume in software (non-offloaded) kTLS mode.\r\n\r\nOn the TX side tls_sw_fallback is used to encrypt all packets. The RX\nside already has all the necessary fallbacks, because receiving\nnon-decrypted packets is supported. The thing needed on the RX side is\nto block resync requests, which are normally produced after receiving\nnon-decrypted packets.\r\n\r\nThe necessary synchronization is implemented for a graceful teardown:\nfirst the fallbacks are deployed, then the driver resources are released\n(it used to be possible to have a tls_dev_resync after tls_dev_del).\r\n\r\nA new flag called TLS_RX_DEV_DEGRADED is added to indicate the fallback\nmode. It\u0026apos;s used to skip the RX resync logic completely, as it becomes\nuseless, and some objects may be released (for example, resync_async,\nwhich is allocated and freed by the driver).(CVE-2021-47131)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amdgpu: Fix a use-after-free\r\n\r\nlooks like we forget to set ttm-\u0026gt;sg to NULL.\nHit panic below\r\n\r\n[ 1235.844104] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI\n[ 1235.989074] Call Trace:\n[ 1235.991751]  sg_free_table+0x17/0x20\n[ 1235.995667]  amdgpu_ttm_backend_unbind.cold+0x4d/0xf7 [amdgpu]\n[ 1236.002288]  amdgpu_ttm_backend_destroy+0x29/0x130 [amdgpu]\n[ 1236.008464]  ttm_tt_destroy+0x1e/0x30 [ttm]\n[ 1236.013066]  ttm_bo_cleanup_memtype_use+0x51/0xa0 [ttm]\n[ 1236.018783]  ttm_bo_release+0x262/0xa50 [ttm]\n[ 1236.023547]  ttm_bo_put+0x82/0xd0 [ttm]\n[ 1236.027766]  amdgpu_bo_unref+0x26/0x50 [amdgpu]\n[ 1236.032809]  amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x7aa/0xd90 [amdgpu]\n[ 1236.040400]  kfd_ioctl_alloc_memory_of_gpu+0xe2/0x330 [amdgpu]\n[ 1236.046912]  kfd_ioctl+0x463/0x690 [amdgpu](CVE-2021-47142)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/smc: remove device from smcd_dev_list after failed device_add()\r\n\r\nIf the device_add() for a smcd_dev fails, there\u0026apos;s no cleanup step that\nrolls back the earlier list_add(). The device subsequently gets freed,\nand we end up with a corrupted list.\r\n\r\nAdd some error handling that removes the device from the list.(CVE-2021-47143)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/amdgpu: fix refcount leak\r\n\r\n[Why]\nthe gem object rfb-\u0026gt;base.obj[0] is get according to num_planes\nin amdgpufb_create, but is not put according to num_planes\r\n\r\n[How]\nput rfb-\u0026gt;base.obj[0] in amdgpu_fbdev_destroy according to num_planes(CVE-2021-47144)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: do not BUG_ON in link_to_fixup_dir\r\n\r\nWhile doing error injection testing I got the following panic\r\n\r\n  kernel BUG at fs/btrfs/tree-log.c:1862!\n  invalid opcode: 0000 [#1] SMP NOPTI\n  CPU: 1 PID: 7836 Comm: mount Not tainted 5.13.0-rc1+ #305\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014\n  RIP: 0010:link_to_fixup_dir+0xd5/0xe0\n  RSP: 0018:ffffb5800180fa30 EFLAGS: 00010216\n  RAX: fffffffffffffffb RBX: 00000000fffffffb RCX: ffff8f595287faf0\n  RDX: ffffb5800180fa37 RSI: ffff8f5954978800 RDI: 0000000000000000\n  RBP: ffff8f5953af9450 R08: 0000000000000019 R09: 0000000000000001\n  R10: 000151f408682970 R11: 0000000120021001 R12: ffff8f5954978800\n  R13: ffff8f595287faf0 R14: ffff8f5953c77dd0 R15: 0000000000000065\n  FS:  00007fc5284c8c40(0000) GS:ffff8f59bbd00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007fc5287f47c0 CR3: 000000011275e002 CR4: 0000000000370ee0\n  Call Trace:\n   replay_one_buffer+0x409/0x470\n   ? btree_read_extent_buffer_pages+0xd0/0x110\n   walk_up_log_tree+0x157/0x1e0\n   walk_log_tree+0xa6/0x1d0\n   btrfs_recover_log_trees+0x1da/0x360\n   ? replay_one_extent+0x7b0/0x7b0\n   open_ctree+0x1486/0x1720\n   btrfs_mount_root.cold+0x12/0xea\n   ? __kmalloc_track_caller+0x12f/0x240\n   legacy_get_tree+0x24/0x40\n   vfs_get_tree+0x22/0xb0\n   vfs_kern_mount.part.0+0x71/0xb0\n   btrfs_mount+0x10d/0x380\n   ? vfs_parse_fs_string+0x4d/0x90\n   legacy_get_tree+0x24/0x40\n   vfs_get_tree+0x22/0xb0\n   path_mount+0x433/0xa10\n   __x64_sys_mount+0xe3/0x120\n   do_syscall_64+0x3d/0x80\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\r\n\r\nWe can get -EIO or any number of legitimate errors from\nbtrfs_search_slot(), panicing here is not the appropriate response.  The\nerror path for this code handles errors properly, simply return the\nerror.(CVE-2021-47145)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmld: fix panic in mld_newpack()\r\n\r\nmld_newpack() doesn\u0026apos;t allow to allocate high order page,\nonly order-0 allocation is allowed.\nIf headroom size is too large, a kernel panic could occur in skb_put().\r\n\r\nTest commands:\n    ip netns del A\n    ip netns del B\n    ip netns add A\n    ip netns add B\n    ip link add veth0 type veth peer name veth1\n    ip link set veth0 netns A\n    ip link set veth1 netns B\r\n\r\n    ip netns exec A ip link set lo up\n    ip netns exec A ip link set veth0 up\n    ip netns exec A ip -6 a a 2001:db8:0::1/64 dev veth0\n    ip netns exec B ip link set lo up\n    ip netns exec B ip link set veth1 up\n    ip netns exec B ip -6 a a 2001:db8:0::2/64 dev veth1\n    for i in {1..99}\n    do\n        let A=$i-1\n        ip netns exec A ip link add ip6gre$i type ip6gre \\\n\tlocal 2001:db8:$A::1 remote 2001:db8:$A::2 encaplimit 100\n        ip netns exec A ip -6 a a 2001:db8:$i::1/64 dev ip6gre$i\n        ip netns exec A ip link set ip6gre$i up\r\n\r\n        ip netns exec B ip link add ip6gre$i type ip6gre \\\n\tlocal 2001:db8:$A::2 remote 2001:db8:$A::1 encaplimit 100\n        ip netns exec B ip -6 a a 2001:db8:$i::2/64 dev ip6gre$i\n        ip netns exec B ip link set ip6gre$i up\n    done\r\n\r\nSplat looks like:\nkernel BUG at net/core/skbuff.c:110!\ninvalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI\nCPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.12.0+ #891\nWorkqueue: ipv6_addrconf addrconf_dad_work\nRIP: 0010:skb_panic+0x15d/0x15f\nCode: 92 fe 4c 8b 4c 24 10 53 8b 4d 70 45 89 e0 48 c7 c7 00 ae 79 83\n41 57 41 56 41 55 48 8b 54 24 a6 26 f9 ff \u0026lt;0f\u0026gt; 0b 48 8b 6c 24 20 89\n34 24 e8 4a 4e 92 fe 8b 34 24 48 c7 c1 20\nRSP: 0018:ffff88810091f820 EFLAGS: 00010282\nRAX: 0000000000000089 RBX: ffff8881086e9000 RCX: 0000000000000000\nRDX: 0000000000000089 RSI: 0000000000000008 RDI: ffffed1020123efb\nRBP: ffff888005f6eac0 R08: ffffed1022fc0031 R09: ffffed1022fc0031\nR10: ffff888117e00187 R11: ffffed1022fc0030 R12: 0000000000000028\nR13: ffff888008284eb0 R14: 0000000000000ed8 R15: 0000000000000ec0\nFS:  0000000000000000(0000) GS:ffff888117c00000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f8b801c5640 CR3: 0000000033c2c006 CR4: 00000000003706f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n ? ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600\n ? ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600\n skb_put.cold.104+0x22/0x22\n ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600\n ? rcu_read_lock_sched_held+0x91/0xc0\n mld_newpack+0x398/0x8f0\n ? ip6_mc_hdr.isra.26.constprop.46+0x600/0x600\n ? lock_contended+0xc40/0xc40\n add_grhead.isra.33+0x280/0x380\n add_grec+0x5ca/0xff0\n ? mld_sendpack+0xf40/0xf40\n ? lock_downgrade+0x690/0x690\n mld_send_initial_cr.part.34+0xb9/0x180\n ipv6_mc_dad_complete+0x15d/0x1b0\n addrconf_dad_completed+0x8d2/0xbb0\n ? lock_downgrade+0x690/0x690\n ? addrconf_rs_timer+0x660/0x660\n ? addrconf_dad_work+0x73c/0x10e0\n addrconf_dad_work+0x73c/0x10e0\r\n\r\nAllowing high order page allocation could fix this problem.(CVE-2021-47146)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ni2c: i801: Don\u0026apos;t generate an interrupt on bus reset\r\n\r\nNow that the i2c-i801 driver supports interrupts, setting the KILL bit\nin a attempt to recover from a timed out transaction triggers an\ninterrupt. Unfortunately, the interrupt handler (i801_isr) is not\nprepared for this situation and will try to process the interrupt as\nif it was signaling the end of a successful transaction. In the case\nof a block transaction, this can result in an out-of-range memory\naccess.\r\n\r\nThis condition was reproduced several times by syzbot:\nhttps://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e\nhttps://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e\nhttps://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e\nhttps://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb\nhttps://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a\nhttps://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79\r\n\r\nSo disable interrupts while trying to reset the bus. Interrupts will\nbe enabled again for the following transaction.(CVE-2021-47153)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: dsa: fix a crash if -\u0026gt;get_sset_count() fails\r\n\r\nIf ds-\u0026gt;ops-\u0026gt;get_sset_count() fails then it \u0026quot;count\u0026quot; is a negative error\ncode such as -EOPNOTSUPP.  Because \u0026quot;i\u0026quot; is an unsigned int, the negative\nerror code is type promoted to a very high value and the loop will\ncorrupt memory until the system crashes.\r\n\r\nFix this by checking for error codes and changing the type of \u0026quot;i\u0026quot; to\njust int.(CVE-2021-47159)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: dsa: mt7530: fix VLAN traffic leaks\r\n\r\nPCR_MATRIX field was set to all 1\u0026apos;s when VLAN filtering is enabled, but\nwas not reset when it is disabled, which may cause traffic leaks:\r\n\r\n\tip link add br0 type bridge vlan_filtering 1\n\tip link add br1 type bridge vlan_filtering 1\n\tip link set swp0 master br0\n\tip link set swp1 master br1\n\tip link set br0 type bridge vlan_filtering 0\n\tip link set br1 type bridge vlan_filtering 0\n\t# traffic in br0 and br1 will start leaking to each other\r\n\r\nAs port_bridge_{add,del} have set up PCR_MATRIX properly, remove the\nPCR_MATRIX write from mt7530_port_set_vlan_aware.(CVE-2021-47160)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nspi: spi-fsl-dspi: Fix a resource leak in an error handling path\r\n\r\n\u0026apos;dspi_request_dma()\u0026apos; should be undone by a \u0026apos;dspi_release_dma()\u0026apos; call in the\nerror handling path of the probe function, as already done in the remove\nfunction(CVE-2021-47161)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntipc: skb_linearize the head skb when reassembling msgs\r\n\r\nIt\u0026apos;s not a good idea to append the frag skb to a skb\u0026apos;s frag_list if\nthe frag_list already has skbs from elsewhere, such as this skb was\ncreated by pskb_copy() where the frag_list was cloned (all the skbs\nin it were skb_get\u0026apos;ed) and shared by multiple skbs.\r\n\r\nHowever, the new appended frag skb should have been only seen by the\ncurrent skb. Otherwise, it will cause use after free crashes as this\nappended frag skb are seen by multiple skbs but it only got skb_get\ncalled once.\r\n\r\nThe same thing happens with a skb updated by pskb_may_pull() with a\nskb_cloned skb. Li Shuang has reported quite a few crashes caused\nby this when doing testing over macvlan devices:\r\n\r\n  [] kernel BUG at net/core/skbuff.c:1970!\n  [] Call Trace:\n  []  skb_clone+0x4d/0xb0\n  []  macvlan_broadcast+0xd8/0x160 [macvlan]\n  []  macvlan_process_broadcast+0x148/0x150 [macvlan]\n  []  process_one_work+0x1a7/0x360\n  []  worker_thread+0x30/0x390\r\n\r\n  [] kernel BUG at mm/usercopy.c:102!\n  [] Call Trace:\n  []  __check_heap_object+0xd3/0x100\n  []  __check_object_size+0xff/0x16b\n  []  simple_copy_to_iter+0x1c/0x30\n  []  __skb_datagram_iter+0x7d/0x310\n  []  __skb_datagram_iter+0x2a5/0x310\n  []  skb_copy_datagram_iter+0x3b/0x90\n  []  tipc_recvmsg+0x14a/0x3a0 [tipc]\n  []  ____sys_recvmsg+0x91/0x150\n  []  ___sys_recvmsg+0x7b/0xc0\r\n\r\n  [] kernel BUG at mm/slub.c:305!\n  [] Call Trace:\n  []  \u0026lt;IRQ\u0026gt;\n  []  kmem_cache_free+0x3ff/0x400\n  []  __netif_receive_skb_core+0x12c/0xc40\n  []  ? kmem_cache_alloc+0x12e/0x270\n  []  netif_receive_skb_internal+0x3d/0xb0\n  []  ? get_rx_page_info+0x8e/0xa0 [be2net]\n  []  be_poll+0x6ef/0xd00 [be2net]\n  []  ? irq_exit+0x4f/0x100\n  []  net_rx_action+0x149/0x3b0\r\n\r\n  ...\r\n\r\nThis patch is to fix it by linearizing the head skb if it has frag_list\nset in tipc_buf_append(). Note that we choose to do this before calling\nskb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can\nnot just drop the frag_list either as the early time.(CVE-2021-47162)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntipc: wait and exit until all work queues are done\r\n\r\nOn some host, a crash could be triggered simply by repeating these\ncommands several times:\r\n\r\n  # modprobe tipc\n  # tipc bearer enable media udp name UDP1 localip 127.0.0.1\n  # rmmod tipc\r\n\r\n  [] BUG: unable to handle kernel paging request at ffffffffc096bb00\n  [] Workqueue: events 0xffffffffc096bb00\n  [] Call Trace:\n  []  ? process_one_work+0x1a7/0x360\n  []  ? worker_thread+0x30/0x390\n  []  ? create_worker+0x1a0/0x1a0\n  []  ? kthread+0x116/0x130\n  []  ? kthread_flush_work_fn+0x10/0x10\n  []  ? ret_from_fork+0x35/0x40\r\n\r\nWhen removing the TIPC module, the UDP tunnel sock will be delayed to\nrelease in a work queue as sock_release() can\u0026apos;t be done in rtnl_lock().\nIf the work queue is schedule to run after the TIPC module is removed,\nkernel will crash as the work queue function cleanup_beareri() code no\nlonger exists when trying to invoke it.\r\n\r\nTo fix it, this patch introduce a member wq_count in tipc_net to track\nthe numbers of work queues in schedule, and  wait and exit until all\nwork queues are done in tipc_exit_net().(CVE-2021-47163)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nNFS: Fix an Oopsable condition in __nfs_pageio_add_request()\r\n\r\nEnsure that nfs_pageio_error_cleanup() resets the mirror array contents,\nso that the structure reflects the fact that it is now empty.\nAlso change the test in nfs_pageio_do_add_request() to be more robust by\nchecking whether or not the list is empty rather than relying on the\nvalue of pg_count.(CVE-2021-47167)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nUSB: usbfs: Don\u0026apos;t WARN about excessively large memory allocations\r\n\r\nSyzbot found that the kernel generates a WARNing if the user tries to\nsubmit a bulk transfer through usbfs with a buffer that is way too\nlarge.  This isn\u0026apos;t a bug in the kernel; it\u0026apos;s merely an invalid request\nfrom the user and the usbfs code does handle it correctly.\r\n\r\nIn theory the same thing can happen with async transfers, or with the\npacket descriptor table for isochronous transfers.\r\n\r\nTo prevent the MM subsystem from complaining about these bad\nallocation requests, add the __GFP_NOWARN flag to the kmalloc calls\nfor these buffers.(CVE-2021-47170)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: usb: fix memory leak in smsc75xx_bind\r\n\r\nSyzbot reported memory leak in smsc75xx_bind().\nThe problem was is non-freed memory in case of\nerrors after memory allocation.\r\n\r\nbacktrace:\n  [\u0026lt;ffffffff84245b62\u0026gt;] kmalloc include/linux/slab.h:556 [inline]\n  [\u0026lt;ffffffff84245b62\u0026gt;] kzalloc include/linux/slab.h:686 [inline]\n  [\u0026lt;ffffffff84245b62\u0026gt;] smsc75xx_bind+0x7a/0x334 drivers/net/usb/smsc75xx.c:1460\n  [\u0026lt;ffffffff82b5b2e6\u0026gt;] usbnet_probe+0x3b6/0xc30 drivers/net/usb/usbnet.c:1728(CVE-2021-47171)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmisc/uss720: fix memory leak in uss720_probe\r\n\r\nuss720_probe forgets to decrease the refcount of usbdev in uss720_probe.\nFix this by decreasing the refcount of usbdev by usb_put_dev.\r\n\r\nBUG: memory leak\nunreferenced object 0xffff888101113800 (size 2048):\n  comm \u0026quot;kworker/0:1\u0026quot;, pid 7, jiffies 4294956777 (age 28.870s)\n  hex dump (first 32 bytes):\n    ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00  ....1...........\n    00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00  ................\n  backtrace:\n    [\u0026lt;ffffffff82b8e822\u0026gt;] kmalloc include/linux/slab.h:554 [inline]\n    [\u0026lt;ffffffff82b8e822\u0026gt;] kzalloc include/linux/slab.h:684 [inline]\n    [\u0026lt;ffffffff82b8e822\u0026gt;] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582\n    [\u0026lt;ffffffff82b98441\u0026gt;] hub_port_connect drivers/usb/core/hub.c:5129 [inline]\n    [\u0026lt;ffffffff82b98441\u0026gt;] hub_port_connect_change drivers/usb/core/hub.c:5363 [inline]\n    [\u0026lt;ffffffff82b98441\u0026gt;] port_event drivers/usb/core/hub.c:5509 [inline]\n    [\u0026lt;ffffffff82b98441\u0026gt;] hub_event+0x1171/0x20c0 drivers/usb/core/hub.c:5591\n    [\u0026lt;ffffffff81259229\u0026gt;] process_one_work+0x2c9/0x600 kernel/workqueue.c:2275\n    [\u0026lt;ffffffff81259b19\u0026gt;] worker_thread+0x59/0x5d0 kernel/workqueue.c:2421\n    [\u0026lt;ffffffff81261228\u0026gt;] kthread+0x178/0x1b0 kernel/kthread.c:292\n    [\u0026lt;ffffffff8100227f\u0026gt;] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294(CVE-2021-47173)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nNFC: nci: fix memory leak in nci_allocate_device\r\n\r\nnfcmrvl_disconnect fails to free the hci_dev field in struct nci_dev.\nFix this by freeing hci_dev in nci_free_device.\r\n\r\nBUG: memory leak\nunreferenced object 0xffff888111ea6800 (size 1024):\n  comm \u0026quot;kworker/1:0\u0026quot;, pid 19, jiffies 4294942308 (age 13.580s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 60 fd 0c 81 88 ff ff  .........`......\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u0026lt;000000004bc25d43\u0026gt;] kmalloc include/linux/slab.h:552 [inline]\n    [\u0026lt;000000004bc25d43\u0026gt;] kzalloc include/linux/slab.h:682 [inline]\n    [\u0026lt;000000004bc25d43\u0026gt;] nci_hci_allocate+0x21/0xd0 net/nfc/nci/hci.c:784\n    [\u0026lt;00000000c59cff92\u0026gt;] nci_allocate_device net/nfc/nci/core.c:1170 [inline]\n    [\u0026lt;00000000c59cff92\u0026gt;] nci_allocate_device+0x10b/0x160 net/nfc/nci/core.c:1132\n    [\u0026lt;00000000006e0a8e\u0026gt;] nfcmrvl_nci_register_dev+0x10a/0x1c0 drivers/nfc/nfcmrvl/main.c:153\n    [\u0026lt;000000004da1b57e\u0026gt;] nfcmrvl_probe+0x223/0x290 drivers/nfc/nfcmrvl/usb.c:345\n    [\u0026lt;00000000d506aed9\u0026gt;] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n    [\u0026lt;00000000bc632c92\u0026gt;] really_probe+0x159/0x4a0 drivers/base/dd.c:554\n    [\u0026lt;00000000f5009125\u0026gt;] driver_probe_device+0x84/0x100 drivers/base/dd.c:740\n    [\u0026lt;000000000ce658ca\u0026gt;] __device_attach_driver+0xee/0x110 drivers/base/dd.c:846\n    [\u0026lt;000000007067d05f\u0026gt;] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431\n    [\u0026lt;00000000f8e13372\u0026gt;] __device_attach+0x122/0x250 drivers/base/dd.c:914\n    [\u0026lt;000000009cf68860\u0026gt;] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491\n    [\u0026lt;00000000359c965a\u0026gt;] device_add+0x5be/0xc30 drivers/base/core.c:3109\n    [\u0026lt;00000000086e4bd3\u0026gt;] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164\n    [\u0026lt;00000000ca036872\u0026gt;] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238\n    [\u0026lt;00000000d40d36f6\u0026gt;] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293\n    [\u0026lt;00000000bc632c92\u0026gt;] really_probe+0x159/0x4a0 drivers/base/dd.c:554(CVE-2021-47180)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nEDAC/thunderx: Fix possible out-of-bounds string access\r\n\r\nEnabling -Wstringop-overflow globally exposes a warning for a common bug\nin the usage of strncat():\r\n\r\n  drivers/edac/thunderx_edac.c: In function \u0026apos;thunderx_ocx_com_threaded_isr\u0026apos;:\n  drivers/edac/thunderx_edac.c:1136:17: error: \u0026apos;strncat\u0026apos; specified bound 1024 equals destination size [-Werror=stringop-overflow=]\n   1136 |                 strncat(msg, other, OCX_MESSAGE_SIZE);\n        |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n   ...\n   1145 |                                 strncat(msg, other, OCX_MESSAGE_SIZE);\n   ...\n   1150 |                                 strncat(msg, other, OCX_MESSAGE_SIZE);\r\n\r\n   ...\r\n\r\nApparently the author of this driver expected strncat() to behave the\nway that strlcat() does, which uses the size of the destination buffer\nas its third argument rather than the length of the source buffer. The\nresult is that there is no check on the size of the allocated buffer.\r\n\r\nChange it to strlcat().\r\n\r\n  [ bp: Trim compiler output, fixup commit message. ](CVE-2023-52464)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nInput: powermate - fix use-after-free in powermate_config_complete\r\n\r\nsyzbot has found a use-after-free bug [1] in the powermate driver. This\nhappens when the device is disconnected, which leads to a memory free from\nthe powermate_device struct.  When an asynchronous control message\ncompletes after the kfree and its callback is invoked, the lock does not\nexist anymore and hence the bug.\r\n\r\nUse usb_kill_urb() on pm-\u0026gt;config to cancel any in-progress requests upon\ndevice disconnection.\r\n\r\n[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e(CVE-2023-52475)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nscsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command\r\n\r\nTags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed\nwhen we receive the response.(CVE-2023-52500)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnfc: nci: assert requested protocol is valid\r\n\r\nThe protocol is used in a bit mask to determine if the protocol is\nsupported. Assert the provided protocol is less than the maximum\ndefined so it doesn\u0026apos;t potentially perform a shift-out-of-bounds and\nprovide a clearer error for undefined protocols vs unsupported ones.(CVE-2023-52507)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nieee802154: ca8210: Fix a potential UAF in ca8210_probe\r\n\r\nIf of_clk_add_provider() fails in ca8210_register_ext_clock(),\nit calls clk_unregister() to release priv-\u0026gt;clk and returns an\nerror. However, the caller ca8210_probe() then calls ca8210_remove(),\nwhere priv-\u0026gt;clk is freed again in ca8210_unregister_ext_clock(). In\nthis case, a use-after-free may happen in the second time we call\nclk_unregister().\r\n\r\nFix this by removing the first clk_unregister(). Also, priv-\u0026gt;clk could\nbe an error code on failure of clk_register_fixed_rate(). Use\nIS_ERR_OR_NULL to catch this case in ca8210_unregister_ext_clock().(CVE-2023-52510)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/srp: Do not call scsi_done() from srp_abort()\r\n\r\nAfter scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler\ncallback, it performs one of the following actions:\n* Call scsi_queue_insert().\n* Call scsi_finish_command().\n* Call scsi_eh_scmd_add().\nHence, SCSI abort handlers must not call scsi_done(). Otherwise all\nthe above actions would trigger a use-after-free. Hence remove the\nscsi_done() call from srp_abort(). Keep the srp_free_req() call\nbefore returning SUCCESS because we may not see the command again if\nSUCCESS is returned.(CVE-2023-52515)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: fix possible store tearing in neigh_periodic_work()\r\n\r\nWhile looking at a related syzbot report involving neigh_periodic_work(),\nI found that I forgot to add an annotation when deleting an\nRCU protected item from a list.\r\n\r\nReaders use rcu_deference(*np), we need to use either\nrcu_assign_pointer() or WRITE_ONCE() on writer side\nto prevent store tearing.\r\n\r\nI use rcu_assign_pointer() to have lockdep support,\nthis was the choice made in neigh_flush_dev().(CVE-2023-52522)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: mac80211: fix potential key use-after-free\r\n\r\nWhen ieee80211_key_link() is called by ieee80211_gtk_rekey_add()\nbut returns 0 due to KRACK protection (identical key reinstall),\nieee80211_gtk_rekey_add() will still return a pointer into the\nkey, in a potential use-after-free. This normally doesn\u0026apos;t happen\nsince it\u0026apos;s only called by iwlwifi in case of WoWLAN rekey offload\nwhich has its own KRACK protection, but still better to fix, do\nthat by returning an error code and converting that to success on\nthe cfg80211 boundary only, leaving the error for bad callers of\nieee80211_gtk_rekey_add().(CVE-2023-52530)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix potential use after free in nilfs_gccache_submit_read_data()\r\n\r\nIn nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the\nreference count of bh when the call to nilfs_dat_translate() fails.  If\nthe reference count hits 0 and its owner page gets unlocked, bh may be\nfreed.  However, bh-\u0026gt;b_page is dereferenced to put the page after that,\nwhich may result in a use-after-free bug.  This patch moves the release\noperation after unlocking and putting the page.\r\n\r\nNOTE: The function in question is only called in GC, and in combination\nwith current userland tools, address translation using DAT does not occur\nin that function, so the code path that causes this issue will not be\nexecuted.  However, it is possible to run that code path by intentionally\nmodifying the userland GC library or by calling the GC ioctl directly.\r\n\r\n[konishi.ryusuke@gmail.com: NOTE added to the commit log](CVE-2023-52566)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: bridge: use DEV_STATS_INC()\r\n\r\nsyzbot/KCSAN reported data-races in br_handle_frame_finish() [1]\nThis function can run from multiple cpus without mutual exclusion.\r\n\r\nAdopt SMP safe DEV_STATS_INC() to update dev-\u0026gt;stats fields.\r\n\r\nHandles updates to dev-\u0026gt;stats.tx_dropped while we are at it.\r\n\r\n[1]\nBUG: KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish\r\n\r\nread-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 1:\nbr_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189\nbr_nf_hook_thresh+0x1ed/0x220\nbr_nf_pre_routing_finish_ipv6+0x50f/0x540\nNF_HOOK include/linux/netfilter.h:304 [inline]\nbr_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178\nbr_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508\nnf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]\nnf_hook_bridge_pre net/bridge/br_input.c:272 [inline]\nbr_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417\n__netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417\n__netif_receive_skb_one_core net/core/dev.c:5521 [inline]\n__netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637\nprocess_backlog+0x21f/0x380 net/core/dev.c:5965\n__napi_poll+0x60/0x3b0 net/core/dev.c:6527\nnapi_poll net/core/dev.c:6594 [inline]\nnet_rx_action+0x32b/0x750 net/core/dev.c:6727\n__do_softirq+0xc1/0x265 kernel/softirq.c:553\nrun_ksoftirqd+0x17/0x20 kernel/softirq.c:921\nsmpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164\nkthread+0x1d7/0x210 kernel/kthread.c:388\nret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147\nret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304\r\n\r\nread-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 0:\nbr_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189\nbr_nf_hook_thresh+0x1ed/0x220\nbr_nf_pre_routing_finish_ipv6+0x50f/0x540\nNF_HOOK include/linux/netfilter.h:304 [inline]\nbr_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178\nbr_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508\nnf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]\nnf_hook_bridge_pre net/bridge/br_input.c:272 [inline]\nbr_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417\n__netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417\n__netif_receive_skb_one_core net/core/dev.c:5521 [inline]\n__netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637\nprocess_backlog+0x21f/0x380 net/core/dev.c:5965\n__napi_poll+0x60/0x3b0 net/core/dev.c:6527\nnapi_poll net/core/dev.c:6594 [inline]\nnet_rx_action+0x32b/0x750 net/core/dev.c:6727\n__do_softirq+0xc1/0x265 kernel/softirq.c:553\ndo_softirq+0x5e/0x90 kernel/softirq.c:454\n__local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381\n__raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]\n_raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210\nspin_unlock_bh include/linux/spinlock.h:396 [inline]\nbatadv_tt_local_purge+0x1a8/0x1f0 net/batman-adv/translation-table.c:1356\nbatadv_tt_purge+0x2b/0x630 net/batman-adv/translation-table.c:3560\nprocess_one_work kernel/workqueue.c:2630 [inline]\nprocess_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2703\nworker_thread+0x525/0x730 kernel/workqueue.c:2784\nkthread+0x1d7/0x210 kernel/kthread.c:388\nret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147\nret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304\r\n\r\nvalue changed: 0x00000000000d7190 -\u0026gt; 0x00000000000d7191\r\n\r\nReported by Kernel Concurrency Sanitizer on:\nCPU: 0 PID: 14848 Comm: kworker/u4:11 Not tainted 6.6.0-rc1-syzkaller-00236-gad8a69f361b9 #0(CVE-2023-52578)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nceph: fix deadlock or deadcode of misusing dget()\r\n\r\nThe lock order is incorrect between denty and its parent, we should\nalways make sure that the parent get the lock first.\r\n\r\nBut since this deadcode is never used and the parent dir will always\nbe set from the callers, let\u0026apos;s just remove it.(CVE-2023-52583)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nIB/ipoib: Fix mcast list locking\r\n\r\nReleasing the `priv-\u0026gt;lock` while iterating the `priv-\u0026gt;multicast_list` in\n`ipoib_mcast_join_task()` opens a window for `ipoib_mcast_dev_flush()` to\nremove the items while in the middle of iteration. If the mcast is removed\nwhile the lock was dropped, the for loop spins forever resulting in a hard\nlockup (as was reported on RHEL 4.18.0-372.75.1.el8_6 kernel):\r\n\r\n    Task A (kworker/u72:2 below)       | Task B (kworker/u72:0 below)\n    -----------------------------------+-----------------------------------\n    ipoib_mcast_join_task(work)        | ipoib_ib_dev_flush_light(work)\n      spin_lock_irq(\u0026amp;priv-\u0026gt;lock)       | __ipoib_ib_dev_flush(priv, ...)\n      list_for_each_entry(mcast,       | ipoib_mcast_dev_flush(dev = priv-\u0026gt;dev)\n          \u0026amp;priv-\u0026gt;multicast_list, list) |\n        ipoib_mcast_join(dev, mcast)   |\n          spin_unlock_irq(\u0026amp;priv-\u0026gt;lock) |\n                                       |   spin_lock_irqsave(\u0026amp;priv-\u0026gt;lock, flags)\n                                       |   list_for_each_entry_safe(mcast, tmcast,\n                                       |                  \u0026amp;priv-\u0026gt;multicast_list, list)\n                                       |     list_del(\u0026amp;mcast-\u0026gt;list);\n                                       |     list_add_tail(\u0026amp;mcast-\u0026gt;list, \u0026amp;remove_list)\n                                       |   spin_unlock_irqrestore(\u0026amp;priv-\u0026gt;lock, flags)\n          spin_lock_irq(\u0026amp;priv-\u0026gt;lock)   |\n                                       |   ipoib_mcast_remove_list(\u0026amp;remove_list)\n   (Here, `mcast` is no longer on the  |     list_for_each_entry_safe(mcast, tmcast,\n    `priv-\u0026gt;multicast_list` and we keep |                            remove_list, list)\n    spinning on the `remove_list` of   |  \u0026gt;\u0026gt;\u0026gt;  wait_for_completion(\u0026amp;mcast-\u0026gt;done)\n    the other thread which is blocked  |\n    and the list is still valid on     |\n    it\u0026apos;s stack.)\r\n\r\nFix this by keeping the lock held and changing to GFP_ATOMIC to prevent\neventual sleeps.\nUnfortunately we could not reproduce the lockup and confirm this fix but\nbased on the code review I think this fix should address such lockups.\r\n\r\ncrash\u0026gt; bc 31\nPID: 747      TASK: ff1c6a1a007e8000  CPU: 31   COMMAND: \u0026quot;kworker/u72:2\u0026quot;\n--\n    [exception RIP: ipoib_mcast_join_task+0x1b1]\n    RIP: ffffffffc0944ac1  RSP: ff646f199a8c7e00  RFLAGS: 00000002\n    RAX: 0000000000000000  RBX: ff1c6a1a04dc82f8  RCX: 0000000000000000\n                                  work (\u0026amp;priv-\u0026gt;mcast_task{,.work})\n    RDX: ff1c6a192d60ac68  RSI: 0000000000000286  RDI: ff1c6a1a04dc8000\n           \u0026amp;mcast-\u0026gt;list\n    RBP: ff646f199a8c7e90   R8: ff1c699980019420   R9: ff1c6a1920c9a000\n    R10: ff646f199a8c7e00  R11: ff1c6a191a7d9800  R12: ff1c6a192d60ac00\n                                                         mcast\n    R13: ff1c6a1d82200000  R14: ff1c6a1a04dc8000  R15: ff1c6a1a04dc82d8\n           dev                    priv (\u0026amp;priv-\u0026gt;lock)     \u0026amp;priv-\u0026gt;multicast_list (aka head)\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\n--- \u0026lt;NMI exception stack\u0026gt; ---\n #5 [ff646f199a8c7e00] ipoib_mcast_join_task+0x1b1 at ffffffffc0944ac1 [ib_ipoib]\n #6 [ff646f199a8c7e98] process_one_work+0x1a7 at ffffffff9bf10967\r\n\r\ncrash\u0026gt; rx ff646f199a8c7e68\nff646f199a8c7e68:  ff1c6a1a04dc82f8 \u0026lt;\u0026lt;\u0026lt; work = \u0026amp;priv-\u0026gt;mcast_task.work\r\n\r\ncrash\u0026gt; list -hO ipoib_dev_priv.multicast_list ff1c6a1a04dc8000\n(empty)\r\n\r\ncrash\u0026gt; ipoib_dev_priv.mcast_task.work.func,mcast_mutex.owner.counter ff1c6a1a04dc8000\n  mcast_task.work.func = 0xffffffffc0944910 \u0026lt;ipoib_mcast_join_task\u0026gt;,\n  mcast_mutex.owner.counter = 0xff1c69998efec000\r\n\r\ncrash\u0026gt; b 8\nPID: 8        TASK: ff1c69998efec000  CPU: 33   COMMAND: \u0026quot;kworker/u72:0\u0026quot;\n--\n #3 [ff646f1980153d50] wait_for_completion+0x96 at ffffffff9c7d7646\n #4 [ff646f1980153d90] ipoib_mcast_remove_list+0x56 at ffffffffc0944dc6 [ib_ipoib]\n #5 [ff646f1980153de8] ipoib_mcast_dev_flush+0x1a7 at ffffffffc09455a7 [ib_ipoib]\n #6 [ff646f1980153e58] __ipoib_ib_dev_flush+0x1a4 at ffffffffc09431a4 [ib_ipoib]\n #7 [ff\n---truncated---(CVE-2023-52587)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()\r\n\r\nFix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug\noccurs when txs-\u0026gt;cnt, data from a URB provided by a USB device, is\nbigger than the size of the array txs-\u0026gt;txstatus, which is\nHTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bug\nhandling code after the check. Make the function return if that is the\ncase.\r\n\r\nFound by a modified version of syzkaller.\r\n\r\nUBSAN: array-index-out-of-bounds in htc_drv_txrx.c\nindex 13 is out of range for type \u0026apos;__wmi_event_txstatus [12]\u0026apos;\nCall Trace:\n ath9k_htc_txstatus\n ath9k_wmi_event_tasklet\n tasklet_action_common\n __do_softirq\n irq_exit_rxu\n sysvec_apic_timer_interrupt(CVE-2023-52594)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: rt2x00: restart beacon queue when hardware reset\r\n\r\nWhen a hardware reset is triggered, all registers are reset, so all\nqueues are forced to stop in hardware interface. However, mac80211\nwill not automatically stop the queue. If we don\u0026apos;t manually stop the\nbeacon queue, the queue will be deadlocked and unable to start again.\nThis patch fixes the issue where Apple devices cannot connect to the\nAP after calling ieee80211_restart_hw().(CVE-2023-52595)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nKVM: s390: fix setting of fpc register\r\n\r\nkvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control\n(fpc) register of a guest cpu. The new value is tested for validity by\ntemporarily loading it into the fpc register.\r\n\r\nThis may lead to corruption of the fpc register of the host process:\nif an interrupt happens while the value is temporarily loaded into the fpc\nregister, and within interrupt context floating point or vector registers\nare used, the current fp/vx registers are saved with save_fpu_regs()\nassuming they belong to user space and will be loaded into fp/vx registers\nwhen returning to user space.\r\n\r\ntest_fp_ctl() restores the original user space / host process fpc register\nvalue, however it will be discarded, when returning to user space.\r\n\r\nIn result the host process will incorrectly continue to run with the value\nthat was supposed to be used for a guest cpu.\r\n\r\nFix this by simply removing the test. There is another test right before\nthe SIE context is entered which will handles invalid values.\r\n\r\nThis results in a change of behaviour: invalid values will now be accepted\ninstead of that the ioctl fails with -EINVAL. This seems to be acceptable,\ngiven that this interface is most likely not used anymore, and this is in\naddition the same behaviour implemented with the memory mapped interface\n(replace invalid values with zero) - see sync_regs() in kvm-s390.c.(CVE-2023-52597)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ns390/ptrace: handle setting of fpc register correctly\r\n\r\nIf the content of the floating point control (fpc) register of a traced\nprocess is modified with the ptrace interface the new value is tested for\nvalidity by temporarily loading it into the fpc register.\r\n\r\nThis may lead to corruption of the fpc register of the tracing process:\nif an interrupt happens while the value is temporarily loaded into the\nfpc register, and within interrupt context floating point or vector\nregisters are used, the current fp/vx registers are saved with\nsave_fpu_regs() assuming they belong to user space and will be loaded into\nfp/vx registers when returning to user space.\r\n\r\ntest_fp_ctl() restores the original user space fpc register value, however\nit will be discarded, when returning to user space.\r\n\r\nIn result the tracer will incorrectly continue to run with the value that\nwas supposed to be used for the traced process.\r\n\r\nFix this by saving fpu register contents with save_fpu_regs() before using\ntest_fp_ctl().(CVE-2023-52598)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\next4: avoid online resizing failures due to oversized flex bg\r\n\r\nWhen we online resize an ext4 filesystem with a oversized flexbg_size,\r\n\r\n     mkfs.ext4 -F -G 67108864 $dev -b 4096 100M\n     mount $dev $dir\n     resize2fs $dev 16G\r\n\r\nthe following WARN_ON is triggered:\n==================================================================\nWARNING: CPU: 0 PID: 427 at mm/page_alloc.c:4402 __alloc_pages+0x411/0x550\nModules linked in: sg(E)\nCPU: 0 PID: 427 Comm: resize2fs Tainted: G  E  6.6.0-rc5+ #314\nRIP: 0010:__alloc_pages+0x411/0x550\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __kmalloc_large_node+0xa2/0x200\n __kmalloc+0x16e/0x290\n ext4_resize_fs+0x481/0xd80\n __ext4_ioctl+0x1616/0x1d90\n ext4_ioctl+0x12/0x20\n __x64_sys_ioctl+0xf0/0x150\n do_syscall_64+0x3b/0x90\n==================================================================\r\n\r\nThis is because flexbg_size is too large and the size of the new_group_data\narray to be allocated exceeds MAX_ORDER. Currently, the minimum value of\nMAX_ORDER is 8, the minimum value of PAGE_SIZE is 4096, the corresponding\nmaximum number of groups that can be allocated is:\r\n\r\n (PAGE_SIZE \u0026lt;\u0026lt; MAX_ORDER) / sizeof(struct ext4_new_group_data) ≈ 21845\r\n\r\nAnd the value that is down-aligned to the power of 2 is 16384. Therefore,\nthis value is defined as MAX_RESIZE_BG, and the number of groups added\neach time does not exceed this value during resizing, and is added multiple\ntimes to complete the online resizing. The difference is that the metadata\nin a flex_bg may be more dispersed.(CVE-2023-52622)","status":"published","published":"2024-04-19T11:06:55Z","modified":"2026-08-18T01:18:25.302720118Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"UBUNTU-CVE-2021-47162","description":"In the Linux kernel, the following vulnerability has been resolved: tipc: skb_linearize the head skb when reassembling msgs It's not a good idea to append the frag skb to a skb's frag_list if the frag_list already has skbs from elsewhere, such as this skb was created by pskb_copy() where the frag_list was cloned (all the skbs in it were skb_get'ed) and shared by multiple skbs. However, the new appended frag skb should have been only seen by the current skb. Otherwise, it will cause use after free crashes as this appended frag skb are seen by multiple skbs but it only got skb_get called once. The same thing happens with a skb updated by pskb_may_pull() with a skb_cloned skb. Li Shuang has reported quite a few crashes caused by this when doing testing over macvlan devices:   [] kernel BUG at net/core/skbuff.c:1970!   [] Call Trace:   []  skb_clone+0x4d/0xb0   []  macvlan_broadcast+0xd8/0x160 [macvlan]   []  macvlan_process_broadcast+0x148/0x150 [macvlan]   []  process_one_work+0x1a7/0x360   []  worker_thread+0x30/0x390   [] kernel BUG at mm/usercopy.c:102!   [] Call Trace:   []  __check_heap_object+0xd3/0x100   []  __check_object_size+0xff/0x16b   []  simple_copy_to_iter+0x1c/0x30   []  __skb_datagram_iter+0x7d/0x310   []  __skb_datagram_iter+0x2a5/0x310   []  skb_copy_datagram_iter+0x3b/0x90   []  tipc_recvmsg+0x14a/0x3a0 [tipc]   []  ____sys_recvmsg+0x91/0x150   []  ___sys_recvmsg+0x7b/0xc0   [] kernel BUG at mm/slub.c:305!   [] Call Trace:   []  \u003cIRQ\u003e   []  kmem_cache_free+0x3ff/0x400   []  __netif_receive_skb_core+0x12c/0xc40   []  ? kmem_cache_alloc+0x12e/0x270   []  netif_receive_skb_internal+0x3d/0xb0   []  ? get_rx_page_info+0x8e/0xa0 [be2net]   []  be_poll+0x6ef/0xd00 [be2net]   []  ? irq_exit+0x4f/0x100   []  net_rx_action+0x149/0x3b0   ... This patch is to fix it by linearizing the head skb if it has frag_list set in tipc_buf_append(). Note that we choose to do this before calling skb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can not just drop the frag_list either as the early time.","status":"published","published":"2024-03-25T10:15:00Z","modified":"2026-11-06T13:49:20.11648148Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-06T14:22:00.307848Z"},{"id":"SUSE-SU-2024:1643-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).\n- CVE-2020-36312: Fixed an issue in virt/kvm/kvm_main.c that had a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure (bsc#1184509).\n- CVE-2021-23134: Fixed a use-after-free issue in nfc sockets (bsc#1186060).\n- CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).\n- CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).\n- CVE-2021-46909: Fixed a PCI interrupt mapping in ARM footbridge (bsc#1220442).\n- CVE-2021-46938: Fixed a double free of blk_mq_tag_set in dev remove after table load fails in dm rq (bsc#1220554).\n- CVE-2021-46939: Fixed a denial of service in trace_clock_global() in tracing (bsc#1220580).\n- CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).\n- CVE-2021-46950: Fixed a data corruption bug in raid1 arrays using bitmaps in md/raid1 (bsc#1220662).\n- CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).\n- CVE-2021-46958: Fixed a race between transaction aborts and fsyncs leading to use-after-free in btrfs (bsc#1220521).\n- CVE-2021-46960: Fixed a warning on smb2_get_enc_key in cifs (bsc#1220528).\n- CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand()  (bsc#1220536).\n- CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).\n- CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).\n- CVE-2021-46981: Fixed a NULL pointer in flush_workqueue in nbd (bsc#1220611).\n- CVE-2021-46988: Fixed release page in error path to avoid BUG_ON (bsc#1220706).\n- CVE-2021-46990: Fixed a denial of service when toggling entry flush barrier in powerpc/64s (bsc#1220743).\n- CVE-2021-46998: Fixed an use after free bug in enic_hard_start_xmit in ethernet/enic (bsc#1220625).\n- CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).\n- CVE-2021-47015: Fixed a RX consumer index logic in the error path in bnxt_rx_pkt() in bnxt_en (bsc#1220794).\n- CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).\n- CVE-2021-47034: Fixed a kernel memory fault for pte update on radix in powerpc/64s (bsc#1220687).\n- CVE-2021-47045: Fixed a null pointer dereference in lpfc_prep_els_iocb() in scsi lpfc (bsc#1220640).\n- CVE-2021-47049: Fixed an after free in __vmbus_open() in hv vmbus (bsc#1220692).\n- CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).\n- CVE-2021-47056: Fixed a user-memory-access error on vf2pf_lock in crypto (bsc#1220769).\n- CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).\n- CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure _after_  sync'ing SRCU (bsc#1220745).\n- CVE-2021-47063: Fixed a potential use-after-free during bridge detach in drm bridge/panel (bsc#1220777).\n- CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).\n- CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).\n- CVE-2021-47071: Fixed a memory leak in error handling paths in hv_uio_cleanup() in uio_hv_generic (bsc#1220846).\n- CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).\n- CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).\n- CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).\n- CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).\n- CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221532).\n- CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221541).\n- CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).\n- CVE-2021-47114: Fixed a data corruption by fallocate in ocfs2 (bsc#1221548).\n- CVE-2021-47117: Fixed a crash in ext4_es_cache_extent as ext4_split_extent_at failed in ext4 (bsc#1221575).\n- CVE-2021-47118: Fixed an use-after-free in init task's struct pid in pid (bsc#1221605).\n- CVE-2021-47119: Fixed a memory leak in ext4_fill_super in ext4 (bsc#1221608).\n- CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).\n- CVE-2021-47138: Fixed an out-of-bound memory access during clearing filters in cxgb4 (bsc#1221934).\n- CVE-2021-47141: Fixed a null pointer dereference on priv-\u003emsix_vectors when driver is unloaded in gve (bsc#1221949).\n- CVE-2021-47142: Fixed an use-after-free on ttm-\u003esg in drm/amdgpu (bsc#1221952).\n- CVE-2021-47143: Fixed possible corruption in net/smc after failed device_add() (bsc#1221988).\n- CVE-2021-47149: Fixed a potential null pointer deref in fmvj18x_get_hwinfo() (bsc#1221972).\n- CVE-2021-47150: Fixed the potential memory leak in fec_enet_init() (bsc#1221973).\n- CVE-2021-47153: Fixed wrongly generated interrupt on bus reset in i2c/i801 (bsc#1221969).\n- CVE-2021-47161: Fixed a resource leak in an error handling path in the error handling path of the probe function in spi spi-fsl-dspi (bsc#1221966).\n- CVE-2021-47162: Fixed a possible memory leak in tipc_buf_append (bsc#1221977).\n- CVE-2021-47165: Fixed shutdown crash when component not probed in drm/meson (bsc#1221965).\n- CVE-2021-47166: Fixed a data corruption of pg_bytes_written in nfs_do_recoalesce() in nfs (bsc#1221998).\n- CVE-2021-47167: Fixed an oopsable condition in __nfs_pageio_add_request() in nfs (bsc#1221991).\n- CVE-2021-47168: Fixed an incorrect limit in filelayout_decode_layout() in nfs (bsc#1222002).\n- CVE-2021-47169: Fixed a NULL pointer dereference in rp2_probe in serial rp2 (bsc#1222000).\n- CVE-2021-47171: Fixed a memory leak in smsc75xx_bind in net usb (bsc#1221994).\n- CVE-2021-47173: Fixed a memory leak in uss720_probe in misc/uss720 (bsc#1221993).\n- CVE-2021-47177: Fixed a sysfs leak in alloc_iommu() in iommu/vt-d (bsc#1221997).\n- CVE-2021-47179: Fixed a NULL pointer dereference in pnfs_mark_matching_lsegs_return() in nfsv4 (bsc#1222001).\n- CVE-2021-47180: Fixed a memory leak in nci_allocate_device nfcmrvl_disconnect in nfc nci (bsc#1221999).\n- CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource() (bsc#1222660).\n- CVE-2021-47182: Fixed scsi_mode_sense() buffer length handling (bsc#1222662).\n- CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145, bsc#1222664).\n- CVE-2021-47184: Fixed NULL pointer dereference on VSI filter sync (bsc#1222666).\n- CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).\n- CVE-2021-47189: Fixed denial of service due to memory ordering issues between normal and ordered work functions in btrfs (bsc#1222706).\n- CVE-2021-47202: Fixed NULL pointer dereferences in of_thermal_ functions in thermal (bsc#1222878)\n- CVE-2021-47205: Unregistered clocks/resets when unbinding in sunxi-ng (bsc#1222888).\n- CVE-2021-47207: Fixed a null pointer dereference on pointer block in gus (bsc#1222790).\n- CVE-2021-47211: Fixed a null pointer dereference on pointer cs_desc in usb-audio (bsc#1222869).\n- CVE-2022-0487: Fixed an use-after-free vulnerability in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).\n- CVE-2022-48619: Fixed a denial-of-service issue in drivers/input/input.c (bsc#1218220).\n- CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).\n- CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb-\u003emac_header (bsc#1223513).\n- CVE-2022-48672: Fixed off-by-one error in unflatten_dt_nodes() (bsc#1223931).\n- CVE-2022-48701: Fixed an out-of-bounds bug in __snd_usb_parse_audio_interface() (bsc#1223921).\n- CVE-2022-48702: Fixed out of bounds access in  snd_emu10k1_pcm_channel_alloc() (bsc#1223923).\n- CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).\n- CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).\n- CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).\n- CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).\n- CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).\n- CVE-2023-52469: Fixed a use-after-free in kv_parse_power_table (bsc#1220411).\n- CVE-2023-52470: Fixed null-ptr-deref in radeon_crtc_init() (bsc#1220413).\n- CVE-2023-52474: Fixed a vulnerability with non-PAGE_SIZE-end multi-iovec user SDMA requests (bsc#1220445).\n- CVE-2023-52476: Fixed possible unhandled page fault via perf sampling NMI during vsyscall (bsc#1220703).\n- CVE-2023-52477: Fixed USB Hub accesses to uninitialized BOS descriptors (bsc#1220790).\n- CVE-2023-52486: Fixed possible use-after-free in drm (bsc#1221277).\n- CVE-2023-52488: Fixed serial/sc16is7xx convert from _raw_ to _noinc_ regmap functions for FIFO (bsc#1221162).\n- CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).\n- CVE-2023-52515: Fixed possible use-after-free in RDMA/srp (bsc#1221048).\n- CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).\n- CVE-2023-52528: Fixed uninit-value access in __smsc75xx_read_reg() (bsc#1220843).\n- CVE-2023-52575: Fixed SBPB enablement for spec_rstack_overflow=off (bsc#1220871).\n- CVE-2023-52583: Fixed deadlock or deadcode of misusing dget() inside ceph (bsc#1221058).\n- CVE-2023-52587: Fixed mcast list locking in IB/ipoib (bsc#1221082).\n- CVE-2023-52590: Fixed a possible ocfs2 filesystem corruption via directory renaming (bsc#1221088).\n- CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).\n- CVE-2023-52595: Fixed possible deadlock in wifi/rt2x00 (bsc#1221046).\n- CVE-2023-52598: Fixed wrong setting of fpc register in s390/ptrace (bsc#1221060).\n- CVE-2023-52607: Fixed a null-pointer-dereference in pgtable_cache_add kasprintf() (bsc#1221061).\n- CVE-2023-52614: Fixed PM/devfreq buffer overflow in trans_stat_show (bsc#1221617).\n- CVE-2023-52620: Fixed netfilter/nf_tables to disallow timeout for anonymous sets never used from userspace (bsc#1221825).\n- CVE-2023-52628: Fixed 4-byte stack OOB write in nftables (bsc#1222117).\n- CVE-2023-52635: Fixed PM/devfreq to synchronize devfreq_monitor_[start/stop] (bsc#1222294).\n- CVE-2023-52639: Fixed race during shadow creation in KVM/s390/vsie Fixed (bsc#1222300).\n- CVE-2023-52644: Stop/wake correct queue in DMA Tx path when QoS is disabled in b43 (bsc#1222961).\n- CVE-2023-52650: Added missing check for of_find_device_by_node() (bsc#1223770)\n- CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).\n- CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).\n- CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).\n- CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).\n- CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).\n- CVE-2023-7042: Fixed a null-pointer-dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (bsc#1218336).\n- CVE-2023-7192: Fixed a memory leak problem in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c (bsc#1218479).\n- CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).\n- CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).\n- CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).\n- CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).\n- CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).\n- CVE-2024-24855: Fixed race condition in lpfc_unregister_fcf_rescan() that could lead to a kernel panic or denial of service issue (bsc#1219618).\n- CVE-2024-24861: Fixed race condition in xc4000_get_frequency() that could lead to malfunction or denial of service issue (bsc#1219623).\n- CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).\n- CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).\n- CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).\n- CVE-2024-26675: Fixed ppp_async to limit MRU to 64K (bsc#1222379).\n- CVE-2024-26689: Fixed a use-after-free in encode_cap_msg() (bsc#1222503).\n- CVE-2024-26704: fixed double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).\n- CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).\n- CVE-2024-26743: Fixed memory leak in qedr_create_user_qp error flow in rdma/qedr (bsc#1222677)\n- CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449)\n- CVE-2024-26747: Fixed a NULL pointer issue with USB parent module's reference (bsc#1222609).\n- CVE-2024-26754: Fixed ab use-after-free and null-ptr-deref in gtp_genl_dump_pdp() in gtp (bsc#1222632).\n- CVE-2024-26763: Fixed user corruption via by writing data with O_DIRECT on device in dm-crypt (bsc#1222720).\n- CVE-2024-26771: Fixed a null pointer dereference on edma_probe in dmaengine ti edma (bsc#1222610)\n- CVE-2024-26772: Fixed ext4 to avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (bsc#1222613).\n- CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found() (bsc#1222618).\n- CVE-2024-26777: Error out if pixclock equals zero in fbdev/sis (bsc#1222765)\n- CVE-2024-26778: Error out if pixclock equals zero in fbdev/savage (bsc#1222770)\n- CVE-2024-26779: Fixed a race condition on enabling fast-xmit in mac80211 (bsc#1222772).\n- CVE-2024-26791: Properly validated device names in btrfs dev-replace (bsc#1222793)\n- CVE-2024-26793: fixed use-after-free and null-ptr-deref in gtp_newlink() (bsc#1222428).\n- CVE-2024-26805: Fixed a kernel-infoleak-after-free in __skb_datagram_iter in netlink (bsc#1222630).\n- CVE-2024-26816: Fixed relocations in .notes section when building with CONFIG_XEN_PV=y by ignoring them (bsc#1222624).\n- CVE-2024-26817: Fixed amdkfd to use calloc instead of kzalloc to avoid integer overflow (bsc#1222812).\n- CVE-2024-26839: Fixed a memory leak in init_credit_return() (bsc#1222975)\n- CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).\n- CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify() (bsc#1223057).\n- CVE-2024-26855: Fixed net/ice potential NULL pointer dereference in ice_bridge_setlink() (bsc#1223051).\n- CVE-2024-26857: Fixed geneve to make sure to pull inner header in geneve_rx() (bsc#1223058).\n- CVE-2024-26859: Prevent access to a freed page in page_pool in bnx2x (bsc#1223049).\n- CVE-2024-26876: Fixed crash on irq during probe, related to adv7511_probe() (bsc#1223119).\n- CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).\n- CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).\n- CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).\n- CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).\n- CVE-2024-26907: Fixed a fortify source warning while accessing Eth segment in mlx5 (bsc#1223203).\n- CVE-2024-26922: Validated the parameters of bo mapping operations more clearly (bsc#1223315).\n- CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).\n- CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).\n- CVE-2024-27008: Fixed out of bounds access in nv04 (CVE-2024-27008 bsc#1223802).\n- CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).\n- CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).\n- CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).\n- CVE-2024-27046: Fixed nfp/flower handling acti_netdevs allocation failure (bsc#1223827).\n- CVE-2024-27072: Removed useless locks in usbtv_video_free() (bsc#1223837).\n- CVE-2024-27073: Fixed a memory leak in budget_av_attach() (bsc#1223843).\n- CVE-2024-27074: Fixed a memory leak in go7007_load_encoder() (bsc#1223844).\n- CVE-2024-27075: Avoided stack overflow warnings with clang (bsc#1223842).\n- CVE-2024-27078: Fixed a memory leak in tpg_alloc() (bsc#1223781).\n\nThe following non-security bugs were fixed:\n\n- Input: adxl34x - do not hardcode interrupt trigger type (git-fixes).\n- Input: drv260x - sleep between polling GO bit (git-fixes).\n- Input: ipaq-micro-keys - add error handling for devm_kmemdup.\n- Input: xpad - add PXN V900 support.\n- USB: core: Fix deadlock in usb_deauthorize_interface().\n- USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (git-fixes).\n- atl1c: fix error return code in atl1c_probe() (git-fixes).\n- atl1e: fix error return code in atl1e_probe() (git-fixes).\n- bluetooth: btqca: Fixed a coding style error (git-fixes).\n- bluetooth: btqca: Introduce HCI_EV_VENDOR and use it (git-fixes).\n- bluetooth: btqcomsmd: Fix command timeout after setting BD address (git-fixes).\n- bluetooth: hci_intel: Add check for platform_driver_register (git-fixes).\n- bnx2x: Fix enabling network interfaces without VFs (git-fixes).\n- bnx2x: Fix missing error code in bnx2x_iov_init_one() (git-fixes).\n- bpf, sockmap: Fix preempt_rt splat when using raw_spin_lock_t (git-fixes).\n- drivers: usb: host: Fix deadlock in oxu_bus_suspend() (git-fixes).\n- ethernet: myri10ge: Fix missing error code in myri10ge_probe() (git-fixes).\n- ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram (git-fixes).\n- fuse: do not unhash root (bsc#1223954).\n- iommu/amd: Increase interrupt remapping table limit to 512 entries (git-fixes).\n- iommu/amd: Mark interrupt as managed (git-fixes).\n- iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs (git-fixes).\n- iommu/amd: Silence warnings under memory pressure (git-fixes).\n- iommu: Check if group is NULL before remove device (git-fixes).\n- kabi fix for pNFS: Fix the pnfs block driver's calculation of layoutget size (git-fixes).\n- kabi: PCI: Add locking to RMW PCI Express Capability Register accessors (kabi).\n- lan78xx: Add missing return code checks (git-fixes).\n- lan78xx: Add support to dump lan78xx registers (git-fixes).\n- lan78xx: Do not access skb_queue_head list pointers directly (git-fixes).\n- lan78xx: Fix exception on link speed change (git-fixes).\n- lan78xx: Fix partial packet errors on suspend/resume (git-fixes).\n- lan78xx: Fix race conditions in suspend/resume handling (git-fixes).\n- lan78xx: Fix white space and style issues (git-fixes).\n- lan78xx: Modify error messages (git-fixes).\n- lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected (git-fixes).\n- livepatch: Fix missing newline character in klp_resolve_symbols() (bsc#1223539).\n- net/mlx5: Properly convey driver version to firmware (git-fixes).\n- net/qla3xxx: fix schedule while atomic in ql_sem_spinlock (git-fixes).\n- net/tls: Remove the context from the list in tls_device_down (bsc#1221545).\n- net: Fix features skip in for_each_netdev_feature() (git-fixes).\n- net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function (git-fixes).\n- net: atheros: switch from 'pci_' to 'dma_' API (git-fixes).\n- net: lan78xx: Allow for VLAN headers in timeout calcs (git-fixes).\n- net: lan78xx: Make declaration style consistent (git-fixes).\n- net: lan78xx: Merge memcpy + lexx_to_cpus to get_unaligned_lexx (git-fixes).\n- net: lan78xx: fix runtime PM count underflow on link stop (git-fixes).\n- net: lan78xx: remove set but not used variable 'event' (git-fixes).\n- net: macb: ensure the device is available before accessing GEMGXL control registers (git-fixes).\n- net: stmmac: free tx skb buffer in stmmac_resume() (git-fixes).\n- net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() (git-fixes).\n- net: usb: lan78xx: Remove lots of set but unused 'ret' variables (git-fixes).\n- net:usb: Use ARRAY_SIZE instead of calculating the array size (git-fixes).\n- nfs: add atomic_open for NFSv3 to handle O_TRUNC correctly (bsc#1219847).\n- nfs: avoid spurious warning of lost lock that is being unlocked (bsc#1221791).\n- nfs: commit errors should be fatal (git-fixes).\n- nfs: fix O_DIRECT commit verifier handling (git-fixes).\n- nfs: fix O_DIRECT locking issues (git-fixes).\n- nfs: fix a request reference leak in nfs_direct_write_clear_reqs() (git-fixes).\n- nfs: fix an off by one in root_nfs_cat() (git-fixes).\n- nfs: fix direct WRITE throughput regression (git-fixes).\n- nfs: fix error handling for O_DIRECT write scheduling (git-fixes).\n- nfs: more O_DIRECT accounting fixes for error paths (git-fixes).\n- nfs: only issue commit in DIO codepath if we have uncommitted data (git-fixes).\n- nfsd: Fix error cleanup path in nfsd_rename() (git-fixes).\n- nfsd: Reset cb_seq_status after NFS4ERR_DELAY (git-fixes).\n- nfsd: Retransmit callbacks after client reconnects (git-fixes).\n- nfsd: lock_rename() needs both directories to live on the same fs (git-fixes).\n- nfsv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT (git-fixes).\n- pNFS/flexfiles: Check the layout validity in ff_layout_mirror_prepare_stats (git-fixes).\n- pNFS: Fix the pnfs block driver's calculation of layoutget size (git-fixes).\n- pci/aer: Clear MULTI_ERR_COR/UNCOR_RCV bits (git-fixes).\n- pci/aspm: Avoid link retraining race (git-fixes).\n- pci/aspm: Disable ASPM on MFD function removal to avoid use-after-free (git-fixes).\n- pci/aspm: Do not warn if already in common clock mode (git-fixes).\n- pci/aspm: Factor out pcie_wait_for_retrain() (git-fixes).\n- pci/aspm: Reduce severity of common clock config message (git-fixes).\n- pci/aspm: Return 0 or -ETIMEDOUT from pcie_retrain_link() (git-fixes).\n- pci/aspm: Use RMW accessors for changing LNKCTL (git-fixes).\n- pci/dpc: Print all TLP Prefixes, not just the first (git-fixes).\n- pci/iov: Enlarge virtfn sysfs name buffer (git-fixes).\n- pci/msi: Prevent MSI hardware interrupt number truncation (git-fixes).\n- pci/pm: Power up all devices during runtime resume (git-fixes).\n- pci/sysfs: Protect driver's D3cold preference from user space (git-fixes).\n- pci: Add ACS quirk for Broadcom BCM5750x NICs (git-fixes).\n- pci: Add function 1 DMA alias quirk for Marvell 88SE9235 (git-fixes).\n- pci: Add locking to RMW PCI Express Capability Register accessors (git-fixes).\n- pci: Avoid FLR for AMD FCH AHCI adapters (git-fixes).\n- pci: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() (git-fixes).\n- pci: Make link retraining use RMW accessors for changing LNKCTL (git-fixes).\n- pci: Mark 3ware-9650SE Root Port Extended Tags as broken (git-fixes).\n- pci: Rework pcie_retrain_link() wait loop (git-fixes).\n- pci: aardvark: Fix setting MSI address (git-fixes).\n- pci: aardvark: Fix support for MSI interrupts (git-fixes).\n- pci: dwc: Add unroll iATU space support to dw_pcie_disable_atu() (git-fixes).\n- pci: endpoint: Do not stop controller when unbinding endpoint function (git-fixes).\n- pci: hotplug: Allow marking devices as disconnected during bind/unbind (git-fixes).\n- pci: pciehp: Add pciehp_set_indicators() to set both indicators (git-fixes).\n- pci: pciehp: Cancel bringup sequence if card is not present (git-fixes).\n- pci: pciehp: Fix AB-BA deadlock between reset_lock and device_lock (git-fixes).\n- pci: pciehp: Use RMW accessors for changing LNKCTL (git-fixes).\n- pci: qcom: Disable write access to read only registers for IP v2.3.3 (git-fixes).\n- pci: qcom: Fix unbalanced PHY init on probe errors (git-fixes).\n- pci: qcom: Use DWC helpers for modifying the read-only DBI registers (git-fixes).\n- pci: switchtec: Return -EFAULT for copy_to_user() errors (git-fixes).\n- printk: Disable passing console lock owner completely during panic() (bsc#1197894).\n- printk: Update @console_may_schedule in console_trylock_spinning() (bsc#1223969).\n- rdma/ipoib: Fix error code return in ipoib_mcast_join (bsc#1221082)\n- s390/mm: Fix clearing storage keys for huge pages (git-fixes bsc#1223883).\n- s390/mm: Fix storage key clearing for guest huge pages (git-fixes bsc#1223885).\n- s390/vtime: fix average steal time calculation (git-fixes bsc#1221953).\n- scsi: qla2xxx: Change debug message during driver unload (bsc1221816).\n- scsi: qla2xxx: Delay I/O Abort on PCI error (bsc1221816).\n- scsi: qla2xxx: Fix N2N stuck connection (bsc1221816).\n- scsi: qla2xxx: Fix command flush on cable pull (bsc1221816).\n- scsi: qla2xxx: Fix double free of fcport (bsc1221816).\n- scsi: qla2xxx: Fix double free of the ha-\u003evp_map pointer (bsc1221816).\n- scsi: qla2xxx: NVME|FCP prefer flag not being honored (bsc1221816).\n- scsi: qla2xxx: Prevent command send on chip reset (bsc1221816).\n- scsi: qla2xxx: Split FCE|EFT trace control (bsc1221816).\n- scsi: qla2xxx: Update manufacturer detail (bsc1221816).\n- scsi: qla2xxx: Update version to 10.02.09.200-k (bsc1221816).\n- sr9800: Add check for usbnet_get_endpoints (git-fixes).\n- sunrpc: Fix RPC client cleaned up the freed pipefs dentries (git-fixes).\n- sunrpc: fix a memleak in gss_import_v2_context (git-fixes).\n- sunrpc: fix some memleaks in gssx_dec_option_array (git-fixes).\n- tls: Fix context leak on tls_device_down (bsc#1221545).\n- tty/sysrq: replace smp_processor_id() with get_cpu() (bsc#1223540).\n- tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (bsc#1222619).\n- tun: honor IOCB_NOWAIT flag (git-fixes).\n- usb: dwc2: Fix memory leak in dwc2_hcd_init.\n- usb: dwc2: check return value after calling platform_get_resource() (git-fixes).\n- usb: dwc3: gadget: Ignore EP queue requests during bus reset (git-fixes).\n- usb: gadget: Fix issue with config_ep_by_speed function (git-fixes).\n- usb: mon: Fix atomicity violation in mon_bin_vma_fault (git-fixes).\n- usb: musb: Modify the 'HWVers' register address (git-fixes).\n- usb: roles: do not get/set_role() when usb_role_switch is unregistered.\n- usb: serial: option: add Fibocom L7xx modules (git-fixes).\n- usb: serial: option: do not claim interface 4 for ZTE MF290 (git-fixes).\n- usb: storage: set 1.50 as the lower bcdDevice for older 'Super Top' compatibility (git-fixes).\n- usb: typec: class: fix typec_altmode_put_partner to put plugs (git-fixes).\n- usb: usbfs: Do not WARN about excessively large memory allocations.\n- x86/CPU/AMD: Update the Zenbleed microcode revisions (git-fixes).\n- x86/bugs: Fix the SRSO mitigation on Zen3/4 (git-fixes).\n","status":"published","published":"2024-05-14T13:38:57Z","modified":"2026-02-04T02:48:22.100089Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1646-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).\n- CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).\n- CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).\n- CVE-2021-46909: Fixed a PCI interrupt mapping in ARM footbridge (bsc#1220442).\n- CVE-2021-46938: Fixed a double free of blk_mq_tag_set in dev remove after table load fails in dm rq (bsc#1220554).\n- CVE-2021-46939: Fixed a denial of service in trace_clock_global() in tracing (bsc#1220580).\n- CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).\n- CVE-2021-46950: Fixed a data corruption bug in raid1 arrays using bitmaps in md/raid1 (bsc#1220662).\n- CVE-2021-46958: Fixed a race between transaction aborts and fsyncs leading to use-after-free in btrfs (bsc#1220521).\n- CVE-2021-46960: Fixed a warning on smb2_get_enc_key in cifs (bsc#1220528).\n- CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand()  (bsc#1220536).\n- CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).\n- CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).\n- CVE-2021-46981: Fixed a NULL pointer in flush_workqueue in nbd (bsc#1220611).\n- CVE-2021-46988: Fixed release page in error path to avoid BUG_ON (bsc#1220706).\n- CVE-2021-46990: Fixed a denial of service when toggling entry flush barrier in powerpc/64s (bsc#1220743).\n- CVE-2021-46998: Fixed an use after free bug in enic_hard_start_xmit in ethernet/enic (bsc#1220625).\n- CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).\n- CVE-2021-47015: Fixed a RX consumer index logic in the error path in bnxt_rx_pkt() in bnxt_en (bsc#1220794).\n- CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).\n- CVE-2021-47034: Fixed a kernel memory fault for pte update on radix in powerpc/64s (bsc#1220687).\n- CVE-2021-47045: Fixed a null pointer dereference in lpfc_prep_els_iocb() in scsi lpfc (bsc#1220640).\n- CVE-2021-47049: Fixed an after free in __vmbus_open() in hv vmbus (bsc#1220692).\n- CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).\n- CVE-2021-47056: Fixed a user-memory-access error on vf2pf_lock in crypto (bsc#1220769).\n- CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).\n- CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure _after_  sync'ing SRCU (bsc#1220745).\n- CVE-2021-47063: Fixed a potential use-after-free during bridge detach in drm bridge/panel (bsc#1220777).\n- CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).\n- CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).\n- CVE-2021-47071: Fixed a memory leak in error handling paths in hv_uio_cleanup() in uio_hv_generic (bsc#1220846).\n- CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).\n- CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).\n- CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).\n- CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).\n- CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221532).\n- CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221541).\n- CVE-2021-47114: Fixed a data corruption by fallocate in ocfs2 (bsc#1221548).\n- CVE-2021-47117: Fixed a crash in ext4_es_cache_extent as ext4_split_extent_at failed in ext4 (bsc#1221575).\n- CVE-2021-47118: Fixed an use-after-free in init task's struct pid in pid (bsc#1221605).\n- CVE-2021-47119: Fixed a memory leak in ext4_fill_super in ext4 (bsc#1221608).\n- CVE-2021-47138: Fixed an out-of-bound memory access during clearing filters in cxgb4 (bsc#1221934).\n- CVE-2021-47141: Fixed a null pointer dereference on priv-\u003emsix_vectors when driver is unloaded in gve (bsc#1221949).\n- CVE-2021-47142: Fixed an use-after-free on ttm-\u003esg in drm/amdgpu (bsc#1221952).\n- CVE-2021-47143: Fixed possible corruption in net/smc after failed device_add() (bsc#1221988).\n- CVE-2021-47149: Fixed a potential null pointer deref in fmvj18x_get_hwinfo() (bsc#1221972).\n- CVE-2021-47150: Fixed the potential memory leak in fec_enet_init() (bsc#1221973).\n- CVE-2021-47153: Fixed wrongly generated interrupt on bus reset in i2c/i801 (bsc#1221969).\n- CVE-2021-47161: Fixed a resource leak in an error handling path in the error handling path of the probe function in spi spi-fsl-dspi (bsc#1221966).\n- CVE-2021-47162: Fixed a possible memory leak in tipc_buf_append (bsc#1221977).\n- CVE-2021-47165: Fixed shutdown crash when component not probed in drm/meson (bsc#1221965).\n- CVE-2021-47166: Fixed a data corruption of pg_bytes_written in nfs_do_recoalesce() in nfs (bsc#1221998).\n- CVE-2021-47167: Fixed an oopsable condition in __nfs_pageio_add_request() in nfs (bsc#1221991).\n- CVE-2021-47168: Fixed an incorrect limit in filelayout_decode_layout() in nfs (bsc#1222002).\n- CVE-2021-47169: Fixed a NULL pointer dereference in rp2_probe in serial rp2 (bsc#1222000).\n- CVE-2021-47171: Fixed a memory leak in smsc75xx_bind in net usb (bsc#1221994).\n- CVE-2021-47173: Fixed a memory leak in uss720_probe in misc/uss720 (bsc#1221993).\n- CVE-2021-47177: Fixed a sysfs leak in alloc_iommu() in iommu/vt-d (bsc#1221997).\n- CVE-2021-47179: Fixed a NULL pointer dereference in pnfs_mark_matching_lsegs_return() in nfsv4 (bsc#1222001).\n- CVE-2021-47180: Fixed a memory leak in nci_allocate_device nfcmrvl_disconnect in nfc nci (bsc#1221999).\n- CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource()  (bsc#1222660).\n- CVE-2021-47182: Fixed scsi_mode_sense() buffer length handling (bsc#1222662).\n- CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145, bsc#1222664).\n- CVE-2021-47184: Fixed NULL pointer dereference on VSI filter sync (bsc#1222666).\n- CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).\n- CVE-2021-47189: Fixed denial of service due to memory ordering issues between normal and ordered work functions in btrfs (bsc#1222706).\n- CVE-2021-47202: Fixed NULL pointer dereferences in of_thermal_ functions in thermal (bsc#1222878)\n- CVE-2021-47205: Unregistered clocks/resets when unbinding in sunxi-ng (bsc#1222888).\n- CVE-2021-47207: Fixed a null pointer dereference on pointer block in gus (bsc#1222790).\n- CVE-2021-47211: Fixed a null pointer dereference on pointer cs_desc in usb-audio (bsc#1222869).\n- CVE-2022-0487: Fixed use-after-free in moxart_remove in moxart-mmc (bsc#1194516).\n- CVE-2022-48619: Fixed a denial-of-service issue in drivers/input/input.c (bsc#1218220).\n- CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).\n- CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb-\u003emac_header (bsc#1223513).\n- CVE-2022-48701: Fixed an out-of-bounds bug in __snd_usb_parse_audio_interface() (bsc#1223921).\n- CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).\n- CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).\n- CVE-2023-52469: Fixed a use-after-free in kv_parse_power_table (bsc#1220411).\n- CVE-2023-52470: Fixed null-ptr-deref in radeon_crtc_init() (bsc#1220413).\n- CVE-2023-52474: Fixed a vulnerability with non-PAGE_SIZE-end multi-iovec user SDMA requests (bsc#1220445).\n- CVE-2023-52476: Fixed possible unhandled page fault via perf sampling NMI during vsyscall (bsc#1220703).\n- CVE-2023-52477: Fixed USB Hub accesses to uninitialized BOS descriptors (bsc#1220790).\n- CVE-2023-52486: Fixed possible use-after-free in drm (bsc#1221277).\n- CVE-2023-52488: Fixed serial/sc16is7xx convert from _raw_ to _noinc_ regmap functions for FIFO (bsc#1221162).\n- CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).\n- CVE-2023-52515: Fixed possible use-after-free in RDMA/srp (bsc#1221048).\n- CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).\n- CVE-2023-52528: Fixed uninit-value access in __smsc75xx_read_reg() (bsc#1220843).\n- CVE-2023-52575: Fixed SBPB enablement for spec_rstack_overflow=off (bsc#1220871).\n- CVE-2023-52583: Fixed deadlock or deadcode of misusing dget() inside ceph (bsc#1221058).\n- CVE-2023-52587: Fixed mcast list locking in IB/ipoib (bsc#1221082).\n- CVE-2023-52590: Fixed a possible ocfs2 filesystem corruption via directory renaming (bsc#1221088).\n- CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).\n- CVE-2023-52595: Fixed possible deadlock in wifi/rt2x00 (bsc#1221046).\n- CVE-2023-52598: Fixed wrong setting of fpc register in s390/ptrace (bsc#1221060).\n- CVE-2023-52607: Fixed a null-pointer-dereference in pgtable_cache_add kasprintf() (bsc#1221061).\n- CVE-2023-52614: Fixed PM/devfreq buffer overflow in trans_stat_show (bsc#1221617).\n- CVE-2023-52620: Fixed netfilter/nf_tables to disallow timeout for anonymous sets never used from userspace (bsc#1221825).\n- CVE-2023-52628: Fixed 4-byte stack OOB write in nftables (bsc#1222117).\n- CVE-2023-52635: Fixed PM/devfreq to synchronize devfreq_monitor_[start/stop] (bsc#1222294).\n- CVE-2023-52639: Fixed race during shadow creation in KVM/s390/vsie Fixed (bsc#1222300).\n- CVE-2023-52644: Stop/wake correct queue in DMA Tx path when QoS is disabled in b43 (bsc#1222961).\n- CVE-2023-52650: Added missing check for of_find_device_by_node() (bsc#1223770)\n- CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).\n- CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).\n- CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).\n- CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).\n- CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).\n- CVE-2023-7042: Fixed a null-pointer-dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (bsc#1218336).\n- CVE-2023-7192: Fixed a memory leak problem in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c (bsc#1218479).\n- CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).\n- CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).\n- CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).\n- CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).\n- CVE-2024-24855: Fixed a null pointer dereference due to race condition in scsi device driver in lpfc_unregister_fcf_rescan() function (bsc#1219618).\n- CVE-2024-24861: Fixed an overflow due to race condition in media/xc4000 device driver in xc4000 xc4000_get_frequency() function (bsc#1219623).\n- CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).\n- CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).\n- CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).\n- CVE-2024-26675: Fixed ppp_async to limit MRU to 64K (bsc#1222379).\n- CVE-2024-26689: Fixed a use-after-free in encode_cap_msg() (bsc#1222503).\n- CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).\n- CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).\n- CVE-2024-26743: Fixed memory leak in qedr_create_user_qp error flow in rdma/qedr (bsc#1222677)\n- CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449)\n- CVE-2024-26747: Fixed a NULL pointer issue with USB parent module's reference (bsc#1222609).\n- CVE-2024-26754: Fixed an use-after-free and null-ptr-deref in gtp_genl_dump_pdp() in gtp  (bsc#1222632).\n- CVE-2024-26763: Fixed user corruption via by writing data with O_DIRECT on device in dm-crypt (bsc#1222720).\n- CVE-2024-26771: Fixed a null pointer dereference on edma_probe in dmaengine ti edma  (bsc#1222610)\n- CVE-2024-26772: Fixed ext4 to avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (bsc#1222613).\n- CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found() (bsc#1222618).\n- CVE-2024-26777: Error out if pixclock equals zero in fbdev/sis (bsc#1222765)\n- CVE-2024-26778: Error out if pixclock equals zero in fbdev/savage (bsc#1222770)\n- CVE-2024-26779: Fixed a race condition on enabling fast-xmit in mac80211 (bsc#1222772).\n- CVE-2024-26793: Fixed an use-after-free and null-ptr-deref in gtp_newlink() in gtp  (bsc#1222428).\n- CVE-2024-26805: Fixed a kernel-infoleak-after-free in __skb_datagram_iter in netlink  (bsc#1222630).\n- CVE-2024-26816: Fixed relocations in .notes section when building with CONFIG_XEN_PV=y by ignoring them (bsc#1222624).\n- CVE-2024-26817: Fixed amdkfd to use calloc instead of kzalloc to avoid integer overflow (bsc#1222812).\n- CVE-2024-26839: Fixed a memleak in init_credit_return() (bsc#1222975)\n- CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).\n- CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify() (bsc#1223057).\n- CVE-2024-26855: Fixed net/ice potential NULL pointer dereference in ice_bridge_setlink() (bsc#1223051).\n- CVE-2024-26857: Fixed geneve to make sure to pull inner header in geneve_rx() (bsc#1223058).\n- CVE-2024-26859: Prevent access to a freed page in page_pool in bnx2x (bsc#1223049).\n- CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).\n- CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).\n- CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).\n- CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).\n- CVE-2024-26907: Fixed a fortify source warning while accessing Eth segment in mlx5 (bsc#1223203).\n- CVE-2024-26922: Validated the parameters of bo mapping operations more clearly (bsc#1223315).\n- CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).\n- CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).\n- CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).\n- CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).\n- CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).\n- CVE-2024-27046: Fixed nfp/flower handling acti_netdevs allocation failure (bsc#1223827).\n- CVE-2024-27072: Removed useless locks in usbtv_video_free() (bsc#1223837).\n- CVE-2024-27073: Fixed a memory leak in budget_av_attach() (bsc#1223843).\n- CVE-2024-27074: Fixed a memory leak in go7007_load_encoder() (bsc#1223844).\n- CVE-2024-27075: Avoided stack overflow warnings with clang (bsc#1223842).\n- CVE-2024-27078: Fixed a memory leak in tpg_alloc() (bsc#1223781).\n\nThe following non-security bugs were fixed:\n\n- Input: adxl34x - do not hardcode interrupt trigger type (git-fixes).\n- Input: drv260x - sleep between polling GO bit (git-fixes).\n- Input: ipaq-micro-keys - add error handling for devm_kmemdup.\n- Input: xpad - add PXN V900 support.\n- USB: core: Fix deadlock in usb_deauthorize_interface().\n- USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (git-fixes).\n- atl1c: fix error return code in atl1c_probe() (git-fixes).\n- atl1e: fix error return code in atl1e_probe() (git-fixes).\n- bluetooth: btqca: Fixed a coding style error (git-fixes).\n- bluetooth: btqca: Introduce HCI_EV_VENDOR and use it (git-fixes).\n- bluetooth: btqcomsmd: Fix command timeout after setting BD address (git-fixes).\n- bluetooth: hci_intel: Add check for platform_driver_register (git-fixes).\n- bnx2x: Fix enabling network interfaces without VFs (git-fixes).\n- bnx2x: Fix missing error code in bnx2x_iov_init_one() (git-fixes).\n- bpf, sockmap: Fix preempt_rt splat when using raw_spin_lock_t (git-fixes).\n- doc/README.SUSE: Update information about module support status (jsc#PED-5759)\n- drivers: usb: host: Fix deadlock in oxu_bus_suspend() (git-fixes).\n- ethernet: myri10ge: Fix missing error code in myri10ge_probe() (git-fixes).\n- ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram (git-fixes).\n- fuse: do not unhash root (bsc#1223954).\n- iommu/amd: Increase interrupt remapping table limit to 512 entries (git-fixes).\n- iommu/amd: Mark interrupt as managed (git-fixes).\n- iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs (git-fixes).\n- iommu/amd: Silence warnings under memory pressure (git-fixes).\n- iommu: Check if group is NULL before remove device (git-fixes).\n- kabi fix for pNFS: Fix the pnfs block driver's calculation of layoutget size (git-fixes).\n- kabi: PCI: Add locking to RMW PCI Express Capability Register accessors (kabi).\n- lan78xx: Add missing return code checks (git-fixes).\n- lan78xx: Add support to dump lan78xx registers (git-fixes).\n- lan78xx: Do not access skb_queue_head list pointers directly (git-fixes).\n- lan78xx: Fix exception on link speed change (git-fixes).\n- lan78xx: Fix partial packet errors on suspend/resume (git-fixes).\n- lan78xx: Fix race conditions in suspend/resume handling (git-fixes).\n- lan78xx: Fix white space and style issues (git-fixes).\n- lan78xx: Modify error messages (git-fixes).\n- lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected (git-fixes).\n- net/mlx5: Properly convey driver version to firmware (git-fixes).\n- net/qla3xxx: fix schedule while atomic in ql_sem_spinlock (git-fixes).\n- net: Fix features skip in for_each_netdev_feature() (git-fixes).\n- net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function (git-fixes).\n- net: atheros: switch from 'pci_' to 'dma_' API (git-fixes).\n- net: lan78xx: Allow for VLAN headers in timeout calcs (git-fixes).\n- net: lan78xx: Make declaration style consistent (git-fixes).\n- net: lan78xx: Merge memcpy + lexx_to_cpus to get_unaligned_lexx (git-fixes).\n- net: lan78xx: fix runtime PM count underflow on link stop (git-fixes).\n- net: lan78xx: remove set but not used variable 'event' (git-fixes).\n- net: macb: ensure the device is available before accessing GEMGXL control registers (git-fixes).\n- net: stmmac: free tx skb buffer in stmmac_resume() (git-fixes).\n- net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() (git-fixes).\n- net: usb: Use ARRAY_SIZE instead of calculating the array size (git-fixes).\n- net: usb: lan78xx: Remove lots of set but unused 'ret' variables (git-fixes).\n- nfs: Fix O_DIRECT commit verifier handling (git-fixes).\n- nfs: Fix O_DIRECT locking issues (git-fixes).\n- nfs: Fix a request reference leak in nfs_direct_write_clear_reqs() (git-fixes).\n- nfs: Fix an off by one in root_nfs_cat() (git-fixes).\n- nfs: Fix direct WRITE throughput regression (git-fixes).\n- nfs: Fix error handling for O_DIRECT write scheduling (git-fixes).\n- nfs: More O_DIRECT accounting fixes for error paths (git-fixes).\n- nfs: add atomic_open for NFSv3 to handle O_TRUNC correctly (bsc#1219847).\n- nfs: avoid spurious warning of lost lock that is being unlocked (bsc#1221791).\n- nfs: commit errors should be fatal (git-fixes).\n- nfs: only issue commit in DIO codepath if we have uncommitted data (git-fixes).\n- nfsd: Fix error cleanup path in nfsd_rename() (git-fixes).\n- nfsd: Reset cb_seq_status after NFS4ERR_DELAY (git-fixes).\n- nfsd: Retransmit callbacks after client reconnects (git-fixes).\n- nfsd: lock_rename() needs both directories to live on the same fs (git-fixes).\n- nfsv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT (git-fixes).\n- pci/aer: Clear MULTI_ERR_COR/UNCOR_RCV bits (git-fixes).\n- pci/aspm: Avoid link retraining race (git-fixes).\n- pci/aspm: Disable ASPM on MFD function removal to avoid use-after-free (git-fixes).\n- pci/aspm: Do not warn if already in common clock mode (git-fixes).\n- pci/aspm: Factor out pcie_wait_for_retrain() (git-fixes).\n- pci/aspm: Reduce severity of common clock config message (git-fixes).\n- pci/aspm: Return 0 or -ETIMEDOUT from pcie_retrain_link() (git-fixes).\n- pci/aspm: Use RMW accessors for changing LNKCTL (git-fixes).\n- pci/dpc: Print all TLP Prefixes, not just the first (git-fixes).\n- pci/iov: Enlarge virtfn sysfs name buffer (git-fixes).\n- pci/msi: Prevent MSI hardware interrupt number truncation (git-fixes).\n- pci/pm: Power up all devices during runtime resume (git-fixes).\n- pci/sysfs: Protect driver's D3cold preference from user space (git-fixes).\n- pci: Add ACS quirk for Broadcom BCM5750x NICs (git-fixes).\n- pci: Add function 1 DMA alias quirk for Marvell 88SE9235 (git-fixes).\n- pci: Add locking to RMW PCI Express Capability Register accessors (git-fixes).\n- pci: Avoid FLR for AMD FCH AHCI adapters (git-fixes).\n- pci: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() (git-fixes).\n- pci: Make link retraining use RMW accessors for changing LNKCTL (git-fixes).\n- pci: Mark 3ware-9650SE Root Port Extended Tags as broken (git-fixes).\n- pci: Rework pcie_retrain_link() wait loop (git-fixes).\n- pci: aardvark: Fix setting MSI address (git-fixes).\n- pci: aardvark: Fix support for MSI interrupts (git-fixes).\n- pci: dwc: Add unroll iATU space support to dw_pcie_disable_atu() (git-fixes).\n- pci: endpoint: Do not stop controller when unbinding endpoint function (git-fixes).\n- pci: hotplug: Allow marking devices as disconnected during bind/unbind (git-fixes).\n- pci: pciehp: Add pciehp_set_indicators() to set both indicators (git-fixes).\n- pci: pciehp: Cancel bringup sequence if card is not present (git-fixes).\n- pci: pciehp: Fix AB-BA deadlock between reset_lock and device_lock (git-fixes).\n- pci: pciehp: Use RMW accessors for changing LNKCTL (git-fixes).\n- pci: qcom: Disable write access to read only registers for IP v2.3.3 (git-fixes).\n- pci: qcom: Fix unbalanced PHY init on probe errors (git-fixes).\n- pci: qcom: Use DWC helpers for modifying the read-only DBI registers (git-fixes).\n- pci: switchtec: Return -EFAULT for copy_to_user() errors (git-fixes).\n- pnfs/flexfiles: Check the layout validity in ff_layout_mirror_prepare_stats (git-fixes).\n- pnfs: Fix the pnfs block driver's calculation of layoutget size (git-fixes).\n- rdma/ipoib: Fix error code return in ipoib_mcast_join (bsc#1221082)\n- s390/mm: Fix clearing storage keys for huge pages (git-fixes bsc#1223883).\n- s390/mm: Fix storage key clearing for guest huge pages (git-fixes bsc#1223885).\n- s390/vtime: fix average steal time calculation (git-fixes bsc#1221953).\n- scsi: qla2xxx: Change debug message during driver unload (bsc1221816).\n- scsi: qla2xxx: Delay I/O Abort on PCI error (bsc1221816).\n- scsi: qla2xxx: Fix N2N stuck connection (bsc1221816).\n- scsi: qla2xxx: Fix command flush on cable pull (bsc1221816).\n- scsi: qla2xxx: Fix double free of fcport (bsc1221816).\n- scsi: qla2xxx: Fix double free of the ha-\u003evp_map pointer (bsc1221816).\n- scsi: qla2xxx: NVME|FCP prefer flag not being honored (bsc1221816).\n- scsi: qla2xxx: Prevent command send on chip reset (bsc1221816).\n- scsi: qla2xxx: Split FCE|EFT trace control (bsc1221816).\n- scsi: qla2xxx: Update manufacturer detail (bsc1221816).\n- scsi: qla2xxx: Update version to 10.02.09.200-k (bsc1221816).\n- sr9800: Add check for usbnet_get_endpoints (git-fixes).\n- sunrpc: Fix RPC client cleaned up the freed pipefs dentries (git-fixes).\n- sunrpc: fix a memleak in gss_import_v2_context (git-fixes).\n- sunrpc: fix some memleaks in gssx_dec_option_array (git-fixes).\n- tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (bsc#1222619).\n- tun: honor IOCB_NOWAIT flag (git-fixes).\n- usb: dwc2: Fix memory leak in dwc2_hcd_init.\n- usb: dwc2: check return value after calling platform_get_resource() (git-fixes).\n- usb: dwc3: gadget: Ignore EP queue requests during bus reset (git-fixes).\n- usb: gadget: Fix issue with config_ep_by_speed function (git-fixes).\n- usb: mon: Fix atomicity violation in mon_bin_vma_fault (git-fixes).\n- usb: musb: Modify the 'HWVers' register address (git-fixes).\n- usb: roles: do not get/set_role() when usb_role_switch is unregistered.\n- usb: serial: option: add Fibocom L7xx modules (git-fixes).\n- usb: serial: option: do not claim interface 4 for ZTE MF290 (git-fixes).\n- usb: storage: set 1.50 as the lower bcdDevice for older 'Super Top' compatibility (git-fixes).\n- usb: typec: class: fix typec_altmode_put_partner to put plugs (git-fixes).\n- usb: usbfs: Do not WARN about excessively large memory allocations.\n- x86/CPU/AMD: Update the Zenbleed microcode revisions (git-fixes).\n- x86/bugs: Fix the SRSO mitigation on Zen3/4 (git-fixes).\n","status":"published","published":"2024-05-14T14:30:34Z","modified":"2026-02-04T03:21:38.493557Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1870-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).\n- CVE-2020-36312: Fixed an issue in virt/kvm/kvm_main.c that had a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure (bsc#1184509).\n- CVE-2021-23134: Fixed a use-after-free issue in nfc sockets (bsc#1186060).\n- CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).\n- CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).\n- CVE-2021-46909: Fixed PCI interrupt mapping in ARM footbridge (bsc#1220442).\n- CVE-2021-46938: Fixed double free of blk_mq_tag_set in dev remove after table load fails (bsc#1220554).\n- CVE-2021-46939: Fixed possible hung in trace_clock_global() (bsc#1220580).\n- CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).\n- CVE-2021-46950: Fixed possible data corruption in md/raid1 when ending a failed write request (bsc#1220662).\n- CVE-2021-46958: Fixed race between transaction aborts and fsyncs that could lead to use-after-free in btrfs (bsc#1220521).\n- CVE-2021-46960: Fixed wrong error code from smb2_get_enc_key() (bsc#1220528).\n- CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand()  (bsc#1220536).\n- CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).\n- CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).\n- CVE-2021-46981: Fixed NULL pointer in flush_workqueue (bsc#1220611).\n- CVE-2021-46988: Fixed possible crash in userfaultfd due to unreleased page (bsc#1220706).\n- CVE-2021-46990: Fixed crashes when toggling entry flush barrier in powerpc/64s (bsc#1220743).\n- CVE-2021-46998: Fixed a use after free bug in enic_hard_start_xmit() (bsc#1220625).\n- CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).\n- CVE-2021-47015: Fixed RX consumer index logic in the error path in bnxt_en (bsc#1220794).\n- CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).\n- CVE-2021-47034: Fixed resolved pte update for kernel memory on radix in powerpc/64s (bsc#1220687).\n- CVE-2021-47045: Fixed null pointer dereference in lpfc_prep_els_iocb() (bsc#1220640).\n- CVE-2021-47049: Fixed Use after free in __vmbus_open() (bsc#1220692).\n- CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).\n- CVE-2021-47056: Fixed uninitialized lock in adf_vf2pf_shutdown() (bsc#1220769).\n- CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).\n- CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure _after_  sync'ing SRCU (bsc#1220745).\n- CVE-2021-47063: Fixed possible use-after-free in panel_bridge_detach() (bsc#1220777).\n- CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).\n- CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).\n- CVE-2021-47071: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220846).\n- CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).\n- CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).\n- CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).\n- CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).\n- CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221532).\n- CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221541).\n- CVE-2021-47114: Fixed data corruption by fallocate in ocfs2 (bsc#1221548).\n- CVE-2021-47117: Fixed bug on in ext4_es_cache_extent() as ext4_split_extent_at() failed (bsc#1221575).\n- CVE-2021-47118: Fixed possible use-after-free when initializing `cad_pid` (bsc#1221605).\n- CVE-2021-47119: Fixed memory leak in ext4_fill_super() (bsc#1221608).\n- CVE-2021-47138: Fixed possible out-of-bound memory access in cxgb4 when clearing filters (bsc#1221934).\n- CVE-2021-47141: Fixed possible NULL pointer dereference when freeing irqs (bsc#1221949).\n- CVE-2021-47142: Fixed a use-after-free in drm/amdgpu (bsc#1221952).\n- CVE-2021-47143: Fixed possible corruption in net/smc after failed device_add() (bsc#1221988).\n- CVE-2021-47150: Fixed the potential memory leak in fec_enet_init() (bsc#1221973).\n- CVE-2021-47153: Fixed wrongly generated interrupt on bus reset in i2c/i801 (bsc#1221969).\n- CVE-2021-47165: Fixed shutdown crash when component not probed in drm/meson (bsc#1221965).\n- CVE-2021-47166: Fixed possible corruptionb in nfs_do_recoalesce() (bsc#1221998).\n- CVE-2021-47167: Fixed an Oopsable condition in __nfs_pageio_add_request() (bsc#1221991).\n- CVE-2021-47168: Fixed an incorrect limit in filelayout_decode_layout() (bsc#1222002).\n- CVE-2021-47169: Fixed possible NULL pointer dereference in serial/rp2 (bsc#1222000).\n- CVE-2021-47171: Fixed memory leak in smsc75xx_bind() (bsc#1221994).\n- CVE-2021-47173: Fixed memory leak in uss720_probe() (bsc#1221993).\n- CVE-2021-47177: Fixed sysfs leak in alloc_iommu() (bsc#1221997).\n- CVE-2021-47179: Fixed a NULL pointer dereference in pnfs_mark_matching_lsegs_return() (bsc#1222001).\n- CVE-2021-47180: Fixed memory leak in nci_allocate_device() (bsc#1221999).\n- CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource()  (bsc#1222660).\n- CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145, bsc#1222664).\n- CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).\n- CVE-2021-47189: Fixed denial of service due to memory ordering issues between normal and ordered work functions in btrfs (bsc#1222706).\n- CVE-2021-47202: Fixed NULL pointer dereferences in of_thermal_ functions (bsc#1222878)\n- CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).\n- CVE-2022-48619: Fixed a denial-of-service issue in drivers/input/input.c (bsc#1218220).\n- CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).\n- CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).\n- CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).\n- CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).\n- CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).\n- CVE-2023-52469: Fixed use-after-free in kv_parse_power_table() (bsc#1220411).\n- CVE-2023-52470: Fixed null-ptr-deref in radeon_crtc_init() (bsc#122041).\n- CVE-2023-52474: Fixed bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests in hfi1 (bsc#1220445).\n- CVE-2023-52476: Fixed possible unhandled page fault via perf sampling NMI during vsyscall (bsc#1220703).\n- CVE-2023-52477: Fixed USB Hub accesses to uninitialized BOS descriptors (bsc#1220790).\n- CVE-2023-52486: Fixed possible use-after-free in drm (bsc#1221277).\n- CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).\n- CVE-2023-52515: Fixed possible use-after-free in RDMA/srp (bsc#1221048).\n- CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).\n- CVE-2023-52528: Fixed uninit-value access in __smsc75xx_read_reg() (bsc#1220843).\n- CVE-2023-52575: Fixed SBPB enablement for spec_rstack_overflow=off (bsc#1220871).\n- CVE-2023-52583: Fixed deadlock or deadcode of misusing dget() inside ceph (bsc#1221058).\n- CVE-2023-52587: Fixed mcast list locking in IB/ipoib (bsc#1221082).\n- CVE-2023-52590: Fixed a possible ocfs2 filesystem corruption via directory renaming (bsc#1221088).\n- CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).\n- CVE-2023-52598: Fixed wrong setting of fpc register in s390/ptrace (bsc#1221060).\n- CVE-2023-52607: Fixed NULL pointer dereference in pgtable_cache_add kasprintf() (bsc#1221061).\n- CVE-2023-52628: Fixed 4-byte stack OOB write in nftables (bsc#1222117).\n- CVE-2023-52639: Fixed race during shadow creation in KVM/s390/vsie (bsc#1222300).\n- CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).\n- CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).\n- CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).\n- CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).\n- CVE-2023-7042: Fixed a NULL pointer dereference vulnerability in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (bsc#1218336).\n- CVE-2023-7192: Fixed a memory leak problem in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c (bsc#1218479).\n- CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).\n- CVE-2024-22099: Fixed NULL Pointer Dereference vulnerability in /net/bluetooth/rfcomm/core.c (bsc#1219170).\n- CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).\n- CVE-2024-24855: Fixed a null pointer dereference due to race condition in scsi device driver in lpfc_unregister_fcf_rescan() function (bsc#1219618).\n- CVE-2024-24861: Fixed an overflow due to race condition in media/xc4000 device driver in xc4000 xc4000_get_frequency() function (bsc#1219623).\n- CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).\n- CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).\n- CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).\n- CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).\n- CVE-2024-26743: Fixed memory leak in qedr_create_user_qp error flow in rdma/qedr (bsc#1222677)\n- CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449)\n- CVE-2024-26754: Fixed an use-after-free and null-ptr-deref in gtp_genl_dump_pdp() in gtp  (bsc#1222632).\n- CVE-2024-26763: Fixed user corruption via by writing data with O_DIRECT on device in dm-crypt (bsc#1222720).\n- CVE-2024-26771: Fixed a null pointer dereference on edma_probe in dmaengine ti edma  (bsc#1222610)\n- CVE-2024-26793: Fixed an use-after-free and null-ptr-deref in gtp_newlink() in gtp  (bsc#1222428).\n- CVE-2024-26805: Fixed a kernel-infoleak-after-free in __skb_datagram_iter in netlink  (bsc#1222630).\n- CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).\n- CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).\n- CVE-2021-47161: Fixed a resource leak in an error handling path in the error handling path of the probe function in spi spi-fsl-dspi (bsc#1221966).\n- CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb-\u003emac_header (bsc#1223513).\n- CVE-2024-26816: Ignore relocations in .notes section when building with CONFIG_XEN_PV=y (bsc#1222624).\n- CVE-2023-52595: Fixed possible deadlock in wifi/rt2x00 (bsc#1221046).\n- CVE-2024-26689: Fixed a use-after-free in encode_cap_msg() (bsc#1222503).\n- CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found() (bsc#1222618).\n- CVE-2021-47182: Fixed scsi_mode_sense() buffer length handling (bsc#1222662).\n- CVE-2022-48701: Fixed an out-of-bounds bug in __snd_usb_parse_audio_interface() (bsc#1223921).\n- CVE-2024-26993: Fixed a reference leak in sysfs_break_active_protection() (bsc#1223693)\n- CVE-2023-52650: Added missing check for of_find_device_by_node() (bsc#1223770)\n- CVE-2024-26948: Added a dc_state NULL check in dc_state_release (bsc#1223664)\n- CVE-2024-27013: Limited printing rate when illegal packet received by tun  dev (bsc#1223745).\n- CVE-2024-27014: Prevented deadlock while disabling aRFS (bsc#1223735).\n- CVE-2024-27046: Handled acti_netdevs allocation failure (bsc#1223827).\n- CVE-2021-47162: Fixed a possible memory leak in tipc_buf_append (bsc#1221977).\n- CVE-2024-27072: Removed useless locks in usbtv_video_free() (bsc#1223837).\n- CVE-2024-27075: Avoided stack overflow warnings with clang (bsc#1223842).\n- CVE-2024-27073: Fixed a memory leak in budget_av_attach() (bsc#1223843).\n- CVE-2024-27074: Fixed a memory leak in go7007_load_encoder() (bsc#1223844).\n- CVE-2024-27078: Fixed a memory leak in tpg_alloc() (bsc#1223781).\n- CVE-2023-52652: Fixed a possible name leak in ntb_register_device() (bsc#1223686).\n- CVE-2024-23848: Fixed a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c (bsc#1219104).\n- CVE-2024-26859: Prevent access to a freed page in page_pool in bnx2x (bsc#1223049).\n- CVE-2024-26817: Used calloc instead of kzalloc to avoid integer overflow (bsc#1222812)\n- CVE-2021-47149: Fixed a potential null pointer deref in fmvj18x_get_hwinfo() (bsc#1221972).\n- CVE-2023-52620: Disallowed timeout for anonymous sets in nf_tables (bsc#1221825).\n- CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).\n- CVE-2024-26878: Fixed potential NULL pointer dereference, related to dquots (bsc#1223060).\n- CVE-2024-26901: Used kzalloc() to fix information leak in do_sys_name_to_handle() (bsc#1223198).\n- CVE-2024-26671: Fixed an IO hang from sbitmap wakeup race in blk_mq_mark_tag_wait() (bsc#1222357).\n- CVE-2024-26772: Avoided allocating blocks from corrupted group in ext4_mb_find_by_goal() (bsc#1222613).\n- CVE-2023-52614: Fixed a buffer overflow in trans_stat_show() (bsc#1221617).\n- CVE-2024-26855: Fixed a potential NULL pointer dereference in ice_bridge_setlink() (bsc#1223051).\n- CVE-2024-26857: Made sure to pull inner header in geneve_rx() (bsc#1223058).\n- CVE-2024-26675: Limited MRU to 64K in ppp_async_ioctl() (bsc#1222379).\n- CVE-2024-26907: Fixed a fortify source warning while accessing Eth segment in mlx5 (bsc#1223203).\n- CVE-2023-52488: Converted from _raw_ to _noinc_ regmap functions for FIFO in sc16is7xx (bsc#1221162).\n- CVE-2024-26922: Validated the parameters of bo mapping operations more clearly (bsc#1223315).\n- CVE-2021-47184: Fixed NULL pointer dereference on VSI filter sync (bsc#1222666).\n- CVE-2023-52635: Synchronized devfreq_monitor_[start/stop] for devfreq (bsc#1222294).\n- CVE-2024-26883: Checked for integer overflow when using roundup_pow_of_two()  (bsc#1223035).\n- CVE-2024-26884: Fixed a bpf hashtab overflow check on 32-bit architectures (bsc#1223189).\n- CVE-2024-26839: Fixed a memleak in init_credit_return() (bsc#1222975)\n- CVE-2023-52644: Stop/wake correct queue in DMA Tx path when QoS is disabled in b43 (bsc#1222961).\n- CVE-2021-47205: Unregistered clocks/resets when unbinding in sunxi-ng (bsc#1222888).\n- CVE-2021-47211: Fixed a null pointer dereference on pointer cs_desc in usb-audio (bsc#1222869).\n- CVE-2021-47207: Fixed a null pointer dereference on pointer block in gus (bsc#1222790).\n- CVE-2024-26779: Fixed a race condition on enabling fast-xmit in mac80211 (bsc#1222772).\n- CVE-2024-26777: Error out if pixclock equals zero in fbdev/sis (bsc#1222765)\n- CVE-2024-26778: Error out if pixclock equals zero in fbdev/savage (bsc#1222770)\n- CVE-2024-26747: Fixed a NULL pointer issue with USB parent module's reference (bsc#1222609).\n\nThe following non-security bugs were fixed:\n\n- Input: adxl34x - do not hardcode interrupt trigger type (git-fixes).\n- Input: drv260x - sleep between polling GO bit (git-fixes).\n- Input: ipaq-micro-keys - add error handling for devm_kmemdup.\n- Input: xpad - add PXN V900 support.\n- USB: core: Fix deadlock in usb_deauthorize_interface().\n- USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (git-fixes).\n- atl1c: fix error return code in atl1c_probe() (git-fixes).\n- atl1e: fix error return code in atl1e_probe() (git-fixes).\n- bluetooth: btqca: Fixed a coding style error (git-fixes).\n- bluetooth: btqca: Introduce HCI_EV_VENDOR and use it (git-fixes).\n- bluetooth: btqcomsmd: Fix command timeout after setting BD address (git-fixes).\n- bluetooth: hci_intel: Add check for platform_driver_register (git-fixes).\n- bnx2x: Fix enabling network interfaces without VFs (git-fixes).\n- bnx2x: Fix missing error code in bnx2x_iov_init_one() (git-fixes).\n- bpf, sockmap: Fix preempt_rt splat when using raw_spin_lock_t (git-fixes).\n- drivers: usb: host: Fix deadlock in oxu_bus_suspend() (git-fixes).\n- ethernet: myri10ge: Fix missing error code in myri10ge_probe() (git-fixes).\n- ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram (git-fixes).\n- fuse: do not unhash root (bsc#1223954).\n- iommu/amd: Increase interrupt remapping table limit to 512 entries (git-fixes).\n- iommu/amd: Mark interrupt as managed (git-fixes).\n- iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs (git-fixes).\n- iommu/amd: Silence warnings under memory pressure (git-fixes).\n- iommu: Check if group is NULL before remove device (git-fixes).\n- kabi fix for pNFS: Fix the pnfs block driver's calculation of layoutget size (git-fixes).\n- kabi: pci: Add locking to RMW PCI Express Capability Register accessors (kabi).\n- lan78xx: Add missing return code checks (git-fixes).\n- lan78xx: Add support to dump lan78xx registers (git-fixes).\n- lan78xx: Do not access skb_queue_head list pointers directly (git-fixes).\n- lan78xx: Fix exception on link speed change (git-fixes).\n- lan78xx: Fix partial packet errors on suspend/resume (git-fixes).\n- lan78xx: Fix race conditions in suspend/resume handling (git-fixes).\n- lan78xx: Fix white space and style issues (git-fixes).\n- lan78xx: Modify error messages (git-fixes).\n- lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected (git-fixes).\n- net/mlx5: Properly convey driver version to firmware (git-fixes).\n- net/qla3xxx: fix schedule while atomic in ql_sem_spinlock (git-fixes).\n- net: Fix features skip in for_each_netdev_feature() (git-fixes).\n- net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function (git-fixes).\n- net: atheros: switch from 'pci_' to 'dma_' API (git-fixes).\n- net: lan78xx: Allow for VLAN headers in timeout calcs (git-fixes).\n- net: lan78xx: Make declaration style consistent (git-fixes).\n- net: lan78xx: Merge memcpy + lexx_to_cpus to get_unaligned_lexx (git-fixes).\n- net: lan78xx: fix runtime PM count underflow on link stop (git-fixes).\n- net: lan78xx: remove set but not used variable 'event' (git-fixes).\n- net: macb: ensure the device is available before accessing GEMGXL control registers (git-fixes).\n- net: stmmac: free tx skb buffer in stmmac_resume() (git-fixes).\n- net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() (git-fixes).\n- net: usb: lan78xx: Remove lots of set but unused 'ret' variables (git-fixes).\n- net:usb: Use ARRAY_SIZE instead of calculating the array size (git-fixes).\n- nfs: Fix O_DIRECT commit verifier handling (git-fixes).\n- nfs: Fix O_DIRECT locking issues (git-fixes).\n- nfs: Fix error handling for O_DIRECT write scheduling (bsc#1224785).\n- nfs: Fix a request reference leak in nfs_direct_write_clear_reqs() (git-fixes).\n- nfs: Fix an off by one in root_nfs_cat() (git-fixes).\n- nfs: Fix direct WRITE throughput regression (git-fixes).\n- nfs: Fix error handling for O_DIRECT write scheduling (git-fixes).\n- nfs: More O_DIRECT accounting fixes for error paths (git-fixes).\n- nfs: add atomic_open for NFSv3 to handle O_TRUNC correctly (bsc#1219847).\n- nfs: avoid spurious warning of lost lock that is being unlocked (bsc#1221791).\n- nfs: commit errors should be fatal (git-fixes).\n- nfs: only issue commit in DIO codepath if we have uncommitted data (git-fixes).\n- nfsd: Fix error cleanup path in nfsd_rename() (git-fixes).\n- nfsd: Reset cb_seq_status after NFS4ERR_DELAY (git-fixes).\n- nfsd: Retransmit callbacks after client reconnects (git-fixes).\n- nfsd: lock_rename() needs both directories to live on the same fs (git-fixes).\n- nfsv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT (git-fixes).\n- pci/aer: Clear MULTI_ERR_COR/UNCOR_RCV bits (git-fixes).\n- pci/aspm: Avoid link retraining race (git-fixes).\n- pci/aspm: Disable ASPM on MFD function removal to avoid use-after-free (git-fixes).\n- pci/aspm: Do not warn if already in common clock mode (git-fixes).\n- pci/aspm: Factor out pcie_wait_for_retrain() (git-fixes).\n- pci/aspm: Reduce severity of common clock config message (git-fixes).\n- pci/aspm: Return 0 or -ETIMEDOUT from pcie_retrain_link() (git-fixes).\n- pci/aspm: Use RMW accessors for changing LNKCTL (git-fixes).\n- pci/dpc: Print all TLP Prefixes, not just the first (git-fixes).\n- pci/iov: Enlarge virtfn sysfs name buffer (git-fixes).\n- pci/msi: Prevent MSI hardware interrupt number truncation (git-fixes).\n- pci/pm: Power up all devices during runtime resume (git-fixes).\n- pci/sysfs: Protect driver's D3cold preference from user space (git-fixes).\n- pci: Add ACS quirk for Broadcom BCM5750x NICs (git-fixes).\n- pci: Add function 1 DMA alias quirk for Marvell 88SE9235 (git-fixes).\n- pci: Add locking to RMW PCI Express Capability Register accessors (git-fixes).\n- pci: Avoid FLR for AMD FCH AHCI adapters (git-fixes).\n- pci: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() (git-fixes).\n- pci: Make link retraining use RMW accessors for changing LNKCTL (git-fixes).\n- pci: Mark 3ware-9650SE Root Port Extended Tags as broken (git-fixes).\n- pci: Rework pcie_retrain_link() wait loop (git-fixes).\n- pci: aardvark: Fix setting MSI address (git-fixes).\n- pci: aardvark: Fix support for MSI interrupts (git-fixes).\n- pci: dwc: Add unroll iATU space support to dw_pcie_disable_atu() (git-fixes).\n- pci: endpoint: Do not stop controller when unbinding endpoint function (git-fixes).\n- pci: hotplug: Allow marking devices as disconnected during bind/unbind (git-fixes).\n- pci: pciehp: Add pciehp_set_indicators() to set both indicators (git-fixes).\n- pci: pciehp: Cancel bringup sequence if card is not present (git-fixes).\n- pci: pciehp: Fix AB-BA deadlock between reset_lock and device_lock (git-fixes).\n- pci: pciehp: Use RMW accessors for changing LNKCTL (git-fixes).\n- pci: qcom: Disable write access to read only registers for IP v2.3.3 (git-fixes).\n- pci: qcom: Fix unbalanced PHY init on probe errors (git-fixes).\n- pci: qcom: Use DWC helpers for modifying the read-only DBI registers (git-fixes).\n- pci: switchtec: Return -EFAULT for copy_to_user() errors (git-fixes).\n- pnfs/flexfiles: Check the layout validity in ff_layout_mirror_prepare_stats (git-fixes).\n- pnfs: Fix the pnfs block driver's calculation of layoutget size (git-fixes).\n- rdma/ipoib: Fix error code return in ipoib_mcast_join (bsc#1221082)\n- s390/mm: Fix clearing storage keys for huge pages (git-fixes bsc#1223883).\n- s390/mm: Fix storage key clearing for guest huge pages (git-fixes bsc#1223885).\n- s390/vtime: fix average steal time calculation (git-fixes bsc#1221953).\n- scsi: qla2xxx: Change debug message during driver unload (bsc1221816).\n- scsi: qla2xxx: Delay I/O Abort on PCI error (bsc1221816).\n- scsi: qla2xxx: Fix N2N stuck connection (bsc1221816).\n- scsi: qla2xxx: Fix command flush on cable pull (bsc1221816).\n- scsi: qla2xxx: Fix double free of fcport (bsc1221816).\n- scsi: qla2xxx: Fix double free of the ha-\u003evp_map pointer (bsc1221816).\n- scsi: qla2xxx: NVME|FCP prefer flag not being honored (bsc1221816).\n- scsi: qla2xxx: Prevent command send on chip reset (bsc1221816).\n- scsi: qla2xxx: Split FCE|EFT trace control (bsc1221816).\n- scsi: qla2xxx: Update manufacturer detail (bsc1221816).\n- scsi: qla2xxx: Update version to 10.02.09.200-k (bsc1221816).\n- sr9800: Add check for usbnet_get_endpoints (git-fixes).\n- sunrpc: Fix RPC client cleaned up the freed pipefs dentries (git-fixes).\n- sunrpc: fix a memleak in gss_import_v2_context (git-fixes).\n- sunrpc: fix some memleaks in gssx_dec_option_array (git-fixes).\n- tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (bsc#1222619).\n- tun: honor IOCB_NOWAIT flag (git-fixes).\n- usb: dwc2: Fix memory leak in dwc2_hcd_init.\n- usb: dwc2: check return value after calling platform_get_resource() (git-fixes).\n- usb: dwc3: gadget: Ignore EP queue requests during bus reset (git-fixes).\n- usb: gadget: Fix issue with config_ep_by_speed function (git-fixes).\n- usb: mon: Fix atomicity violation in mon_bin_vma_fault (git-fixes).\n- usb: musb: Modify the 'HWVers' register address (git-fixes).\n- usb: roles: do not get/set_role() when usb_role_switch is unregistered.\n- usb: serial: option: add Fibocom L7xx modules (git-fixes).\n- usb: serial: option: do not claim interface 4 for ZTE MF290 (git-fixes).\n- usb: storage: set 1.50 as the lower bcdDevice for older 'Super Top' compatibility (git-fixes).\n- usb: typec: class: fix typec_altmode_put_partner to put plugs (git-fixes).\n- usb: usbfs: Do not WARN about excessively large memory allocations.\n- x86/CPU/AMD: Update the Zenbleed microcode revisions (git-fixes).\n- x86/bugs: Fix the SRSO mitigation on Zen3/4 (git-fixes).\n","status":"published","published":"2024-05-30T14:27:09Z","modified":"2026-02-04T03:36:26.384359Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1979-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).\n- CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948). Update blacklist.conf: remove entry\n- CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).\n- CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).\n- CVE-2022-48697: Fix a use-after-free (bsc#1223922). Update blacklist.conf: drop entry from it\n- CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).\n- CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)\n- CVE-2023-42755: Check user supplied offsets (bsc#1215702).\n- CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).\n- CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).\n- CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).\n- CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222 CVE-2023-52732).\n- CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)\n- CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)\n- CVE-2024-36029: Pervent access to suspended controller (bsc#1225708 CVE-2024-36029)\n- CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)\n- CVE-2021-47352: Add validation for used length (bsc#1225124).\n- CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)\n- CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).\n- CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)\n- CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).\n- CVE-2021-47423: Fix file release memory leak (bsc#1225366).\n- CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).\n- CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).\n- CVE-2024-35932: Do not check if plane-\u003estate-\u003efb == state-\u003efb (bsc#1224650).\n- CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).\n- CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).\n- CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).\n- CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).\n- CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).\n- CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).\n- CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)\n- CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).\n- CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960, CVE-2021-47277).\n- CVE-2024-35791: Flush pages under kvm-\u003elock to fix UAF in svm_register_enc_region() (bsc#1224725).\n- CVE-2021-47401: Fix stack information leak (bsc#1225242).\n- CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).\n- CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).\n- CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)\n- CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).\n- CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).\n- CVE-2023-52864: Fix opening of char device (bsc#1225132).\n- CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).\n- CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).\n- CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)\n- CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).\n- CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).\n- CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)\n- CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).\n- CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)\n- CVE-2021-47249: Fix memory leak in rds_recvmsg (bsc#1224880)\n- CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb (bsc#1225082)\n- CVE-2021-47250: Fix memory leak in netlbl_cipsov4_add_std (bsc#1224827)\n- CVE-2024-35849: Fix information leak in btrfs_ioctl_logical_to_ino() (bsc#1224733).\n- CVE-2024-27436: Stop parsing channels bits when all channels are found (bsc#1224803).\n- CVE-2021-47281: Fix race of snd_seq_timer_open() (bsc#1224983).\n- CVE-2024-35789: Clear fast rx for non-4addr in VLAN netdev (bsc#1224749).\n- CVE-2024-35830: Register v4l2 async device only after successful setup (bsc#1224680).\n- CVE-2021-47334: Fix two use after free in ibmasm_init_one (bsc#1225112).\n- CVE-2021-47357: Fix possible use-after-free in ia_module_exit() (bsc#1225144).\n- CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).\n- CVE-2023-52865: Add check for mtk_alloc_clk_data (bsc#1225086).\n- CVE-2024-35887: Fix use-after-free bugs caused by ax25_ds_del_timer (bsc#1224663)\n- CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit() (bsc#1224907).\n- CVE-2024-26957: Fix reference counting on zcrypt card objects (bsc#1223666).\n- CVE-2023-52691: Fix a double-free in si_dpm_init (bsc#1224607).\n- CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).\n- CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).\n- CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).\n- CVE-2024-26984: Fix instmem race condition around ptr stores (bsc#1223633)\n- CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).\n- CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).\n- CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).\n- CVE-2024-26900: Fixed kmemleak of rdev-\u003eserial (bsc#1223046).\n- CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181).\n- CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).\n- CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).\n- CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)\n- CVE-2021-47206: Check return value after calling platform_get_resource() (bsc#1222894).\n- CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)\n- CVE-2024-26996: Fix UAF ncm object at re-bind after usb transport error (bsc#1223752).\n- CVE-2024-26874: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip (bsc#1223048)\n- CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).\n\nThe following non-security bugs were fixed:\n\n- af_unix: annote lockless accesses to unix_tot_inflight \u0026 gc_in_progress (bsc#1223384).\n- af_unix: Do not use atomic ops for unix_sk(sk)-\u003einflight (bsc#1223384).\n- af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).\n- ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value (git-fixes).\n- assoc_array: Fix BUG_ON during garbage collect.\n- autofs: fix a leak in autofs_expire_indirect() (git-fixes)\n- Bluetooth: btusb: Some Qualcomm Bluetooth adapters stop working (git-fixes).\n- btrfs: avoid null pointer dereference on fs_info when calling btrfs_crit (git-fixes)\n- btrfs: check if root is readonly while setting security xattr (git-fixes)\n- btrfs: defrag: use btrfs_mod_outstanding_extents in cluster_pages_for_defrag (git-fixes)\n- btrfs: do not get an EINTR during drop_snapshot for reloc (git-fixes)\n- btrfs: do not stop integrity writeback too early (git-fixes)\n- btrfs: Explicitly handle btrfs_update_root failure (git-fixes)\n- btrfs: fail mount when sb flag is not in BTRFS_SUPER_FLAG_SUPP (git-fixes)\n- btrfs: fix btrfs_prev_leaf() to not return the same key twice (git-fixes)\n- btrfs: fix deadlock when writing out space cache (git-fixes)\n- Btrfs: fix incorrect {node,sector}size endianness from BTRFS_IOC_FS_INFO (git-fixes)\n- btrfs: fix lockdep splat and potential deadlock after failure running delayed items (git-fixes)\n- btrfs: fix lost error handling when looking up extended ref on log replay (git-fixes)\n- btrfs: Fix NULL pointer exception in find_bio_stripe (git-fixes)\n- btrfs: Fix out of bounds access in btrfs_search_slot (git-fixes)\n- btrfs: fix race when deleting quota root from the dirty cow roots list (git-fixes)\n- btrfs: fix range_end calculation in extent_write_locked_range (git-fixes)\n- btrfs: fix return value mixup in btrfs_get_extent (git-fixes)\n- btrfs: fix unaligned access in readdir (git-fixes)\n- btrfs: limit device extents to the device size (git-fixes)\n- btrfs: prevent to set invalid default subvolid (git-fixes)\n- btrfs: record delayed inode root in transaction (git-fixes)\n- btrfs: scrub: reject unsupported scrub flags (git-fixes)\n- btrfs: send: ensure send_fd is writable (git-fixes)\n- btrfs: send: in case of IO error log it (git-fixes)\n- btrfs: send: limit number of clones and allocated memory size (git-fixes)\n- btrfs: sysfs: use NOFS for device creation (git-fixes) Adjustment: add #include\n- btrfs: tree-checker: add missing return after error in root_item (git-fixes)\n- btrfs: tree-checker: add missing returns after data_ref alignment checks (git-fixes)\n- btrfs: tree-checker: do not error out if extent ref hash does not match (git-fixes)\n- btrfs: tree-checker: fix inline ref size in error messages (git-fixes)\n- btrfs: tree-checker: Fix misleading group system information (git-fixes)\n- btrfs: undo writable superblocke when sprouting fails (git-fixes)\n- btrfs: validate qgroup inherit for SNAP_CREATE_V2 ioctl (git-fixes)\n- ecryptfs: fix a memory leak bug in ecryptfs_init_messaging() (git-fixes)\n- ecryptfs: fix a memory leak bug in parse_tag_1_packet() (git-fixes)\n- ecryptfs: fix kernel panic with null dev_name (git-fixes)\n- ecryptfs: Fix typo in message (git-fixes)\n- ep_create_wakeup_source(): dentry name can change under you (git-fixes)\n- exportfs_decode_fh(): negative pinned may become positive without the parent locked (git-fixes)\n- fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes (git-fixes)\n- fscrypt: clean up some BUG_ON()s in block encryption/decryption (git-fixes)\n- ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (git-fixes).\n- ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (git-fixes).\n- kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes).\n- KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M (git-fixes bsc#1225059).\n- l2tp: pass correct message length to ip6_append_data (git-fixes).\n- lib/mpi: use kcalloc in mpi_resize (git-fixes).\n- list: fix a data-race around ep-\u003erdllist (git-fixes).\n- net: 9p: avoid freeing uninit memory in p9pdu_vreadf (git-fixes).\n- net: tcp: fix unexcepted socket die when snd_wnd is 0 (git-fixes).\n- net: usb: ax88179_178a: stop lying about skb-\u003etruesize (git-fixes).\n- net: usb: smsc95xx: stop lying about skb-\u003etruesize (git-fixes).\n- net: usb: sr9700: stop lying about skb-\u003etruesize (git-fixes).\n- net: vmxnet3: Fix NULL pointer dereference in vmxnet3_rq_rx_complete() (bsc#1223360).\n- net/smc: fix fallback failed while sendmsg with fastopen (git-fixes).\n- netfilter: nf_queue: augment nfqa_cfg_policy (git-fixes).\n- netfilter: nft_compat: explicitly reject ERROR and standard target (git-fixes).\n- netfilter: x_tables: set module owner for icmp(6) matches (git-fixes).\n- nfc: change order inside nfc_se_io error path (git-fixes).\n- powerpc/pseries/lparcfg: drop error message from guest name lookup (bsc#1187716 ltc#193451 git-fixes).\n- ppdev: Add an error check in register_device (git-fixes).\n- rds: avoid unenecessary cong_update in loop transport (git-fixes).\n- rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp (git-fixes).\n- ring-buffer: Clean ring_buffer_poll_wait() error return (git-fixes).\n- ring-buffer: Fix a race between readers and resize checks (bsc#1222893).\n- rxrpc: Do not put crypto buffers on the stack (git-fixes).\n- rxrpc: Fix a memory leak in rxkad_verify_response() (git-fixes).\n- rxrpc: Provide a different lockdep key for call-\u003euser_mutex for kernel calls (git-fixes).\n- rxrpc: The mutex lock returned by rxrpc_accept_call() needs releasing (git-fixes).\n- rxrpc: Work around usercopy check (git-fixes).\n- s390/cpum_cf: make crypto counters upward compatible across machine types (bsc#1224347).\n- s390/pci: fix max size calculation in zpci_memcpy_toio() (git-fixes bsc#1225062).\n- tcp: tcp_make_synack() can be called from process context (git-fixes).\n- tracing: Fix blocked reader of snapshot buffer (git-fixes).\n- tracing: hide unused ftrace_event_id_fops (git-fixes).\n- tracing: Use .flush() call to wake up readers (git-fixes).\n- tracing: Use strncpy instead of memcpy when copying comm in trace.c (git-fixes).\n- usb: aqc111: stop lying about skb-\u003etruesize (git-fixes).\n- wifi: cfg80211: avoid leaking stack data into trace (git-fixes).\n- wifi: radiotap: fix kernel-doc notation warnings (git-fixes).\n","status":"published","published":"2024-06-11T07:41:39Z","modified":"2026-02-04T04:21:09.752601Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1983-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).\n- CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948).\n- CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).\n- CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).\n- CVE-2022-48697: Fix a use-after-free (bsc#1223922).\n- CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).\n- CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)\n- CVE-2023-42755: Check user supplied offsets (bsc#1215702).\n- CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).\n- CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).\n- CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).\n- CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222).\n- CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)\n- CVE-2021-47548: Fixed a possible array out-of-bounds (bsc#1225506)\n- CVE-2024-36029: Pervent access to suspended controller (bsc#1225708)\n- CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)\n- CVE-2021-47352: Add validation for used length (bsc#1225124).\n- CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)\n- CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).\n- CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)\n- CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).\n- CVE-2021-47423: Fix file release memory leak (bsc#1225366).\n- CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).\n- CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).\n- CVE-2024-35932: Do not check if plane-\u003estate-\u003efb == state-\u003efb (bsc#1224650).\n- CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).\n- CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).\n- CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).\n- CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).\n- CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).\n- CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).\n- CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)\n- CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).\n- CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960).\n- CVE-2024-35791: Flush pages under kvm-\u003elock to fix UAF in svm_register_enc_region() (bsc#1224725).\n- CVE-2021-47401: Fix stack information leak (bsc#1225242).\n- CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).\n- CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).\n- CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)\n- CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).\n- CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).\n- CVE-2023-52864: Fix opening of char device (bsc#1225132).\n- CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).\n- CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).\n- CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)\n- CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).\n- CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).\n- CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)\n- CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).\n- CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)\n- CVE-2021-47249: Fix memory leak in rds_recvmsg (bsc#1224880)\n- CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb (bsc#1225082)\n- CVE-2021-47250: Fix memory leak in netlbl_cipsov4_add_std (bsc#1224827)\n- CVE-2024-35849: Fix information leak in btrfs_ioctl_logical_to_ino() (bsc#1224733).\n- CVE-2024-27436: Stop parsing channels bits when all channels are found (bsc#1224803).\n- CVE-2021-47281: Fix race of snd_seq_timer_open() (bsc#1224983).\n- CVE-2024-35789: Clear fast rx for non-4addr sta VLAN changes (bsc#1224749).\n- CVE-2024-35830: Register v4l2 async device only after successful setup (bsc#1224680).\n- CVE-2021-47334: Fix two use after free in ibmasm_init_one (bsc#1225112).\n- CVE-2021-47357: Fix possible use-after-free in ia_module_exit() (bsc#1225144).\n- CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).\n- CVE-2023-52865: Add check for mtk_alloc_clk_data (bsc#1225086).\n- CVE-2024-35887: Fix use-after-free bugs caused by ax25_ds_del_timer (bzg#1224663)\n- CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit() (bsc#1224907).\n- CVE-2024-26957: Fix reference counting on zcrypt card objects (bsc#1223666).\n- CVE-2023-52691: Fix a double-free in si_dpm_init (bsc#1224607).\n- CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).\n- CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).\n- CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).\n- CVE-2024-26984: Fix instmem race condition around ptr stores (bsc#1223633)\n- CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).\n- CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).\n- CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).\n- CVE-2024-26900: Fixed kmemleak of rdev-\u003eserial (bsc#1223046).\n- CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181).\n- CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).\n- CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).\n- CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)\n- CVE-2021-47206: Check return value after calling platform_get_resource() (bsc#1222894).\n- CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)\n- CVE-2024-26996: Fix UAF ncm object at re-bind after usb ep transport error (bsc#1223752).\n- CVE-2024-26874: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip (bsc#1223048)\n- CVE-2022-48702: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() (bsc#1223923).\n- CVE-2022-48672: Fix off-by-one error in unflatten_dt_nodes() (bsc#1223931).\n- CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).\n- CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)\n- CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).\n- CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).\n- CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).\n- CVE-2024-27008: Fix out of bounds access (bsc#1223802).\n- CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).\n- CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).\n\nThe following non-security bugs were fixed:\n\n- af_unix: annote lockless accesses to unix_tot_inflight \u0026 gc_in_progress (bsc#1223384).\n- af_unix: Do not use atomic ops for unix_sk(sk)-\u003einflight (bsc#1223384).\n- af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).\n- ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value (git-fixes).\n- assoc_array: Fix BUG_ON during garbage collect.\n- autofs: fix a leak in autofs_expire_indirect() (git-fixes)\n- Bluetooth: btusb: Some Qualcomm Bluetooth adapters stop working (git-fixes).\n- btrfs: avoid null pointer dereference on fs_info when calling btrfs_crit (git-fixes)\n- btrfs: check if root is readonly while setting security xattr (git-fixes)\n- btrfs: defrag: use btrfs_mod_outstanding_extents in cluster_pages_for_defrag (git-fixes)\n- btrfs: do not get an EINTR during drop_snapshot for reloc (git-fixes)\n- btrfs: do not stop integrity writeback too early (git-fixes)\n- btrfs: Explicitly handle btrfs_update_root failure (git-fixes)\n- btrfs: fail mount when sb flag is not in BTRFS_SUPER_FLAG_SUPP (git-fixes)\n- btrfs: fix btrfs_prev_leaf() to not return the same key twice (git-fixes)\n- btrfs: fix deadlock when writing out space cache (git-fixes)\n- Btrfs: fix incorrect {node,sector}size endianness from BTRFS_IOC_FS_INFO (git-fixes)\n- btrfs: fix lockdep splat and potential deadlock after failure running delayed items (git-fixes)\n- btrfs: fix lost error handling when looking up extended ref on log replay (git-fixes)\n- btrfs: Fix NULL pointer exception in find_bio_stripe (git-fixes)\n- btrfs: Fix out of bounds access in btrfs_search_slot (git-fixes)\n- btrfs: fix race when deleting quota root from the dirty cow roots list (git-fixes)\n- btrfs: fix range_end calculation in extent_write_locked_range (git-fixes)\n- btrfs: fix return value mixup in btrfs_get_extent (git-fixes)\n- btrfs: fix unaligned access in readdir (git-fixes)\n- btrfs: limit device extents to the device size (git-fixes)\n- btrfs: prevent to set invalid default subvolid (git-fixes)\n- btrfs: record delayed inode root in transaction (git-fixes)\n- btrfs: scrub: reject unsupported scrub flags (git-fixes)\n- btrfs: send: ensure send_fd is writable (git-fixes)\n- btrfs: send: in case of IO error log it (git-fixes)\n- btrfs: send: limit number of clones and allocated memory size (git-fixes)\n- btrfs: sysfs: use NOFS for device creation (git-fixes) Adjustment: add #include\n- btrfs: tree-checker: add missing return after error in root_item (git-fixes)\n- btrfs: tree-checker: add missing returns after data_ref alignment checks (git-fixes)\n- btrfs: tree-checker: do not error out if extent ref hash does not match (git-fixes)\n- btrfs: tree-checker: fix inline ref size in error messages (git-fixes)\n- btrfs: tree-checker: Fix misleading group system information (git-fixes)\n- btrfs: undo writable superblocke when sprouting fails (git-fixes)\n- btrfs: validate qgroup inherit for SNAP_CREATE_V2 ioctl (git-fixes)\n- ecryptfs: fix a memory leak bug in ecryptfs_init_messaging() (git-fixes)\n- ecryptfs: fix a memory leak bug in parse_tag_1_packet() (git-fixes)\n- ecryptfs: fix kernel panic with null dev_name (git-fixes)\n- ecryptfs: Fix typo in message (git-fixes)\n- ep_create_wakeup_source(): dentry name can change under you (git-fixes)\n- exportfs_decode_fh(): negative pinned may become positive without the parent locked (git-fixes)\n- fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes (git-fixes)\n- fscrypt: clean up some BUG_ON()s in block encryption/decryption (git-fixes)\n- ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (git-fixes).\n- ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (git-fixes).\n- kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes).\n- KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M (git-fixes bsc#1225059).\n- l2tp: pass correct message length to ip6_append_data (git-fixes).\n- lib/mpi: use kcalloc in mpi_resize (git-fixes).\n- list: fix a data-race around ep-\u003erdllist (git-fixes).\n- net: 9p: avoid freeing uninit memory in p9pdu_vreadf (git-fixes).\n- net: tcp: fix unexcepted socket die when snd_wnd is 0 (git-fixes).\n- net: usb: ax88179_178a: stop lying about skb-\u003etruesize (git-fixes).\n- net: usb: smsc95xx: stop lying about skb-\u003etruesize (git-fixes).\n- net: usb: sr9700: stop lying about skb-\u003etruesize (git-fixes).\n- net: vmxnet3: Fix NULL pointer dereference in vmxnet3_rq_rx_complete() (bsc#1223360).\n- net/smc: fix fallback failed while sendmsg with fastopen (git-fixes).\n- net/tls: Remove the context from the list in tls_device_down (bsc#1221545).\n- netfilter: nf_queue: augment nfqa_cfg_policy (git-fixes).\n- netfilter: nft_compat: explicitly reject ERROR and standard target (git-fixes).\n- netfilter: x_tables: set module owner for icmp(6) matches (git-fixes).\n- nfc: change order inside nfc_se_io error path (git-fixes).\n- powerpc/pseries/lparcfg: drop error message from guest name lookup (bsc#1187716 ltc#193451 git-fixes).\n- ppdev: Add an error check in register_device (git-fixes).\n- printk: Disable passing console lock owner completely during panic() (bsc#1197894).\n- printk: Update @console_may_schedule in console_trylock_spinning() (bsc#1223969).\n- rds: avoid unenecessary cong_update in loop transport (git-fixes).\n- rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp (git-fixes).\n- ring-buffer: Clean ring_buffer_poll_wait() error return (git-fixes).\n- ring-buffer: Fix a race between readers and resize checks (bsc#1222893).\n- rxrpc: Do not put crypto buffers on the stack (git-fixes).\n- rxrpc: Fix a memory leak in rxkad_verify_response() (git-fixes).\n- rxrpc: Provide a different lockdep key for call-\u003euser_mutex for kernel calls (git-fixes).\n- rxrpc: The mutex lock returned by rxrpc_accept_call() needs releasing (git-fixes).\n- rxrpc: Work around usercopy check (git-fixes).\n- s390/cpum_cf: make crypto counters upward compatible across machine types (bsc#1224347).\n- s390/pci: fix max size calculation in zpci_memcpy_toio() (git-fixes bsc#1225062).\n- tcp: tcp_make_synack() can be called from process context (git-fixes).\n- tls: Fix context leak on tls_device_down (bsc#1221545).\n- tracing: Fix blocked reader of snapshot buffer (git-fixes).\n- tracing: hide unused ftrace_event_id_fops (git-fixes).\n- tracing: Use .flush() call to wake up readers (git-fixes).\n- tracing: Use strncpy instead of memcpy when copying comm in trace.c (git-fixes).\n- tty/sysrq: replace smp_processor_id() with get_cpu() (bsc#1223540).\n- usb: aqc111: stop lying about skb-\u003etruesize (git-fixes).\n- wifi: cfg80211: avoid leaking stack data into trace (git-fixes).\n- wifi: radiotap: fix kernel-doc notation warnings (git-fixes).\n","status":"published","published":"2024-06-11T10:56:58Z","modified":"2026-02-04T03:51:56.608318Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:2184-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).\n- CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).\n- CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).\n- CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).\n- CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).\n- CVE-2021-47206: Check return value after calling  platform_get_resource() (bsc#1222894).\n- CVE-2021-47238: Fixed memory leak in ip_mc_add1_src  (bsc#1224847)\n- CVE-2021-47245: Fixed out of bounds when parsing TCP options  (bsc#1224838)\n- CVE-2021-47246: Fixed page reclaim for dead peer hairpin  (CVE-2021-47246 bsc#1224831).\n- CVE-2021-47249: Fixed memory leak in rds_recvmsg  (bsc#1224880)\n- CVE-2021-47250: Fixed memory leak in netlbl_cipsov4_add_std  (bsc#1224827)\n- CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)\n- CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot  accesses (bsc#1224960).\n- CVE-2021-47281: Fixed race of snd_seq_timer_open() (bsc#1224983).\n- CVE-2021-47334: Fixed two use after free in ibmasm_init_one  (bsc#1225112).\n- CVE-2021-47352: Add validation for used length (bsc#1225124).\n- CVE-2021-47355: Fixed possible use-after-free in nicstar_cleanup()  (bsc#1225141).\n- CVE-2021-47357: Fixed possible use-after-free in ia_module_exit()  (bsc#1225144).\n- CVE-2021-47361: Fixed error handling in mcb_alloc_bus() (bsc#1225151).\n- CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).\n- CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).\n- CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225208).\n- CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb  (bsc#1225082)\n- CVE-2021-47401: Fixed stack information leak (bsc#1225242).\n- CVE-2021-47423: Fixed file release memory leak (bsc#1225366).\n- CVE-2021-47431: Fixed gart.bo pin_count leak (bsc#1225390).\n- CVE-2021-47469: Add SPI fix commit to be ignored (bsc#1225347)\n- CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit()  (bsc#1224907).\n- CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)\n- CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).\n- CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).\n- CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).\n- CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).\n- CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)\n- CVE-2022-48672: Fixed off-by-one error in unflatten_dt_nodes()  (CVE-2022-48672 bsc#1223931).\n- CVE-2022-48686: Fixed UAF when detecting digest errors (bsc#1223948).\n- CVE-2022-48697: Fixed a use-after-free (bsc#1223922). \n- CVE-2022-48702: Fixed out of bounds access in  snd_emu10k1_pcm_channel_alloc() (bsc#1223923).\n- CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)\n- CVE-2022-48708: Fixed potential NULL dereference (bsc#1224942).\n- CVE-2022-48710: Fixed a possible null pointer dereference (bsc#1225230).\n- CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).\n- CVE-2023-42755: Check user supplied offsets (bsc#1215702).\n- CVE-2023-52586: Fixed  mutex lock in control vblank irq (bsc#1221081).\n- CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).\n- CVE-2023-52664: Eliminate double free in error handling logic  (bsc#1224747).\n- CVE-2023-52691: Fixed a double-free in si_dpm_init (bsc#1224607).\n- CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass()  (bsc#1224621)\n- CVE-2023-52730: Fixed possible resource leaks in some error paths  (bsc#1224956).\n- CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace  (bsc#1225222).\n- CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)\n- CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).\n- CVE-2023-52821: Fixed a possible null pointer dereference (bsc#1225022).\n- CVE-2023-52864: Fixed opening of char device (bsc#1225132).\n- CVE-2023-52865: Add check for mtk_alloc_clk_data  (bsc#1225086).\n- CVE-2023-52867: Fixed possible buffer overflow (bsc#1225009).\n- CVE-2023-52875: Add check for mtk_alloc_clk_data  (bsc#1225096).\n- CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).\n- CVE-2024-26625: Call sock_orphan() at release time  (bsc#1221086)\n- CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).\n- CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)\n- CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).\n- CVE-2024-26846: Do not wait in vain when unloading module  (bsc#1223023).\n- CVE-2024-26874: Fixed a null pointer crash in (bsc#1223048)\n- CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).\n- CVE-2024-26900: Fixed kmemleak of rdev-\u003eserial (bsc#1223046).\n- CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)\n- CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).\n- CVE-2024-26957: Fixed reference counting on zcrypt card objects  (bsc#1223666).\n- CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).\n- CVE-2024-26984: Fixed instmem race condition around ptr stores (bsc#1223633)\n- CVE-2024-26996: Fixed UAF ncm object at re-bind after usb  ep transport error (bsc#1223752).\n- CVE-2024-27008: Fixed out of bounds access (CVE-2024-27008 bsc#1223802).\n- CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).\n- CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).\n- CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).\n- CVE-2024-27401: Fixed user_length taken into account when  fetching packet contents (bsc#1224181).\n- CVE-2024-27419: Fixed data-races around sysctl_net_busy_read  (bsc#1224759)\n- CVE-2024-27436: Stop parsing channels bits when all channels  are found (bsc#1224803).\n- CVE-2024-35789: Check fast rx for non-4addr sta VLAN  changes (bsc#1224749).\n- CVE-2024-35791: Flush pages under kvm-\u003elock to fix UAF in  svm_register_enc_region() (bsc#1224725).\n- CVE-2024-35809: Drain runtime-idle callbacks before driver removal  (bsc#1224738).\n- CVE-2024-35830: Register v4l2 async device only after  successful setup (bsc#1224680).\n- CVE-2024-35849: Fixed information leak in btrfs_ioctl_logical_to_ino()  (bsc#1224733).\n- CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).\n- CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf()  (bsc#1224671).\n- CVE-2024-35887: Fixed use-after-free bugs caused by ax25_ds_del_timer  (bsc#1224663)\n- CVE-2024-35932: Do not check if plane-\u003estate-\u003efb == state-\u003efb (bsc#1224650).\n- CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)\n- CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)\n- CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host()  (bsc#1224648).\n- CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr  (bsc#1224580).\n- CVE-2024-35982: Avoid infinite loop trying to resize local TT  (bsc#1224566)\n- CVE-2024-36029: Prevent access to suspended controller (bsc#1225708)\n\nThe following non-security bugs were fixed:\n\n- af_unix: annote lockless accesses to unix_tot_inflight \u0026 gc_in_progress (bsc#1223384).\n- af_unix: Do not use atomic ops for unix_sk(sk)-\u003einflight (bsc#1223384).\n- af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).\n- ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value (git-fixes).\n- assoc_array: Fix BUG_ON during garbage collect.\n- autofs: fix a leak in autofs_expire_indirect() (git-fixes)\n- Bluetooth: btusb: Some Qualcomm Bluetooth adapters stop working (git-fixes).\n- btrfs: avoid null pointer dereference on fs_info when calling btrfs_crit (git-fixes)\n- btrfs: check if root is readonly while setting security xattr (git-fixes)\n- btrfs: defrag: use btrfs_mod_outstanding_extents in cluster_pages_for_defrag (git-fixes)\n- btrfs: do not get an EINTR during drop_snapshot for reloc (git-fixes)\n- btrfs: do not stop integrity writeback too early (git-fixes)\n- btrfs: Explicitly handle btrfs_update_root failure (git-fixes)\n- btrfs: fail mount when sb flag is not in BTRFS_SUPER_FLAG_SUPP (git-fixes)\n- btrfs: fix btrfs_prev_leaf() to not return the same key twice (git-fixes)\n- btrfs: fix deadlock when writing out space cache (git-fixes)\n- Btrfs: fix incorrect {node,sector}size endianness from BTRFS_IOC_FS_INFO (git-fixes)\n- btrfs: fix lockdep splat and potential deadlock after failure running delayed items (git-fixes)\n- btrfs: fix lost error handling when looking up extended ref on log replay (git-fixes)\n- btrfs: Fix NULL pointer exception in find_bio_stripe (git-fixes)\n- btrfs: Fix out of bounds access in btrfs_search_slot (git-fixes)\n- btrfs: fix race when deleting quota root from the dirty cow roots list (git-fixes)\n- btrfs: fix range_end calculation in extent_write_locked_range (git-fixes)\n- btrfs: fix return value mixup in btrfs_get_extent (git-fixes)\n- btrfs: fix unaligned access in readdir (git-fixes)\n- btrfs: limit device extents to the device size (git-fixes)\n- btrfs: prevent to set invalid default subvolid (git-fixes)\n- btrfs: record delayed inode root in transaction (git-fixes)\n- btrfs: scrub: reject unsupported scrub flags (git-fixes)\n- btrfs: send: ensure send_fd is writable (git-fixes)\n- btrfs: send: in case of IO error log it (git-fixes)\n- btrfs: send: limit number of clones and allocated memory size (git-fixes)\n- btrfs: sysfs: use NOFS for device creation (git-fixes) Adjustment: add #include\n- btrfs: tree-checker: add missing return after error in root_item (git-fixes)\n- btrfs: tree-checker: add missing returns after data_ref alignment checks (git-fixes)\n- btrfs: tree-checker: do not error out if extent ref hash does not match (git-fixes)\n- btrfs: tree-checker: fix inline ref size in error messages (git-fixes)\n- btrfs: tree-checker: Fix misleading group system information (git-fixes)\n- btrfs: undo writable superblocke when sprouting fails (git-fixes)\n- btrfs: validate qgroup inherit for SNAP_CREATE_V2 ioctl (git-fixes)\n- ecryptfs: fix a memory leak bug in ecryptfs_init_messaging() (git-fixes)\n- ecryptfs: fix a memory leak bug in parse_tag_1_packet() (git-fixes)\n- ecryptfs: fix kernel panic with null dev_name (git-fixes)\n- ecryptfs: Fix typo in message (git-fixes)\n- ep_create_wakeup_source(): dentry name can change under you (git-fixes)\n- exportfs_decode_fh(): negative pinned may become positive without the parent locked (git-fixes)\n- fscrypt: clean up some BUG_ON()s in block encryption/decryption (git-fixes)\n- fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes (git-fixes)\n- ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (git-fixes).\n- ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (git-fixes).\n- kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes).\n- KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M (git-fixes bsc#1225059).\n- l2tp: pass correct message length to ip6_append_data (git-fixes).\n- lib/mpi: use kcalloc in mpi_resize (git-fixes).\n- list: fix a data-race around ep-\u003erdllist (git-fixes).\n- livepatch: Fix missing newline character in klp_resolve_symbols() (bsc#1223539).\n- mass-cve: Add convenience KBUILD_USER environment variable\n- mass-cve: Always use bash in Makefile Some constrcts are just too convenient to leave them in favor of POSIX'd /bin/sh. Switch to explicit bash.\n- mass-cve: Fail early without data files curl \u003e$@ would create/update the file even if download fails. Use explicit argument to prevent continuation with empty cve2bugzilla file.\n- mass-cve: Fix update detection with packed-refs Per-branch files are thing of the past, git may non-deterministically pack the ref files. Therefore use the timestamp of the whole packed-ref file (better false positive detection of update than breakage or false negative). Add unified approach to read packed-refs regardless of KSOURCE_GIT worktree or not.\n- mass-cve: Make BRANCH mandatory\n- mass-cve: Use dedicated worktree for reference updates So that any checkout in KSOURCE_GIT is not changed.\n- net: 9p: avoid freeing uninit memory in p9pdu_vreadf (git-fixes).\n- netfilter: nf_queue: augment nfqa_cfg_policy (git-fixes).\n- netfilter: nft_compat: explicitly reject ERROR and standard target (git-fixes).\n- netfilter: x_tables: set module owner for icmp(6) matches (git-fixes).\n- net/smc: fix fallback failed while sendmsg with fastopen (git-fixes).\n- net: tcp: fix unexcepted socket die when snd_wnd is 0 (git-fixes).\n- net/tls: Remove the context from the list in tls_device_down (bsc#1221545).\n- net: usb: ax88179_178a: stop lying about skb-\u003etruesize (git-fixes).\n- net: usb: smsc95xx: stop lying about skb-\u003etruesize (git-fixes).\n- net: usb: sr9700: stop lying about skb-\u003etruesize (git-fixes).\n- net: vmxnet3: Fix NULL pointer dereference in vmxnet3_rq_rx_complete() (bsc#1223360).\n- nfc: change order inside nfc_se_io error path (git-fixes).\n- powerpc/pseries/lparcfg: drop error message from guest name lookup (bsc#1187716 ltc#193451 git-fixes).\n- ppdev: Add an error check in register_device (git-fixes).\n- printk: Disable passing console lock owner completely during panic() (bsc#1197894).\n- printk: Update @console_may_schedule in console_trylock_spinning() (bsc#1223969).\n- rds: avoid unenecessary cong_update in loop transport (git-fixes).\n- rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp (git-fixes).\n- ring-buffer: Clean ring_buffer_poll_wait() error return (git-fixes).\n- ring-buffer: Fix a race between readers and resize checks (bsc#1222893).\n- rxrpc: Do not put crypto buffers on the stack (git-fixes).\n- rxrpc: Fix a memory leak in rxkad_verify_response() (git-fixes).\n- rxrpc: Provide a different lockdep key for call-\u003euser_mutex for kernel calls (git-fixes).\n- rxrpc: The mutex lock returned by rxrpc_accept_call() needs releasing (git-fixes).\n- rxrpc: Work around usercopy check (git-fixes).\n- s390/cpum_cf: make crypto counters upward compatible across machine types (bsc#1224347).\n- s390/pci: fix max size calculation in zpci_memcpy_toio() (git-fixes bsc#1225062).\n- scripts/check-kernel-fix: add -F parameter\n- scripts/check-kernel-fix: avoid rechecking child branches when parents are OK Topological sorted dependency tree allows to optimize check-kernel-fixe in cases where parent already has the fix. There is not reason to check branches which merge from that branch as they will get the fix eventually.\n- scripts/check-kernel-fix: print a message when no action is needed. Script exits without printing anything about the actions necessary in non-verbose mode. This can be confusing to a beginner user.\n- scripts/common-functions: for_each_build_branch traverse branches in dependency topo sorted list\n- scripts/common-functions: There are cases where Fixes tag is incorrect. Example would be bsc1223062 comment 3.\n- scripts/cve_tools: Update README Issue was fixed in ad3235427c3\n- scripts/git_sort/git_sort.py: add rafael/linux-pm.git#linux-next to remotes\n- scripts/log2: Fix References: update detection The following change -REferences: git-fixes +REferences: git-fixes bsc#123456 (note the typo in E) will not be detected as a reference update and generates a commit message like \n- scripts/PMU: Always use 12 digits for abbreviated hash references Kernel developers tend to use 12 digits for abbreviated hash references as this is mandatory for upstream work. Enforce this count in PMU for consistency.\n- tcp: tcp_make_synack() can be called from process context (git-fixes).\n- tls: Fix context leak on tls_device_down (bsc#1221545).\n- tracing: Fix blocked reader of snapshot buffer (git-fixes).\n- tracing: hide unused ftrace_event_id_fops (git-fixes).\n- tracing: Use .flush() call to wake up readers (git-fixes).\n- tracing: Use strncpy instead of memcpy when copying comm in trace.c (git-fixes).\n- tty/sysrq: replace smp_processor_id() with get_cpu() (bsc#1223540).\n- usb: aqc111: stop lying about skb-\u003etruesize (git-fixes).\n- wifi: cfg80211: avoid leaking stack data into trace (git-fixes).\n- wifi: radiotap: fix kernel-doc notation warnings (git-fixes).\n","status":"published","published":"2024-06-24T18:34:20Z","modified":"2026-02-04T02:22:33.44664Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:4367-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-48853: swiotlb: fix info leak with DMA_FROM_DEVICE (bsc#1228015).\n- CVE-2024-26801: Bluetooth: Avoid potential use-after-free in hci_error_reset (bsc#1222413).\n- CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).\n- CVE-2024-26886: Bluetooth: af_bluetooth: Fix deadlock (bsc#1223044).\n- CVE-2024-27051: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value (bsc#1223769).\n- CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).\n- CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).\n- CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).\n- CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).\n- CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).\n- CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).\n- CVE-2024-46771: can: bcm: Remove proc entry when dev is unregistered (bsc#1230766).\n- CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).\n- CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).\n- CVE-2024-47660: fsnotify: clear PARENT_WATCHED flags lazily (bsc#1231439).\n- CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()\u0026iput() (bsc#1231930).\n- CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).\n- CVE-2024-49858: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption (bsc#1232251).\n- CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).\n- CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).\n- CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)\n- CVE-2024-49938: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit (bsc#1232552).\n- CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).\n- CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).\n- CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).\n- CVE-2024-50044: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (bsc#1231904).\n- CVE-2024-50055: driver core: bus: Fix double free in driver API bus_register() (bsc#1232329).\n- CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).\n- CVE-2024-50074: parport: Proper fix for array out-of-bounds access (bsc#1232507).\n- CVE-2024-50095: RDMA/mad: Improve handling of timed out WRs of mad agent (bsc#1232873).\n- CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).\n- CVE-2024-50117: drm/amd: Guard against bad data for ATIF ACPI method (bsc#1232897).\n- CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).\n- CVE-2024-50135: nvme-pci: fix race condition between reset and nvme_dev_disable() (bsc#1232888).\n- CVE-2024-50148: Bluetooth: bnep: fix wild-memory-access in proto_unregister (bsc#1233063).\n- CVE-2024-50150: usb: typec: altmode should keep reference to parent (bsc#1233051).\n- CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).\n- CVE-2024-50167: be2net: fix potential memory leak in be_xmit() (bsc#1233049).\n- CVE-2024-50171: net: systemport: fix potential memory leak in bcm_sysport_xmit() (bsc#1233057).\n- CVE-2024-50183: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (bsc#1233130).\n- CVE-2024-50187: drm/vc4: Stop the active perfmon before being destroyed (bsc#1233108).\n- CVE-2024-50195: posix-clock: Fix missing timespec64 check in pc_clock_settime() (bsc#1233103).\n- CVE-2024-50218: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow (bsc#1233191).\n- CVE-2024-50234: wifi: iwlegacy: Clear stale interrupts before resuming device (bsc#1233211).\n- CVE-2024-50236: wifi: ath10k: Fix memory leak in management tx (bsc#1233212).\n- CVE-2024-50237: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower (bsc#1233216).\n- CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk-\u003etrans (bsc#1233453).\n- CVE-2024-50265: ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() (bsc#1233454).\n- CVE-2024-50267: usb: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).\n- CVE-2024-50273: btrfs: reinitialize delayed ref list after deleting it from the list (bsc#1233462).\n- CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).\n- CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).\n- CVE-2024-50289: media: av7110: fix a spectre vulnerability (bsc#1233478).\n- CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).\n- CVE-2024-50296: net: hns3: fix kernel crash when uninstalling driver (bsc#1233485).\n- CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).\n- CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).\n- CVE-2024-53058: net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data (bsc#1233552).\n- CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).\n- CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).\n- CVE-2024-53066: nfs: Fix KMSAN warning in decode_getfattr_attrs() (bsc#1233560).\n- CVE-2024-53085: tpm: Lock TPM chip in tpm_pm_suspend() first (bsc#1082555 bsc#1233577).\n- CVE-2024-53088: i40e: fix race condition by adding filter's intermediate sync state (bsc#1233580).\n- CVE-2024-53104: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (bsc#1234025).\n- CVE-2024-53114: x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client (bsc#1234072).\n\nThe following non-security bugs were fixed:\n\n- drm/vc4: Warn if some v3d code is run on BCM2711 (bsc#1233108).\n- initramfs: avoid filename buffer overrun (bsc#1232436).\n- kernel-binary: Enable livepatch package only when livepatch is enabled (bsc#1218644).\n- lpfc: size cpu map by last cpu id set (bsc#1157160).\n- net: relax socket state check at accept time (git-fixes).\n- ocfs2: uncache inode which has failed entering the group (bsc#1234087).\n","status":"published","published":"2024-12-17T17:59:49Z","modified":"2025-05-02T04:32:08.33354Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0035-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-48853: swiotlb: fix info leak with DMA_FROM_DEVICE (bsc#1228015).\n- CVE-2024-26801: Bluetooth: Avoid potential use-after-free in hci_error_reset (bsc#1222413).\n- CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).\n- CVE-2024-26886: Bluetooth: af_bluetooth: Fix deadlock (bsc#1223044).\n- CVE-2024-27051: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value (bsc#1223769).\n- CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).\n- CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).\n- CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).\n- CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).\n- CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).\n- CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).\n- CVE-2024-46771: can: bcm: Remove proc entry when dev is unregistered (bsc#1230766).\n- CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).\n- CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).\n- CVE-2024-47660: fsnotify: clear PARENT_WATCHED flags lazily (bsc#1231439).\n- CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()\u0026iput() (bsc#1231930).\n- CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).\n- CVE-2024-49858: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption (bsc#1232251).\n- CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (bsc#1232272).\n- CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).\n- CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)\n- CVE-2024-49938: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit (bsc#1232552).\n- CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).\n- CVE-2024-49950: Bluetooth: L2CAP: Fix uaf in l2cap_connect (bsc#1232159).\n- CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).\n- CVE-2024-50044: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (bsc#1231904).\n- CVE-2024-50055: driver core: bus: Fix double free in driver API bus_register() (bsc#1232329).\n- CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (bsc#1232520).\n- CVE-2024-50074: parport: Proper fix for array out-of-bounds access (bsc#1232507).\n- CVE-2024-50095: RDMA/mad: Improve handling of timed out WRs of mad agent (bsc#1232873).\n- CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).\n- CVE-2024-50117: drm/amd: Guard against bad data for ATIF ACPI method (bsc#1232897).\n- CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).\n- CVE-2024-50135: nvme-pci: fix race condition between reset and nvme_dev_disable() (bsc#1232888).\n- CVE-2024-50148: Bluetooth: bnep: fix wild-memory-access in proto_unregister (bsc#1233063).\n- CVE-2024-50150: usb: typec: altmode should keep reference to parent (bsc#1233051).\n- CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).\n- CVE-2024-50167: be2net: fix potential memory leak in be_xmit() (bsc#1233049).\n- CVE-2024-50171: net: systemport: fix potential memory leak in bcm_sysport_xmit() (bsc#1233057).\n- CVE-2024-50183: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (bsc#1233130).\n- CVE-2024-50187: drm/vc4: Stop the active perfmon before being destroyed (bsc#1233108).\n- CVE-2024-50195: posix-clock: Fix missing timespec64 check in pc_clock_settime() (bsc#1233103).\n- CVE-2024-50218: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow (bsc#1233191).\n- CVE-2024-50234: wifi: iwlegacy: Clear stale interrupts before resuming device (bsc#1233211).\n- CVE-2024-50236: wifi: ath10k: Fix memory leak in management tx (bsc#1233212).\n- CVE-2024-50237: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower (bsc#1233216).\n- CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk-\u003etrans (bsc#1233453).\n- CVE-2024-50265: ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() (bsc#1233454).\n- CVE-2024-50267: usb: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).\n- CVE-2024-50273: btrfs: reinitialize delayed ref list after deleting it from the list (bsc#1233462).\n- CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).\n- CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).\n- CVE-2024-50289: media: av7110: fix a spectre vulnerability (bsc#1233478).\n- CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).\n- CVE-2024-50296: net: hns3: fix kernel crash when uninstalling driver (bsc#1233485).\n- CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).\n- CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).\n- CVE-2024-53058: net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data (bsc#1233552).\n- CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).\n- CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).\n- CVE-2024-53066: nfs: Fix KMSAN warning in decode_getfattr_attrs() (bsc#1233560).\n- CVE-2024-53085: tpm: Lock TPM chip in tpm_pm_suspend() first (bsc#1082555 bsc#1233577).\n- CVE-2024-53088: i40e: fix race condition by adding filter's intermediate sync state (bsc#1233580).\n- CVE-2024-53104: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (bsc#1234025).\n- CVE-2024-53114: x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client (bsc#1234072).\n\nThe following non-security bugs were fixed:\n\n- drm/vc4: Warn if some v3d code is run on BCM2711 (bsc#1233108).\n- initramfs: avoid filename buffer overrun (bsc#1232436).\n- kernel-binary: Enable livepatch package only when livepatch is enabled (bsc#1218644).\n- lpfc: size cpu map by last cpu id set (bsc#1157160).\n- net: relax socket state check at accept time (git-fixes).\n- ocfs2: uncache inode which has failed entering the group (bsc#1234087).\n","status":"published","published":"2025-01-08T09:47:34Z","modified":"2025-05-02T04:32:08.398412Z","updated_at":"2026-11-02T15:53:56.123059Z"}]}}